CVE-2026-34486 — Vulnerability in org.apache.tomcat:tomcat-tribes...

• First published April 9, 2026 (185 days ago).
• Last revised September 10, 2026 — 153 days after initial publication.
• Added to CISA's Known Exploited Vulnerabilities catalog 116 days after publication.

• CWE-311
  Missing Encryption of Sensitive DataMITRE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• https://nvd.nist.gov/vuln/detail/CVE-2026-34486
  ADVISORY
• https://github.com/apache/tomcat/commit/1fab40ccc752e22639eccfe290d5624afad7eccd
  WEB
• https://github.com/apache/tomcat/commit/55f3eb9148233054fccfdf761141c6894a050be1
  WEB
• https://github.com/apache/tomcat/commit/776e12b3e2b0b4507b8a3b62c187ceb0b74bf418
  WEB
• https://github.com/apache/tomcat
  PACKAGE
• https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
  WEB
• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.54
  WEB
• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.21
  WEB
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.117
  WEB
• https://www.herodevs.com/vulnerability-directory/cve-2026-34486
  WEB
• https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat
  WEB
• https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat
  WEB

What is CVE-2026-34486?

Apache Tomcat Missing Encryption of Sensitive Data vulnerability This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).

How do I check if my project is affected by CVE-2026-34486?

CVE-2026-34486 affects org.apache.tomcat:tomcat-tribes and org.apache.tomcat:tomcat. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning it is being actively exploited in the wild. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-34486 and 200,000+ other known vulnerabilities.