{"schema":"vulnpedia.poc/1","cve":"CVE-2026-34486","generated":"2026-10-26T06:59:15.268Z","kev":{"since":"2026-08-04","ransomware":false},"epss":{"score":0.98503,"percentile":0.99919},"cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"has_public_poc":true,"poc_sources":[{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/afb09f0ad770","executable":false,"sourceId":"afb09f0ad770","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"afb09f0ad770","modified":"2026-07-30T00:00:00Z","url":"https://vulncheck.com/xdb/afb09f0ad770"}],"repositoryUrl":"https://github.com/striga-ai/CVE-2026-34486"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/41dfeadea72e","executable":false,"sourceId":"41dfeadea72e","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"41dfeadea72e","modified":"2026-07-30T00:00:00Z","url":"https://vulncheck.com/xdb/41dfeadea72e"}],"repositoryUrl":"https://github.com/CypherHippie/CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization"}],"poc_candidates":[{"url":"https://github.com/AirSkye/CVE-2026-34486-poc","source":"poc-in-github","sourceId":"CVE-2026-34486","description":"CVE-2026-34486 Apache Tomcat EncryptInterceptor 绕过漏洞复现（使用GLM5.1复现完成）","modified":"2026-08-05T00:07:02Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-34486","url":"https://github.com/AirSkye/CVE-2026-34486-poc"},{"source":"poc-in-github","sourceId":"CVE-2026-34486","modified":"2026-08-05T00:07:02Z","url":"https://github.com/AirSkye/CVE-2026-34486-poc"}],"tags":[]},{"url":"https://github.com/404-src/CVE-2026-34486","source":"poc-in-github","sourceId":"CVE-2026-34486","description":"Apache Tomcat EncryptInterceptor Bypass → Unauthenticated RCE (CVE-2026-34486)","modified":"2026-10-13T19:10:19Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-34486","url":"https://github.com/404-src/CVE-2026-34486"},{"source":"poc-in-github","sourceId":"CVE-2026-34486","modified":"2026-10-13T19:10:19Z","url":"https://github.com/404-src/CVE-2026-34486"}],"tags":[]},{"url":"https://github.com/striga-ai/CVE-2026-34486","source":"poc-in-github","sourceId":"CVE-2026-34486","description":"EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization.","modified":"2026-10-13T19:10:35Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-34486","url":"https://github.com/striga-ai/CVE-2026-34486"},{"source":"poc-in-github","sourceId":"CVE-2026-34486","modified":"2026-10-13T19:10:35Z","url":"https://github.com/striga-ai/CVE-2026-34486"}],"tags":[]},{"url":"https://github.com/razureink/cve-2026-34486-tomcat_encrypt_bypass_reproduction","source":"poc-in-github","sourceId":"CVE-2026-34486","description":"CVE Reproduction: cve-2026-34486-tomcat_encrypt_bypass_reproduction","modified":"2026-07-23T03:46:40Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-34486","url":"https://github.com/razureink/cve-2026-34486-tomcat_encrypt_bypass_reproduction"},{"source":"poc-in-github","sourceId":"CVE-2026-34486","modified":"2026-07-23T03:46:40Z","url":"https://github.com/razureink/cve-2026-34486-tomcat_encrypt_bypass_reproduction"}],"tags":[]},{"url":"https://github.com/CypherHippie/CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization","source":"poc-in-github","sourceId":"CVE-2026-34486","description":"EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization.","modified":"2026-08-19T00:52:29Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-34486","url":"https://github.com/CypherHippie/CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization"},{"source":"poc-in-github","sourceId":"CVE-2026-34486","modified":"2026-08-19T00:52:29Z","url":"https://github.com/CypherHippie/CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization"}],"tags":[]}],"test_commands":[{"tool":"nuclei","cmd":"nuclei -id CVE-2026-34486 -u https://TARGET","note":"Detection template — review its checks and affected versions before use."},{"tool":"poc.json","cmd":"curl -s https://vulnpedia.com/cve/CVE-2026-34486/poc.json","note":"Machine-readable PoC index for this CVE (for automation)."}],"detection_sources":[{"kind":"nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34486.yaml","template":"http/cves/2026/CVE-2026-34486.yaml","executable":true}],"discovery_links":[{"kind":"github-search","url":"https://github.com/search?q=%22CVE-2026-34486%22&type=repositories","executable":false}]}