CVE-2026-34486

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 7.5EPSS 7%

Published 2026-04-09Updated 2026-08-06

Exploited in the wildMedia 12334PoC

Vulnerability details

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CNAapache

EPSS score history

Sources

12 links

PoC links are not available for guest users. Login to view them.

CISA Known Exploited CVEShield CVE Organization RedHat Vuln DB NVD Analysis The Hacker News Bleeping Computer Tenable Blog The Hacker News The Hacker News Unit42 EUVD

Profile

CVSS

7.5

EPSS

Published

2026-04-09

Updated

2026-08-06

CNA

apache

Vendors

Apache Software Foundation

1 product

CPEs

cpe:/o:redhat:enterprise_linux:10

cpe:/o:redhat:enterprise_linux:6

cpe:/o:redhat:enterprise_linux:7

cpe:/o:redhat:enterprise_linux:8

cpe:/o:redhat:enterprise_linux:9

cpe:/a:redhat:jboss_enterprise_web_server:5

cpe:/a:redhat:jboss_enterprise_web_server:6

cpe:/o:redhat:enterprise_linux_eus:10.0

cpe:/o:redhat:enterprise_linux:10.2

cpe:/a:redhat:enterprise_linux:8::appstream

cpe:/a:redhat:rhel_e4s:8.8::appstream

cpe:/a:redhat:rhel_tus:8.8::appstream

cpe:/a:redhat:rhel_e4s:9.2::appstream

cpe:/a:redhat:rhel_e4s:9.4::appstream

cpe:/a:redhat:rhel_eus:9.6::appstream

cpe:/a:redhat:enterprise_linux:9::appstream

cpe:/o:redhat:rhel_els:7

cpe:/a:redhat:enterprise_linux:8

cpe:/a:redhat:rhel_tus:8.8

cpe:/a:redhat:rhel_e4s:8.8

cpe:/a:redhat:enterprise_linux:9

cpe:/a:redhat:rhel_e4s:9.2

cpe:/a:redhat:rhel_e4s:9.4

cpe:/a:redhat:rhel_eus:9.6

cpe:/a:redhat:jboss_enterprise_web_server:7.0

cpe:/a:redhat:jboss_enterprise_web_server:7.0::el10

cpe:/a:redhat:jboss_enterprise_web_server:7.0::el8

cpe:/a:redhat:jboss_enterprise_web_server:7.0::el9

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated