CVE-2026-34486
Missing Encryption of Sensitive Data in Apache Tomcat. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 4 August 2026.
- Product
- Apache Tomcat
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- No known use in ransomware campaigns
- Vendor advisories
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
More from Apache this year.
- CVE-2016-3081 Command Injection, added
- CVE-2026-34197 Improper Input Validation, added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.