CVE-2026-34486

Katalog CVE

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 6,6%

Kerentanan Missing Encryption of Sensitive Data pada apache tomcat, redhat jboss web server +5 lainnya. Skor CVSS 3.1 7.5 (High) menurut CISA ADP. Masuk katalog KEV CISA pada 4 Agustus 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Advisory KUTIM-CSIRT

• Peringatan Keamanan: 4 Kerentanan Kritis Apache Tomcat (CVSS 9,8) pada Autentikasi dan Akses 24 Sep 2026
• Peringatan Keamanan: Kerentanan CVE-2026-34486 Pelewatan EncryptInterceptor pada Apache Tomcat 5 Agt 2026

Rincian

Terbit di NVD

9 April 2026

Terakhir diubah

21 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-311: Missing Encryption of Sensitive Data
CWE-807: Reliance on Untrusted Inputs in a Security Decision

EPSS (30 hari)

6,6% peluang dieksploitasi; lebih tinggi dari 93,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

Masuk KEV

4 Agustus 2026

Tenggat CISA

7 Agustus 2026 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly mailing list · advisory vendor
• https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat mitigasi · advisory pihak ketiga
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486 pemerintah AS
• https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:36787 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:36788 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:36789 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:36790 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:36876 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:36877 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:36878 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:36879 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:37136 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:37137 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:38505 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:39188 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:39189 advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2026-34486 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2457027 issue tracking · advisory pihak ketiga
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json advisory pihak ketiga
• https://socradar.io/blog/snowlight-government-chinese-campaign/ advisory pihak ketiga