{"schemaVersion":3,"id":"CVE-2026-34486","aliases":["UBUNTU-CVE-2026-34486","CGA-f993-jcr3-wjw5","CGA-hjgc-vf5q-g8vv","CGA-mrjm-qr3m-977j","GHSA-69r9-qgr7-g2wj","BIT-tomcat-2026-34486","CGA-wg6w-6fpf-f6vq","CGA-x3vx-wp9c-vwp8"],"status":"published","duplicateOf":null,"title":"Apache Tomcat Missing Encryption of Sensitive Data Vulnerability","description":"Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\n\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.","dates":{"published":"2026-04-09T19:35:35.994Z","modified":"2026-09-21T19:43:41.203Z","reserved":null,"kevAdded":["2026-08-04T00:00:00.000Z"],"kevDue":["2026-08-07T00:00:00.000Z"]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.06561,"percentile":0.93742,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":-92.05499999999999,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.98616},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.06561,"percentile":0.93742}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.98616,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.06561,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.06561,"percentile":0.93742}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2026-08-04T00:00:00.000Z","dueDate":"2026-08-07T00:00:00.000Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","name":"Apache Tomcat Missing Encryption of Sensitive Data Vulnerability","description":"Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.","notes":[{"type":"url","href":"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly","label":"lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly"},{"type":"text","value":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"},{"type":"text","value":"Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2026-34486","label":"nvd.nist.gov/vuln/detail/CVE-2026-34486"}],"vendor":"Apache","product":"Tomcat","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2026-08-04T00:00:00.000Z","dueDate":"2026-08-07T00:00:00.000Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","name":"Apache Tomcat Missing Encryption of Sensitive Data Vulnerability","description":"Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.","notes":[{"type":"url","href":"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly","label":"lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly"},{"type":"text","value":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"},{"type":"text","value":"Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2026-34486","label":"nvd.nist.gov/vuln/detail/CVE-2026-34486"}],"vendor":"Apache","product":"Tomcat","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-311","name":"Missing Encryption of Sensitive Data","description":"The product does not encrypt sensitive or critical information before storage or transmission.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/311.html"},{"id":"CWE-807","name":"Reliance on Untrusted Inputs in a Security Decision","description":"The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/807.html"}],"affected":[{"vendor":"apache software foundation","product":"apache tomcat","name":"Apache Tomcat","label":"apache tomcat","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"11.0.20","noFixRecorded":false,"fixedIn":null},{"text":"10.1.53","noFixRecorded":false,"fixedIn":null},{"text":"9.0.116","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.0.20 | 10.1.53 | 9.0.116","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_tomcat"},{"vendor":"apache","product":"tomcat","name":"Tomcat","label":"tomcat","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"9.0.116","noFixRecorded":false,"fixedIn":null},{"text":"10.1.53","noFixRecorded":false,"fixedIn":null},{"text":"11.0.20","noFixRecorded":false,"fixedIn":null}],"versionsText":"9.0.116 | 10.1.53 | 11.0.20","eol":{"isEol":false,"eolDate":"2027-03-31T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"9.0","label":"9.0","eolFrom":"2027-03-31T00:00:00.000Z","isLts":false,"isMaintained":true,"latestVersion":"9.0.123"},"product":{"name":"tomcat","label":"Apache Tomcat","category":"server-app"}},"hubHref":"/vendor/apache/tomcat"},{"vendor":"chainguard","product":"nacos","name":"nacos","label":"nacos","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nacos","purlType":"apk","versions":[{"text":"< 3.2.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.0-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ontop","name":"ontop","label":"ontop","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ontop","purlType":"apk","versions":[{"text":"< 5.5.0-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.5.0-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ontop-fips","name":"ontop-fips","label":"ontop-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ontop-fips","purlType":"apk","versions":[{"text":"< 5.5.