Apache Tomcat encryption bypass CVE-2026-34486 used in attacks; fixes available
Attackers are exploiting an encryption bypass in Apache Tomcat clustered servers. Affected releases are 11.0.20, 10.1.53 and 9.0.116. Ask your IT provider to update to a current supported release and check for data exposure.
Nothing to install on your family's phones or browsers. If your business or family office runs Tomcat, ask its IT provider to replace 11.0.20, 10.1.53 or 9.0.116 with a current supported release containing the fix, and check for unauthorised access or data exposure. For Tomcat bundled into another product, obtain the supplier's confirmed security update.
What’s happening
Apache Tomcat, software used to run Java websites and business applications, has an encryption bypass in its EncryptInterceptor component. This component protects information exchanged between servers in a cluster. An earlier security fix introduced the flaw, potentially leaving sensitive information unencrypted. Apache identifies exactly three affected releases: 11.0.20, 10.1.53 and 9.0.116. It publicly disclosed the issue on 9 April and directed users to fixed versions 11.0.21, 10.1.54 and 9.0.117. CISA added the vulnerability to its exploited catalogue on 4 August, and Singapore's Cyber Security Agency subsequently urged patching and checks for data exposure. As at 3 November, fixes are available for all three affected Apache branches. The reviewed sources do not establish the number of victims or the scale of information exposed; CISA lists ransomware involvement as unknown.
- What
- Flaw
- Affects
- Apache Tomcat clustered application servers
- Affected
- Apache Tomcat 11.0.20
Apache Tomcat 10.1.53
Apache Tomcat 9.0.116 - Fixed in
- Apache Tomcat 11.0.21
Apache Tomcat 10.1.54
Apache Tomcat 9.0.117 - Since
- 4 Aug 2026
- Closed
- 7 Aug 2026
Timeline
- Update
Singapore's Cyber Security Agency warned that exploitation could expose sensitive information exchanged between Tomcat cluster servers. It advised administrators to update and check for unauthorised access or data exposure.
- CISA added
CISA added CVE-2026-34486 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. Its entry does not identify victims and lists ransomware use as unknown.
- Made publicFixed
Apache disclosed an encryption bypass affecting Tomcat 11.0.20, 10.1.53 and 9.0.116. It identified 11.0.21, 10.1.54 and 9.0.117 as the fixed releases.
Sources
- Apache advisory: CVE-2026-34486 EncryptInterceptor bypassApache · 9 Apr 2026
- Apache Tomcat 11 vulnerabilitiesApache · 9 Apr 2026
- Known Exploited Vulnerabilities catalogueCISA · 3 Nov 2026
- Missing Encryption Vulnerability in Apache TomcatCyber Security Agency of Singapore · 7 Aug 2026
- CVE-2026-34486Red Hat · 9 Apr 2026