CVE-2026-34486

Apache Tomcat und Tomcat Native: Mehrere Schwachstellen

Debian Linux, Amazon Linux 2, IBM Power Hardware Management Console, Red Hat Enterprise Linux, SUSE Linux, Oracle…

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

9. Apr 2026

Ausgewertete Quellen

• Red Hat
  https://access.redhat.com/errata/RHSA-2026:36787
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:36788
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:36789
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:36790
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:36876
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:36877
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:36878
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:36879
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:37136
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:37137
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:38505
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:39188
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:39189
• Red Hat
  https://access.redhat.com/security/cve/CVE-2026-34486
• Red Hat
  https://bugzilla.redhat.com/show_bug.cgi?id=2457027
• Red Hat
  https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json
• Hersteller
  https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
• Hinweis
  https://socradar.io/blog/snowlight-government-chinese-campaign/
• Hinweis
  https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat
• Hinweis
  https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat
• CERT-Bund
  WID-SEC-2026-1038
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486
• CISA
  Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
• NVD
  CVE-2026-34486