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.5.0-r4","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"tomcat8","name":"tomcat8","label":"tomcat8","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/tomcat8","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"org.apache.tomcat","product":"tomcat","name":"org.apache.tomcat:tomcat","label":"tomcat","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.tomcat/tomcat","purlType":"maven","versions":[{"text":"≥ 11.0.20, < 11.0.21","noFixRecorded":false,"fixedIn":null},{"text":"≥ 10.1.53, < 10.1.54","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.116, < 9.0.117","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 11.0.20, < 11.0.21 | ≥ 10.1.53, < 10.1.54 | ≥ 9.0.116, < 9.0.117","eol":null,"hubHref":null},{"vendor":"org.apache.tomcat","product":"tomcat-tribes","name":"org.apache.tomcat:tomcat-tribes","label":"tomcat-tribes","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.tomcat/tomcat-tribes","purlType":"maven","versions":[{"text":"≥ 11.0.20, < 11.0.21","noFixRecorded":false,"fixedIn":null},{"text":"≥ 10.1.53, < 10.1.54","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.116, < 9.0.117","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 11.0.20, < 11.0.21 | ≥ 10.1.53, < 10.1.54 | ≥ 9.0.116, < 9.0.117","eol":null,"hubHref":null},{"vendor":"redhat","product":"enterprise_linux","name":"enterprise linux","label":"enterprise_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"8.0","noFixRecorded":false,"fixedIn":null},{"text":"9.0","noFixRecorded":false,"fixedIn":null},{"text":"10.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.0 | 9.0 | 10.0","eol":{"isEol":false,"eolDate":"2029-05-31T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"8","label":"8 (Upcoming ELS)","eolFrom":"2029-05-31T00:00:00.000Z","isLts":false,"isMaintained":true,"latestVersion":"8.10"},"product":{"name":"rhel","label":"Red Hat Enterprise Linux","category":"os"}},"hubHref":"/vendor/redhat/enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_els","name":"enterprise linux els","label":"enterprise_linux_els","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_els"},{"vendor":"redhat","product":"enterprise_linux_eus","name":"enterprise linux eus","label":"enterprise_linux_eus","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"10.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"10.0","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_tus","name":"enterprise linux tus","label":"enterprise_linux_tus","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"8.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.8","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_tus"},{"vendor":"redhat","product":"enterprise_linux_update_services_for_sap_solutions","name":"enterprise linux update services for sap solutions","label":"enterprise_linux_update_services_for_sap_solutions","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"8.8","noFixRecorded":false,"fixedIn":null},{"text":"9.2","noFixRecorded":false,"fixedIn":null},{"text":"9.4","noFixRecorded":false,"fixedIn":null},{"text":"9.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.8 | 9.2 | 9.4 | 9.6","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_update_services_for_sap_solutions"},{"vendor":"redhat","product":"jboss_web_server","name":"jboss web server","label":"jboss_web_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0.0","eol":null,"hubHref":"/vendor/redhat/jboss_web_server"}],"affectedCount":14,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly","label":"lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly","hostname":"lists.apache.org","tags":["Vendor Advisory","REPORT","Advisory","WEB","Mailing List"]},{"url":"https://socradar.io/blog/snowlight-government-chinese-campaign/","label":"socradar.io/blog/snowlight-government-chinese-campaign/","hostname":"socradar.io","tags":["Third Party Advisory","Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486","hostname":"www.cisa.gov","tags":["Government Resource","WEB","US Government Resource"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat","label":"www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat","hostname":"www.vicarius.io","tags":["WEB","Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat","label":"www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat","hostname":"www.vicarius.io","tags":["WEB","Mitigation","Third Party Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34486","label":"access.redhat.com/security/cve/CVE-2026-34486","hostname":"access.redhat.com","tags":["VDB Entry","X Refsource REDHAT","Advisory","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457027","label":"bugzilla.redhat.com/show_bug.cgi?id=2457027","hostname":"bugzilla.redhat.com","tags":["Issue Tracking","X Refsource REDHAT","REPORT","Third