Known vulnerability record

CVE-2026-34486

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

Stable IDcve:CVE-2026-34486Source record date2026-08-10Human reviewNot recordedProvenanceSource-linked CVE, KEV, and EPSS signals

Summary

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.

Vulns.co field classification

Security control bypass on server and framework

Derived analysis: these labels are inferred from the source title, product, and summary. They are not vendor, CVE, CISA, or FIRST classifications.

Failure classSecurity control bypass

Product laneServer and framework

Attention stateKnown exploited, ransomware use unknown

Hunter pivot

Identify the control, its normalization point, and the alternate path that may disagree. Keep an accepted and rejected control beside every candidate variation.

Signals

Keep the signals separate

CVSS severityhighScore 7.5 · source CISA-ADP

EPSS probability98.6%Probability of exploitation in the next 30 days; not severity

CISA KEVKnown exploitedAdded 2026-08-04

Ransomware useunknownPreserved as known / unknown, not a truthy default

Research boundary

Confirm the product before the behavior.

Match the exact product, build, deployment mode, and exposed component.
Read the vendor advisory and current program policy.
Choose one non-destructive discriminator with an explicit negative control.
Stop at the first sufficient proof. A CVE match is context, not permission.

Timeline

Dates and provenance

CVE published: 2026-04-09
CVE modified: 2026-08-10
KEV date added: 2026-08-04
Dataset fetched: 2026-08-25T13:17:11.066Z

Sources

Original records

Version history: normalized permanent page created 2026-08-20. Machine-enriched fields remain source-attributed.