CVE-2026-34486

CVE-2026-34486: Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Vendor Apache Software Foundation
Product Apache Tomcat
Weakness CWE-311 · Missing encryption
KEV Status Known Exploited
Published April 9, 2026
Last update August 6, 2026
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

CISA mandated remediation

02CISA Required Action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Key dates

03Disclosure timeline

April 9, 2026 CVE published
August 6, 2026 Record updated

External resources

04References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-34486 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/311.html AskarLabs — CWE-311 write-up Missing Encryption of Sensitive Data CISA KEV Reference https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly CISA KEV Reference https://www.cisa.gov/news-events/directives/bod-26-04-prioriti… CISA KEV Reference https://www.cisa.gov/news-events/directives/bod-26-04-implemen… CISA KEV Reference https://nvd.nist.gov/vuln/detail/CVE-2026-34486