CVE-2026-34486
KEV
🔴 Łataj teraz
Brak szyfrowania danych w Apache Tomcat umożliwia ich nieautoryzowany dostęp.
CVSS
7.5
EPSS
82.9%
Exploit
weaponized
Vendor
redhat
Opis źródłowy (NVD)
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
brak
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.5 |
| CISA KEV (aktywnie wykorzystywane) | Tak |
| FIRST EPSS (prawdopodobieństwo exploita) | 82.9% |
| Opublikowano (NVD) | 2026-04-09 20:16:25 UTC |
| Ostatnia modyfikacja (NVD) | 2026-08-10 13:19:04 UTC |
Referencje
- https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly (security@apache.org) [Mailing List, Vendor Advisory]
- https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat (af854a3a-2127-422b-91ae-364da2661108) [Third Party Advisory]
- https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat (af854a3a-2127-422b-91ae-364da2661108) [Mitigation, Third Party Advisory]
- https://access.redhat.com/errata/RHSA-2026:36787 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://access.redhat.com/errata/RHSA-2026:36788 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://access.redhat.com/errata/RHSA-2026:36789 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://access.redhat.com/errata/RHSA-2026:36790 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://access.redhat.com/errata/RHSA-2026:36876 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://access.redhat.com/errata/RHSA-2026:36877 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://access.redhat.com/errata/RHSA-2026:36878 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://access.redhat.com/errata/RHSA-2026:36879 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://access.redhat.com/errata/RHSA-2026:37136 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://access.redhat.com/errata/RHSA-2026:37137 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://access.redhat.com/errata/RHSA-2026:38505 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://access.redhat.com/errata/RHSA-2026:39188 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://access.redhat.com/errata/RHSA-2026:39189 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://access.redhat.com/security/cve/CVE-2026-34486 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://bugzilla.redhat.com/show_bug.cgi?id=2457027 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Issue Tracking, Third Party Advisory]
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json (0b0ca135-0b70-47e7-9f44-1890c2a1c46c) [Third Party Advisory]
- https://socradar.io/blog/snowlight-government-chinese-campaign/ (134c704f-9b21-4f2e-91b3-4a467353bcc0) [Third Party Advisory]
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486 (134c704f-9b21-4f2e-91b3-4a467353bcc0) [US Government Resource]