{
    "id": "CVE-2026-34486",
    "published": "2026-04-09 20:16:25",
    "last_modified": "2026-09-21 19:17:04",
    "cvss_score": "7.5",
    "cvss_severity": "HIGH",
    "cvss_version": "3.1",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
    "cwe": "CWE-311",
    "description": "Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\n\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.",
    "epss_score": "0.06561",
    "epss_percentile": "0.93586",
    "kev": 1,
    "kev_due": "2026-08-07",
    "has_exploit": 0,
    "updated_at": "2026-09-27 18:17:57",
    "priority": {
        "rank": 1,
        "label": "Patch first",
        "why": "On CISA KEV — known exploited in the wild, due 2026-08-07."
    },
    "products": [
        {
            "vendor": "apache",
            "product": "tomcat"
        },
        {
            "vendor": "redhat",
            "product": "enterprise_linux"
        },
        {
            "vendor": "redhat",
            "product": "enterprise_linux_els"
        },
        {
            "vendor": "redhat",
            "product": "enterprise_linux_eus"
        },
        {
            "vendor": "redhat",
            "product": "enterprise_linux_tus"
        },
        {
            "vendor": "redhat",
            "product": "enterprise_linux_update_services_for_sap_solutions"
        },
        {
            "vendor": "redhat",
            "product": "jboss_web_server"
        }
    ],
    "kev_detail": {
        "cve_id": "CVE-2026-34486",
        "date_added": "2026-08-04",
        "due_date": "2026-08-07",
        "vendor": "Apache",
        "product": "Tomcat",
        "name": "Apache Tomcat Missing Encryption of Sensitive Data Vulnerability",
        "ransomware": 0
    },
    "exploits": [],
    "refs_list": [
        "https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly",
        "https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat",
        "https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat",
        "https://access.redhat.com/errata/RHSA-2026:36787",
        "https://access.redhat.com/errata/RHSA-2026:36788",
        "https://access.redhat.com/errata/RHSA-2026:36789",
        "https://access.redhat.com/errata/RHSA-2026:36790",
        "https://access.redhat.com/errata/RHSA-2026:36876",
        "https://access.redhat.com/errata/RHSA-2026:36877",
        "https://access.redhat.com/errata/RHSA-2026:36878",
        "https://access.redhat.com/errata/RHSA-2026:36879",
        "https://access.redhat.com/errata/RHSA-2026:37136",
        "https://access.redhat.com/errata/RHSA-2026:37137",
        "https://access.redhat.com/errata/RHSA-2026:38505",
        "https://access.redhat.com/errata/RHSA-2026:39188",
        "https://access.redhat.com/errata/RHSA-2026:39189",
        "https://access.redhat.com/security/cve/CVE-2026-34486",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2457027",
        "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json",
        "https://socradar.io/blog/snowlight-government-chinese-campaign/",
        "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486"
    ]
}