Vulnpedia
← All CVEs

CVE-2026-34486

HIGH 7.5 KNOWN EXPLOITED PoC CATALOGUED DETECTION TEMPLATE ALL-YEARS

Published 2026-04-09 · Last modified 2026-09-21 · apache · NVD: Analyzed

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

ACTIVELY EXPLOITED

Confirmed exploited in the wild — in CISA KEV since 2026-08-04. Patch or mitigate now.

Exploitation likelihood

98.5%chance of exploitation in 30 days · 100th percentile

● In CISA KEV (2026-08-04)● Catalogued PoC◆ SSVC: exploitation active, automatable yes

Impact if exploited

7.5CVSS 3.1 · HIGH · ADP

  • ConfidentialityHigh
  • IntegrityNone
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

Public PoC or exploit resources are catalogued below.

Listed by the named source; Vulnpedia has not tested these resources.

PoC data: JSON

Detection templates

Detection checks are listed separately from PoCs.

Resource commands

nuclei -id CVE-2026-34486 -u https://TARGETDetection template — review its checks and affected versions before use.
curl -s https://vulnpedia.com/cve/CVE-2026-34486/poc.jsonMachine-readable PoC index for this CVE (for automation).

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Apache Software Foundation Red Hat Apache Redhat

Products Apache Tomcat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat Enterprise Linux 7 Extended Lifecycle Support Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat Enterprise Linux 8.8 Update Services For Sap Solutions Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 9.2 Update Services For Sap Solutions Red Hat Enterprise Linux 9.4 Update Services For Sap Solutions Red Hat Enterprise Linux 9.6 Extended Update Support Red Hat Jboss Web Server 7.0.0 Red Hat Jboss Web Server 7.0 On Rhel 10 Red Hat Jboss Web Server 7.0 On Rhel 8 Red Hat Jboss Web Server 7.0 On Rhel 9 Red Hat Enterprise Linux 6 Red Hat Jboss Web Server 5 Red Hat Jboss Web Server 6 Tomcat Jboss Web Server Enterprise Linux Enterprise Linux Els Enterprise Linux Eus Enterprise Linux Tus Enterprise Linux Update Services For Sap Solutions

Weakness (CWE)

  • CWE-311: Missing Encryption of Sensitive Data
  • CWE-807: Reliance on Untrusted Inputs in a Security Decision

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • org.apache.tomcat:tomcat-tribes Maven

    pkg:maven/org.apache.tomcat/tomcat-tribes

    ECOSYSTEM range
    • Introduced version (included): 11.0.20
    • Fixed boundary (excluded): 11.0.21
    1 explicitly listed affected versions

    11.0.20

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69r9-qgr7-g2wj/GHSA-69r9-qgr7-g2wj.json"
  }
}
    GitHub Advisory Database · GHSA-69r9-qgr7-g2wj · Updated 2026-09-10T03:50:43.551259310Z
  • org.apache.tomcat:tomcat-tribes Maven

    pkg:maven/org.apache.tomcat/tomcat-tribes

    ECOSYSTEM range
    • Introduced version (included): 10.1.53
    • Fixed boundary (excluded): 10.1.54
    1 explicitly listed affected versions

    10.1.53

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69r9-qgr7-g2wj/GHSA-69r9-qgr7-g2wj.json"
  }
}
    GitHub Advisory Database · GHSA-69r9-qgr7-g2wj · Updated 2026-09-10T03:50:43.551259310Z
  • org.apache.tomcat:tomcat-tribes Maven

    pkg:maven/org.apache.tomcat/tomcat-tribes

    ECOSYSTEM range
    • Introduced version (included): 9.0.116
    • Fixed boundary (excluded): 9.0.117
    1 explicitly listed affected versions

    9.0.116

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69r9-qgr7-g2wj/GHSA-69r9-qgr7-g2wj.json"
  }
}
    GitHub Advisory Database · GHSA-69r9-qgr7-g2wj · Updated 2026-09-10T03:50:43.551259310Z
  • org.apache.tomcat:tomcat Maven

    pkg:maven/org.apache.tomcat/tomcat

    ECOSYSTEM range
    • Introduced version (included): 11.0.20
    • Fixed boundary (excluded): 11.0.21
    1 explicitly listed affected versions

    11.0.20

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69r9-qgr7-g2wj/GHSA-69r9-qgr7-g2wj.json"
  }
}
    GitHub Advisory Database · GHSA-69r9-qgr7-g2wj · Updated 2026-09-10T03:50:43.551259310Z
  • org.apache.tomcat:tomcat Maven

    pkg:maven/org.apache.tomcat/tomcat

    ECOSYSTEM range
    • Introduced version (included): 10.1.53
    • Fixed boundary (excluded): 10.1.54
    1 explicitly listed affected versions

    10.1.53

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69r9-qgr7-g2wj/GHSA-69r9-qgr7-g2wj.json"
  }
}
    GitHub Advisory Database · GHSA-69r9-qgr7-g2wj · Updated 2026-09-10T03:50:43.551259310Z
  • org.apache.tomcat:tomcat Maven

    pkg:maven/org.apache.tomcat/tomcat

    ECOSYSTEM range
    • Introduced version (included): 9.0.116
    • Fixed boundary (excluded): 9.0.117
    1 explicitly listed affected versions

    9.0.116

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69r9-qgr7-g2wj/GHSA-69r9-qgr7-g2wj.json"
  }
}
    GitHub Advisory Database · GHSA-69r9-qgr7-g2wj · Updated 2026-09-10T03:50:43.551259310Z

Vendor product assessments

Showing 32 of 226 vendor product statements; 194 omitted. Read the full vendor advisory.

