CVE.RADIO
FREN

CVE-2026-34486

Apache TomcatActively Exploited (CISA KEV)CVSS 7.5KEV0-Day

Actively exploited (CISA KEV) - patch before 2026-08-07

Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor.

Actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No distribution fix is listed yet; apply vendor mitigations and monitor.

Recommended action: No fix is published yet for an actively-exploited flaw. Apply vendor mitigations, restrict exposure, and watch for a patch.

CVE-2026-34486 Apache Tomcat Actively Exploited (CISA KEV)

Severity metrics

CVSS 3.1 : 7.5 HIGH

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
Confidentiality impactHigh
Integrity impactNone
Availability impactNone

Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected & fixed versions by distribution

Versions are the native distribution strings (backport-aware): RHEL/Debian/SUSE backport fixes, so compare with the distro version comparator (dpkg / rpm / vercmp), not the upstream version.

No affected package in the tracked watchlist yet (Debian, Ubuntu, Arch, SUSE, Red Hat...). Triage may still be pending.

Sources

Advisory NVD CVE.org

Other vulnerabilities in Apache Tomcat

Published 2026-08-04 · source: CISA Known Exploited Vulnerabilities