{"id":"tomcat-encryption-bypass-attacks-aug-2026","category":"patch","status":"closed","title":"Apache Tomcat encryption bypass CVE-2026-34486 used in attacks; fixes available","tldr":"Attackers are exploiting an encryption bypass in Apache Tomcat clustered servers. Affected releases are 11.0.20, 10.1.53 and 9.0.116. Ask your IT provider to update to a current supported release and check for data exposure.","summary":"Apache Tomcat, software used to run Java websites and business applications, has an encryption bypass in its EncryptInterceptor component. This component protects information exchanged between servers in a cluster. An earlier security fix introduced the flaw, potentially leaving sensitive information unencrypted. Apache identifies exactly three affected releases: 11.0.20, 10.1.53 and 9.0.116. It publicly disclosed the issue on 9 April and directed users to fixed versions 11.0.21, 10.1.54 and 9.0.117. CISA added the vulnerability to its exploited catalogue on 4 August, and Singapore's Cyber Security Agency subsequently urged patching and checks for data exposure. As at 3 November, fixes are available for all three affected Apache branches. The reviewed sources do not establish the number of victims or the scale of information exposed; CISA lists ransomware involvement as unknown.","action":"Nothing to install on your family's phones or browsers. If your business or family office runs Tomcat, ask its IT provider to replace 11.0.20, 10.1.53 or 9.0.116 with a current supported release containing the fix, and check for unauthorised access or data exposure. For Tomcat bundled into another product, obtain the supplier's confirmed security update.","product":"Apache Tomcat clustered application servers","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-34486"],"tags":["apache","tomcat","server","encryption-bypass","information-disclosure","actively-exploited"],"affected":["Apache Tomcat 11.0.20","Apache Tomcat 10.1.53","Apache Tomcat 9.0.116"],"fixed":["Apache Tomcat 11.0.21","Apache Tomcat 10.1.54","Apache Tomcat 9.0.117"],"matches":[],"sources":[{"kind":"advisory","title":"Apache advisory: CVE-2026-34486 EncryptInterceptor bypass","url":"https://www.openwall.com/lists/oss-security/2026/04/09/27","by":"Apache","date":"2026-04-09"},{"kind":"advisory","title":"Apache Tomcat 11 vulnerabilities","url":"https://tomcat.apache.org/security-11.html","by":"Apache","date":"2026-04-09"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"},{"kind":"advisory","title":"Missing Encryption Vulnerability in Apache Tomcat","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-102/","by":"Cyber Security Agency of Singapore","date":"2026-08-07"},{"kind":"advisory","title":"CVE-2026-34486","url":"https://access.redhat.com/security/cve/cve-2026-34486","by":"Red Hat","date":"2026-04-09"}],"started":"2026-08-04","closed":"2026-08-07","created":"2026-11-03T22:18:28.663Z","updated":"2026-11-03T22:18:28.663Z","cve_notes":[{"cve":"CVE-2026-34486","name":"Encryption bypass in Tomcat's EncryptInterceptor","what":"An error introduced by an earlier Tomcat security fix lets attackers bypass EncryptInterceptor, potentially exposing sensitive information exchanged between clustered servers without encryption.","severity":"high","cvss":7.5}],"timeline":[{"at":"2026-08-07","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Singapore's Cyber Security Agency warned that exploitation could expose sensitive information exchanged between Tomcat cluster servers. It advised administrators to update and check for unauthorised access or data exposure.","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-102/","by":"Cyber Security Agency of Singapore","patch":null},{"at":"2026-08-04","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-34486 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. Its entry does not identify victims and lists ransomware use as unknown.","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-04-09","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Apache disclosed an encryption bypass affecting Tomcat 11.0.20, 10.1.53 and 9.0.116. It identified 11.0.21, 10.1.54 and 9.0.117 as the fixed releases.","url":"https://www.openwall.com/lists/oss-security/2026/04/09/27","by":"Apache","patch":"patched"}],"url":"https://hard.fyi/live/tomcat-encryption-bypass-attacks-aug-2026/","json":"https://hard.fyi/api/live?id=tomcat-encryption-bypass-attacks-aug-2026"}