CVE-2026-34486
Published: 09 April 2026
Summary
CVE-2026-34486 is a high-severity Missing Encryption of Sensitive Data (CWE-311) vulnerability in Apache Tomcat. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 1.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of flaws, directly mitigating CVE-2026-34486 by upgrading Apache Tomcat to fixed versions 11.0.21, 10.1.54, or 9.0.117.
Mandates cryptographic mechanisms to protect sensitive data from unauthorized disclosure, countering the EncryptInterceptor bypass that caused missing encryption.
Implements transmission confidentiality protections, providing layered cryptographic defense against sensitive data exposure exploited via the Tomcat vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote unauthenticated flaw in Apache Tomcat (a public-facing application server) that bypasses EncryptInterceptor to disclose sensitive data, directly enabling exploitation of public-facing applications for confidentiality impact.
NVD Description
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117,…
more
which fix the issue.
Deeper analysisAI
CVE-2026-34486 is a Missing Encryption of Sensitive Data vulnerability (CWE-311) in Apache Tomcat, arising from the fix implemented for CVE-2026-29146 that enables bypass of the EncryptInterceptor. This issue affects Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning unauthenticated attackers can exploit it remotely over the network with low attack complexity and no user interaction required. Exploitation results in high-impact confidentiality loss, allowing disclosure of sensitive data that should have been protected by encryption.
Apache Tomcat advisories recommend upgrading to mitigated versions 11.0.21, 10.1.54, or 9.0.117 to address the bypass. Further details are provided in the official announcement at https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly.
Details
- CWE(s)