CVE-2026-34486

Act now ● On CISA KEV — actively exploited

Actively exploited — on the CISA KEV list.

CVSS base

7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS — probability of exploitation (30 days)

98.6%

99.9th percentile

CISA KEV

Listed

Added 2026-08-04 · patch by 2026-08-07

Weakness / dates

CWE-807

Published 2026-04-09 · modified 2026-08-10

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	N	None
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	H	High
Integrity	N	None
Availability	N	None

Timeline

2026-04-09 — Published (NVD)
2026-08-04 — Added to CISA KEV (actively exploited)
2026-08-07 — CISA patch-by deadline
2026-08-10 — Last modified (NVD)

Description

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Affected

apache redhat

References

Official: NVD · CVE.org