Tomcat TLS bypass exploited in the wild (CVE-2026-34486) [PoC]
CVE-2026-34486
CVE-2026-34486: Apache Tomcat 9.0.116-11.0.20 TLS interceptor bypass exposes private data, actively exploited. Upgrade to 9.0.117, 10.1.54, or 11.0.21.
Actively exploited in the wild - CVE-2026-34486 is a high-severity encryption bypass in Apache Tomcat 9.0.116, 10.1.53, and 11.0.20 that lets unauthenticated attackers intercept or read sensitive data transmitted through the server. Patched versions are available; upgrade immediately to prevent data exposure.
Overview
CVE-2026-34486 is a missing encryption of sensitive data vulnerability in Apache Tomcat. The issue stems from an incomplete fix for an earlier vulnerability, CVE-2026-29146, which allowed attackers to bypass the EncryptInterceptor. This interceptor is a security mechanism designed to enforce TLS encryption on communication between Tomcat components. When bypassed, data that should be encrypted travels in plaintext, making it readable by anyone able to observe the network traffic.
The vulnerability affects Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116. It is rated HIGH with a CVSS score of 7.5, reflecting the low attack complexity and lack of required privileges or user interaction. An attacker can exploit this issue remotely over the network without any authentication.
The practical impact is significant. Any sensitive data passed between Tomcat components - such as session tokens, credentials, or internal application data - becomes exposed to network-level eavesdropping. In a shared or compromised network environment, this could allow an attacker to capture authentication material and impersonate legitimate users or extract confidential information.
Remediation
Apache Tomcat has released patched versions that fully resolve the interceptor bypass. Upgrade to the following versions immediately:
- 11.0.21 for users on 11.0.20
- 10.1.54 for users on 10.1.53
- 9.0.117 for users on 9.0.116
This vulnerability is confirmed in the CISA Known Exploited Vulnerabilities (KEV) catalog with active exploitation reported. Given the EPSS score of 42.6% probability of exploitation in the next 30 days, delaying the patch carries substantial risk. Review your Tomcat deployment inventory and prioritize affected instances for patching within your organization’s standard remediation window. For any Tomcat instances that cannot be patched immediately, consider network-level monitoring for plaintext traffic as a temporary mitigation.
Security Insight
This incident follows a pattern of incomplete patches creating secondary vulnerabilities. Each fix must be tested not only for its intended effect but also for regressions in adjacent security controls. The rapid addition to CISA KEV, similar to the recent Apache ActiveMQ CVE-2026-34197 added to CISA KEV catalog, underscores how quickly attackers weaponize known weaknesses in widely deployed infrastructure components. Organizations should treat every security patch as an opportunity to audit the entire security control chain, not just the specific flaw being addressed.
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Am I Affected by CVE-2026-34486?
Pick an ecosystem, paste your installed version, and we'll compare it against the fixed version published on OSV.dev. Browser-only — nothing is sent to a server.
Heuristic comparison only. Always cross-check against the vendor advisory before making patching decisions.
Public PoC References
Unverified third-party code
These repositories are publicly listed on GitHub and have not been audited by Yazoul Security. They may contain malware, backdoors, destructive payloads, or operational security risks (telemetry, exfiltration). Treat them as hostile binaries. Inspect source before execution. Run only in isolated, disposable lab environments (offline VM, no credentials, no production data).
Authorized use only. This information is provided for defensive research, detection engineering, and patch validation. Using exploit code against systems you do not own or do not have explicit written permission to test is illegal in most jurisdictions and violates Yazoul's terms of use.
| Repository | Stars |
|---|---|
| razureink/cve-2026-34486-tomcat_encrypt_bypass_reproduction CVE Reproduction: cve-2026-34486-tomcat_encrypt_bypass_reproduction | ★ 0 |
Showing 1 of 1 known references. Source: nomi-sec/PoC-in-GitHub.
Nuclei Detection Templates
Detection template available — your exposure is being scanned
The templates below are YAML signatures for the Nuclei scanner from ProjectDiscovery. They are not exploit code — they are detection rules that confirm whether a target is vulnerable. The presence of a Nuclei template means every bug bounty hunter, AppSec team, red team, and reconnaissance pipeline on the public internet is actively probing for this CVE.
Assume your exposed instances have already been touched. Patch immediately even if no exploitation is observed yet — fingerprinting precedes exploitation by days at most.
| Template | Source |
|---|---|
CVE-2026-34486.yaml | View YAML |
1 Nuclei template indexed for this CVE. Source: projectdiscovery/nuclei-templates.
Related Advisories
Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata ...
Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by sub...
Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code th...
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution....