🔥 This vulnerability is being actively exploited in the wild (CISA Known Exploited Vulnerabilities catalog)
CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Summary
Apache Tomcat has a vulnerability where the EncryptInterceptor (a security feature that encrypts sensitive data) can be bypassed, leaving data unprotected. This vulnerability is currently being actively exploited by attackers in the wild. Organizations must apply vendor-provided mitigations by August 7, 2026, following CISA's BOD 26-04 guidance on prioritizing security updates.
Solution / Mitigation
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk guidance. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Consult the Apache Tomcat vendor advisory at https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly for specific patching details.
Vulnerability Details
EPSS: 42.6%
Yes
🔥 Actively Exploited
August 3, 2026
Classification
Taxonomy References
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-34486
First tracked: August 4, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 65%