SECURELYN
Free ScanFree consultation

CVE-2026-34486

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Scores

7.5
CVSS 7.5 out of 10, high severity.
6.6%
EPSS 6.6% chance of exploitation in the next 30 days.

The facts

Published
9 April 2026
Last changed
21 September 2026
NVD status
Analyzed
Severity
High, CVSS 7.5 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
Affects
  • apache tomcat
  • redhat jboss web server
  • redhat enterprise linux
  • redhat enterprise linux els
  • redhat enterprise linux eus
Known exploited
Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 August 2026.
EPSS
6.6% chance of exploitation activity in the next 30 days (percentile 94).

Is there a Securelyn advisory?

Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.

References