Party Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","label":"security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","hostname":"security.access.redhat.com","tags":["X Sadp Csaf Vex","WEB","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:39188","label":"access.redhat.com/errata/RHSA-2026:39188","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:38505","label":"access.redhat.com/errata/RHSA-2026:38505","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36787","label":"access.redhat.com/errata/RHSA-2026:36787","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36789","label":"access.redhat.com/errata/RHSA-2026:36789","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36788","label":"access.redhat.com/errata/RHSA-2026:36788","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36790","label":"access.redhat.com/errata/RHSA-2026:36790","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37137","label":"access.redhat.com/errata/RHSA-2026:37137","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37136","label":"access.redhat.com/errata/RHSA-2026:37136","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36878","label":"access.redhat.com/errata/RHSA-2026:36878","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36876","label":"access.redhat.com/errata/RHSA-2026:36876","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36877","label":"access.redhat.com/errata/RHSA-2026:36877","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36879","label":"access.redhat.com/errata/RHSA-2026:36879","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:39189","label":"access.redhat.com/errata/RHSA-2026:39189","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory","Third Party Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34486","label":"ubuntu.com/security/CVE-2026-34486","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34486","label":"www.cve.org/CVERecord?id=CVE-2026-34486","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog","hostname":"www.cisa.gov","tags":["REPORT"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34486.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34486.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34486","label":"nvd.nist.gov/vuln/detail/CVE-2026-34486","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/apache/tomcat/commit/1fab40ccc752e22639eccfe290d5624afad7eccd","label":"github.com/apache/tomcat/commit/1fab40ccc752e22639eccfe290d5624afad7eccd","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/tomcat/commit/55f3eb9148233054fccfdf761141c6894a050be1","label":"github.com/apache/tomcat/commit/55f3eb9148233054fccfdf761141c6894a050be1","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/tomcat/commit/776e12b3e2b0b4507b8a3b62c187ceb0b74bf418","label":"github.com/apache/tomcat/commit/776e12b3e2b0b4507b8a3b62c187ceb0b74bf418","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/tomcat","label":"github.com/apache/tomcat","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.54","label":"tomcat.apache.org/security-10.html","hostname":"tomcat.apache.org","tags":["WEB"]},{"url":"https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.21","label":"tomcat.apache.org/security-11.html","hostname":"tomcat.apache.org","tags":["WEB"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.117","label":"tomcat.apache.org/security-9.html","hostname":"tomcat.apache.org","tags":["WEB"]},{"url":"https://www.herodevs.com/vulnerability-directory/cve-2026-34486","label":"www.herodevs.com/vulnerability-directory/cve-2026-34486","hostname":"www.herodevs.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":["MGASA-2026-0095","OPENSUSE-SU-2026:10547-1","OPENSUSE-SU-2026:10548-1","OPENSUSE-SU-2026:10549-1","OPENSUSE-SU-2026:20595-1","OPENSUSE-SU-2026:20611-1","OPENSUSE-SU-2026:20612-1","RHSA-2026:36787","RHSA-2026:36788","RHSA-2026:36789","RHSA-2026:36790","RHSA-2026:36876","RHSA-2026:36877","RHSA-2026:36878","RHSA-2026:36879","RHSA-2026:37136","RHSA-2026:37137","RHSA-2026:38505","RHSA-2026:39188","SUSE-SU-2026:1558-1","SUSE-SU-2026:1572-1","SUSE-SU-2026:1603-1","SUSE-SU-2026:1604-1"],"duplicates":[],"related":["CGA-H965-C2P6-V66R","OPENSUSE-SU-2026:10547-1","OPENSUSE-SU-2026:10548-1","OPENSUSE-SU-2026:10549-1","OPENSUSE-SU-2026:20595-1","OPENSUSE-SU-2026:20611-1","OPENSUSE-SU-2026:20612-1","SUSE-SU-2026:1558-1","SUSE-SU-2026:1572-1","SUSE-SU-2026:1603-1","SUSE-SU-2026:1604-1"]},"timeline":[{"kind":"published","date":"2026-04-09T19:35:35.994Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2026-08-04T00:00:00.000Z","label":"Added to CISA KEV","detail":"Apache Tomcat Missing Encryption of Sensitive Data Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2026-08-07T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2026-09-21T19:43:41.203Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T08:58:03.418Z","stale":false,"partial":false}}