  • jws7-tomcat-0:11.0.21-5.redhat_00004.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_00004.1.el10jws?arch=noarch

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat-jsp-2.2-api-0:7.0.76-18.el7_9.noarch as a component of Red Hat Enterprise Linux Server (v. 7 ELS) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_9?arch=noarch

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • jws7-tomcat-admin-webapps-0:11.0.21-5.redhat_00004.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_00004.1.el8jws?arch=noarch

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • jws7-tomcat-jsp-3.1-api-0:11.0.21-5.redhat_00004.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_00004.1.el9jws?arch=noarch

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat9-1:9.0.87-6.el10_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0?arch=src&epoch=1

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat-lib-1:10.1.49-3.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=noarch&epoch=1

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat-docs-webapp-1:9.0.87-2.el8_10.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=noarch&epoch=1

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat-1:9.0.87-2.el8_8.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=noarch&epoch=1

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat-lib-1:9.0.87-2.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=noarch&epoch=1

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat-docs-webapp-1:9.0.87-4.el9_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_6?arch=noarch&epoch=1

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • Red Hat JBoss Web Server 7.0.0 · fixed

    Vendor assessment for this product only.

    • vendor fix: Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files. The References section of this erratum contains a download link for the update. You must be logged in to download the update. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat6 as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat6

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat6-admin-webapps as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat6-admin-webapps

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat6-el-2.1-api as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat6-el-2.1-api

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat6-javadoc as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat6-javadoc

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat6-jsp-2.1-api as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat6-jsp-2.1-api

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat6-lib as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat6-lib

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat6-servlet-2.5-api as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat6-servlet-2.5-api

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat6-webapps as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat6-webapps

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat6.src as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat6?arch=src

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • pki-servlet-engine as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/pki-servlet-engine

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • pki-servlet-engine.src as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/pki-servlet-engine?arch=src

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • jws7-build-0:1-1.el10jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]?arch=x86_64

    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • jws7-jboss-logging-0:3.6.2-1.Final_redhat_00001.1.el10jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_redhat_00001.1.el10jws?arch=src

    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • jws7-tomcat-native-0:1.3.7-2.redhat_2.el10jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_2.el10jws?arch=x86_64

    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • jws7-ecj-0:4.38.0-1.redhat_00001.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_00001.1.el8jws?arch=noarch

    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • jws7-mod_cluster-0:2.1.0-1.Final_redhat_00001.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_redhat_00001.1.el8jws?arch=noarch

    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • jws7-tomcat-native-debuginfo-0:1.3.7-2.redhat_2.el8jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_2.el8jws?arch=x86_64

    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • jws7-javapackages-filesystem-0:6.0.0-1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]?arch=noarch

    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • jws7-mod_cluster-0:2.1.0-1.Final_redhat_00001.1.el9jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_redhat_00001.1.el9jws?arch=src

    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • jws7-tomcat-vault-0:1.1.11-4.Final_redhat_00003.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_redhat_00003.1.el9jws?arch=noarch

    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00
  • tomcat as a component of Red Hat JBoss Web Server 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:maven/org.apache.tomcat/tomcat

    Red Hat · CVE-2026-34486 · Updated 2026-08-07T19:13:47+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

5 candidates

Additional exploitation reports

Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.

  • VulnCheck KEV · 2026-07-30T00:00:00Z

    Source guidance: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

    Source ransomware assessment: Unknown

    VulnCheck KEV · CVE-2026-34486 · Updated 2026-07-30T00:00:00Z
  • VulnCheck KEV · 2026-07-30T00:00:00ZVulnCheck KEV · CVE-2026-34486
  • VulnCheck KEV · 2026-07-31T00:00:00ZVulnCheck KEV · CVE-2026-34486
  • VulnCheck KEV · 2026-08-04T00:00:00ZVulnCheck KEV · CVE-2026-34486
    VulnCheck KEV · CVE-2026-34486
  • VulnCheck KEV · 2026-08-05T00:00:00ZVulnCheck KEV · CVE-2026-34486
  • VulnCheck KEV · 2026-08-07T00:00:00ZVulnCheck KEV · CVE-2026-34486
    VulnCheck KEV · CVE-2026-34486
  • VulnCheck KEV · 2026-08-14T00:00:00ZVulnCheck KEV · CVE-2026-34486
  • VulnCheck KEV · 2026-09-08T00:00:00ZVulnCheck KEV · CVE-2026-34486

Known Affected Software Configurations

VendorProductVersion range
ApacheTomcat9.0.116
ApacheTomcat10.1.53
ApacheTomcat11.0.20
RedhatJboss Web Server7.0.0
RedhatEnterprise Linux8.0
RedhatEnterprise Linux9.0
RedhatEnterprise Linux10.0
RedhatEnterprise Linux Els7.0
RedhatEnterprise Linux Eus10.0
RedhatEnterprise Linux Tus8.8
RedhatEnterprise Linux Update Services For Sap Solutions8.8
RedhatEnterprise Linux Update Services For Sap Solutions9.2
RedhatEnterprise Linux Update Services For Sap Solutions9.4
RedhatEnterprise Linux Update Services For Sap Solutions9.6

All CVSS metrics

  • HIGH 7.5 v3.1 · ADP Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS