CVE-2026-34486
Redhat Enterprise Linux Update Services For Sap Solutions 8.8 … 9.6
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2026-34486 is a high-severity Missing Encryption of Sensitive Data (CWE-311) vulnerability in Redhat Enterprise Linux Update Services For Sap Solutions. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked in the top 0.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and SC-13 (Cryptographic Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-34486 is a Missing Encryption of Sensitive Data vulnerability in Apache Tomcat that arises because the prior fix for CVE-2026-29146 can be bypassed, allowing the EncryptInterceptor to be circumvented. The flaw affects Tomcat versions 11.0.20, 10.1.53, and 9.0.116 and carries a CVSS 3.1 score of 7.5 with network attack vector and high confidentiality impact under CWE-311.
An unauthenticated attacker with network access can exploit the bypass to read sensitive data that should have been protected by the interceptor, without needing user interaction or elevated privileges.
The Apache Tomcat project advises immediate upgrade to the patched releases 11.0.21, 10.1.54, or 9.0.117; the project mailing list and third-party detection and mitigation resources provide further guidance on applying the fixes. The associated EPSS score remains low with only a modest peak, indicating limited observed exploitation interest to date.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21056
Vulnerability Data
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117,…
more
which fix the issue.
- CWE(s)
- KEV Date Added
- 04 August 2026
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 8 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
SC-13 mandates use of specific cryptography, structurally preventing unencrypted sensitive data.
Explicitly requires that every access decision be based on authoritative, protected decision data rather than caller-supplied inputs.
SC-28 requires cryptographic protection of information at rest, eliminating the storage half of the weakness.
SC-8 requires protecting confidentiality of transmitted information, directly stopping missing encryption on the wire.
Input validation can reject malformed or attacker-controlled values before they reach a security decision point.
Access enforcement requires decisions to be made from trusted policy data rather than modifiable client-supplied inputs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Strong authentication mechanisms directly prevent security decisions from depending on modifiable, untrusted inputs.
Verification and protection of identity assertions stops reliance on attacker-controlled values for authorization decisions.
PR.DS-01 directly mandates encryption for data-at-rest and therefore prevents CWE-311 mostly for storage, yet the weakness also spans transmission and other contexts that this single at-rest control leaves unaddressed.
Proper management of identities/credentials reduces the chance that security decisions will be driven by untrusted inputs.
Policy-driven, least-privilege authorization reduces opportunities to bypass controls via tampered inputs.
PR.DS-02 directly eliminates the transmission facet of CWE-311 via mandatory encryption but leaves the storage facet untouched, so each direction rates only partial.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards directly prohibit using untrusted inputs for security-critical decisions.
Security testing in development catches input-validation flaws before deployment.
Explicit rules requiring encryption for sensitive information in transit eliminate the weakness of sending data without cryptographic protection.
Monitoring can detect exploitation but does not stop the underlying weakness.
Explicitly calling for protection of data in transit and at rest, plus secure encryption of communications, drives the implementation of encryption that prevents clear-text exposure of sensitive information.
Secure architecture principles mandate treating all external inputs as untrusted.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. prevents CWE-311
Oracle Linux 9 (1 rule)
- V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-311
RHEL 8 (1 rule)
- V-230224 All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-311
RHEL 9 (1 rule)
- V-257879 RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-311
Windows Server 2016 (1 rule)
- V-224843 Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. prevents CWE-311
Windows Server 2019 (1 rule)
- V-205727 Windows Server 2019 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. prevents CWE-311