CVE-2026-34486 Details.
Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution
Atlas does not check this one. Not a plain web check.
This weakness is not found through ordinary web pages. It needs a different kind of connection to the service. Atlas only runs plain web, DNS and TLS checks, so it does not run this one.
About CVE-2026-34486. What It Means.
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.
Affected Product. What Is Hit.
- Vendor
- apache
- Product
- Apache Tomcat
More CVEs In Apache Tomcat.
- CVE-2019-0232HighApache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code ExecutionApacheCVSS8.1
- CVE-2000-0760MediumJakarta Tomcat 3.1 and 3.0 - Information DisclosureApacheCVSS6.4
- CVE-2023-45648MediumApache Tomcat - HTTP Request SmugglingApacheCVSS5.3
- CVE-2026-50229MediumInformation onlyApache Tomcat - Cross-Site ScriptingApacheCVSS—
FAQ
Common Questions.
Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution. Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.
No. This weakness is not found through ordinary web pages. It needs a different kind of connection to the service. Atlas only runs plain web, DNS and TLS checks, so it does not run this one. The facts about CVE-2026-34486 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
Yes. CVE-2026-34486 is on the CISA Known Exploited Vulnerabilities list, which means attackers have used it against real targets.
Update Apache Tomcat to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-34486. Atlas does not run a check for it, so nothing here says whether a particular site is affected.