CVE-2026-34486: Apache Tomcat Encryption Flaw Actively Exploited

CVE-2026-34486: Apache Tomcat Encryption Flaw Actively Exploited

In short

CVE-2026-34486 is a vulnerability in Apache Tomcat that allows bypassing the encryption of sensitive data managed by the EncryptInterceptor component [1]. It has a CVSS score of 7.5, classified by NVD as "high" severity [1], was published on April 9, 2026 [1], and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it is already being leveraged in real-world attacks [2]. It affects Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116; the vendor itself recommends updating to 11.0.21, 10.1.54, or 9.0.117 [1]. If your organization uses Tomcat, check the version today and plan the update as a high priority.

What it is and why it matters

According to the official record, this vulnerability arises because the fix applied for a previous CVE (CVE-2026-29146) introduced a way to bypass the EncryptInterceptor, the mechanism in Tomcat designed to encrypt sensitive data [1]. In practice, this means that information that should travel encrypted may end up exposed without that encryption, in applications that relied on Tomcat to guarantee it [1].

This is not a flaw that directly allows someone to "break into" the system, but rather the loss of a protection that many applications take for granted. The real risk depends on what data each specific application handles: the more sensitive the information passing through that component, the greater the potential impact if someone intercepts it.

Our internal threat radar at OCIRIA prioritizes this vulnerability as critical, not so much because of the CVSS score —which NVD places at "high," not the maximum level— but because of its confirmed active exploitation in the KEV catalog [2]. This is a criterion worth keeping in mind: many organizations prioritize patches based solely on the CVSS rating and overlook the fact that being listed in KEV is usually a more reliable signal of urgency than the number itself.

Who is affected

The vendors listed as affected in the official record are Apache and Red Hat [1]. We do not have verified data on the size or sector of the organizations most exposed, so we cannot claim that it affects one type of company more than another: any organization running the Tomcat versions mentioned —whether directly or as part of a third-party platform— should be considered potentially affected.

How to know if you are vulnerable

The first step is to identify whether your organization has instances of Apache Tomcat running versions 11.0.20, 10.1.53, or 9.0.116 [1], whether on your own servers, in internal applications, or in third-party products that use Tomcat as an application server. It is also worth reviewing which Tomcat-based services and applications are exposed to the internet, since the externally accessible surface is the one that should be checked and prioritized first.

How to protect yourself

• Take inventory of where Apache Tomcat is deployed and which version is running, including environments managed by third parties.
• Update to the fixed versions: 11.0.21, 10.1.54, or 9.0.117, depending on the branch you use [1].
• If you cannot update immediately, manually verify that the encryption of sensitive data in your applications does not rely solely on Tomcat's EncryptInterceptor.
• Since this vulnerability is listed in KEV with active exploitation [2], treat it as a high priority in your patching cycle, ahead of other vulnerabilities with a similar CVSS score but without confirmed exploitation.
• Review logs and traffic for signs of improper access if you have had vulnerable versions exposed for an extended period.

Frequently asked questions

Is this vulnerability being exploited right now?

Yes, CVE-2026-34486 is listed in CISA's KEV catalog, which tracks vulnerabilities with confirmed active exploitation [2].

Which versions of Apache Tomcat are vulnerable?

Versions 11.0.20, 10.1.53, and 9.0.116; the fixed versions are 11.0.21, 10.1.54, and 9.0.117 [1].

Is this a critical vulnerability?

NVD classifies it with "high" severity and a CVSS score of 7.5 [1]. Its presence in CISA's KEV catalog [2] is, in our assessment, sufficient reason to treat it as a critical priority in the patching plan, even though the technical score is not the maximum.

Does it only affect Apache products?

According to the official record, the affected vendors are Apache and Red Hat [1]; no additional products beyond Apache Tomcat are detailed.

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-34486
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json