CVE-2026-34486 Apache Software Foundation Apache Tomcat
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version…
- CVSS
- 7.5 High
- EPSS
- 99%
- Percentile
- 100
- Published
- 2026-04-09
- Force
- 10 of 12
- Public PoC
- 5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
On CISA’s exploited list
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- Added
- 2026-08-04
- Federal patch deadline
- 2026-08-07
- Ransomware use
- not known