HIGHCVSS 7.5Actively exploited · CISA KEV since 2026-08-04Vulnerability

CVE-2026-34486

Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.

Properties

Vulnerability name
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Epss score
0.06561
Last seen
2026-10-19T12:00:27+00:00
Due date
2026-08-07
Exploited euvd since
2026-08-04T00:00:00+00:00
Date added
2026-08-04
Source url
https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
Ghsa updated
2026-04-15T22:36:07Z
Euvd base score version
3.1
Score
7.5
Euvd vendor
Apache Software Foundation
In Signal since
initial import (Sep 2026)
Euvd base score
7.5
Is ghsa only
false
Vendor project
Apache
Content hash
08f346e05af1758d387fb721ef6b9fd7e1859b4fb875f6808c28c26d69d7e3e2
Published at
2026-04-09T20:16:25.063
Euvd updated
2026-09-21T19:43:41+00:00
Last modified
2026-09-21T19:17:04.670
Euvd epss pct
6.56

Related Entities (26)

AFFECTS_PRODUCT (14)

→[Product]cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:10.1.53:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:redhat:enterprise_linux_els:7.0:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:11.0.20:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:apache:tomcat:9.0.116:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:redhat:jboss_web_server:7.0.0:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*

AFFECTS (4)

→[Software]maven/org.apache.tomcat:tomcat-tribes
→[Software]maven/org.apache.tomcat:tomcat
→[Software]maven/org.apache.tomcat.embed:tomcat-embed-core
→[Software]maven/org.apache.tomcat:tomcat-catalina

VULNERABLE_TO (4)

←[Software]maven/org.apache.tomcat:tomcat-tribes
←[Software]maven/org.apache.tomcat:tomcat-catalina
←[Software]maven/org.apache.tomcat.embed:tomcat-embed-core
←[Software]maven/org.apache.tomcat:tomcat

HAS_WEAKNESS (2)

→[Weakness]Reliance on Untrusted Inputs in a Security Decision
→[Weakness]Missing Encryption of Sensitive Data

DESCRIBES (1)

←[KEVEntry]Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

INVOLVES (1)

←[Signal]kev_added · 2026-08-04

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-34486 (CVSS 7.5) — Ninja Signal Threat Intelligence | Ninja Signal