CVE 2026 34486

nvd.nist.gov • August 8, 2026

Share: View original

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in Apache Tomcat Expose Sensitive Data Risks Two critical vulnerabilities have been identified in Apache Tomcat, CVE-2026-34486 and CVE-2026-29146. CVE-2026-34486 allows bypassing of the EncryptInterceptor due to missing encryption of sensitive data, affecting versions 11.0.20, 10.1.53, and 9.0.116. CVE-2026-29146 is a Padding Oracle vulnerability impacting earlier versions from 11.0.0-M1 to 11.0.18, among others. Users are urged to upgrade to the latest versions to mitigate these risks. The vulnerabilities were published on April 9, 2026, and the first public proof of concept for CVE-2026-34486 was released on April 15, 2026. The scope of impact includes a wide range of Apache Tomcat versions, making it critical for users to act promptly. 2 sources 69

Extracted Entities

CVEs (2)

CVE-2026-29146 CVE-2026-34486

CWE Weaknesses (1)

CWE-311 - Missing Encryption of Sensitive Data

Platforms (1)

Vulnerabilities (1)

Missing Encryption Of Sensitive Data Vulnerability