[KEV] CVE-2026-34486 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-34486 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-34486 is a missing-encryption vulnerability in Apache Tomcat that permits bypass of the EncryptInterceptor component used to protect sensitive data in applicable Tomcat communications.

Technical Detail

The flaw allows the EncryptInterceptor's encryption protections to be bypassed, resulting in sensitive data being transmitted or handled without the intended encryption control. The available information does not identify the precise request format, affected Tomcat versions, or required deployment conditions. Successful exploitation can expose sensitive data to unauthorized disclosure; the supplied data does not indicate remote code execution, privilege escalation, or authentication bypass.

Exploitation Status

Exploit maturity is assessed as Operational, meaning exploitation capability is available for use in real-world operations. CISA has confirmed active exploitation in the wild. The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on August 4, 2026.

Who Is Targeting This

Reported (research-inferred): EVILNUM, LOTUSBLOSSOM, DARKCARACAL, AXIOM, and AGRIUS. These attributions are reported with medium confidence and are not ATTAX-verified confirmations. No confirmed threat actor attribution is available.

What To Do

Prioritize remediation of exposed and production Apache Tomcat deployments. Apply the vendor-provided fix or upgrade to a supported Tomcat release containing the correction when available, and verify that EncryptInterceptor protections are enabled and operating as intended in affected configurations. Restrict access to Tomcat cluster and management communication paths to authorized systems only, segment those paths from untrusted networks, and review network telemetry for unexpected unencrypted sensitive traffic involving Tomcat systems. CISA's Binding Operational Directive requires federal civilian agencies to patch by the CISA-specified remediation due date or apply mitigations; the supplied KEV data does not provide that date. No specific indicators of compromise or detection signatures were supplied.