{"schema":"vulnpedia.research/1","cve":"CVE-2026-34486","references":[{"url":"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly","tags":["vendor-advisory","Mailing List","Vendor Advisory","WEB","vendor-reference"],"source":"mitre","sourceId":"apache","modified":"2026-04-09T19:35:35.994Z","origins":[{"source":"mitre","sourceId":"apache","modified":"2026-04-09T19:35:35.994Z","url":"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly"}]},{"url":"https://socradar.io/blog/snowlight-government-chinese-campaign/","tags":["third-party-advisory","Third Party Advisory","KEV report"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-21T19:43:41.203Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-21T19:43:41.203Z","url":"https://socradar.io/blog/snowlight-government-chinese-campaign/"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://socradar.io/blog/snowlight-government-chinese-campaign/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","url":"https://socradar.io/blog/snowlight-government-chinese-campaign/"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-21T19:43:41.203Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-21T19:43:41.203Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486"}]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat","tags":["Third Party Advisory","WEB"],"source":"mitre","sourceId":"CVE","modified":"2026-05-26T18:16:14.258Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-05-26T18:16:14.258Z","url":"https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat"}]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat","tags":["Mitigation","Third Party Advisory","WEB"],"source":"mitre","sourceId":"CVE","modified":"2026-05-26T18:16:14.258Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-05-26T18:16:14.258Z","url":"https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34486","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","vendor-reference"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://access.redhat.com/security/cve/CVE-2026-34486"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://access.redhat.com/security/cve/CVE-2026-34486"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-34486"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457027","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","vendor-reference"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457027"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457027"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457027"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","tags":["x_sadp-csaf-vex","Third Party Advisory","vendor-advisory"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:39188","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://access.redhat.com/errata/RHSA-2026:39188"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://access.redhat.com/errata/RHSA-2026:39188"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://access.redhat.com/errata/RHSA-2026:39188"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:38505","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://access.redhat.com/errata/RHSA-2026:38505"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://access.redhat.com/errata/RHSA-2026:38505"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://access.redhat.com/errata/RHSA-2026:38505"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:36787","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://access.redhat.com/errata/RHSA-2026:36787"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://access.redhat.com/errata/RHSA-2026:36787"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://access.redhat.com/errata/RHSA-2026:36787"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:36789","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://access.redhat.com/errata/RHSA-2026:36789"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://access.redhat.com/errata/RHSA-2026:36789"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://access.redhat.com/errata/RHSA-2026:36789"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:36788","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://access.redhat.com/errata/RHSA-2026:36788"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://access.redhat.com/errata/RHSA-2026:36788"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://access.redhat.com/errata/RHSA-2026:36788"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:36790","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://access.redhat.com/errata/RHSA-2026:36790"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://access.redhat.com/errata/RHSA-2026:36790"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://access.redhat.com/errata/RHSA-2026:36790"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:37137","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://access.redhat.com/errata/RHSA-2026:37137"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://access.redhat.com/errata/RHSA-2026:37137"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://access.redhat.com/errata/RHSA-2026:37137"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:37136","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://access.redhat.com/errata/RHSA-2026:37136"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://access.redhat.com/errata/RHSA-2026:37136"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://access.redhat.com/errata/RHSA-2026:37136"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:36878","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://access.redhat.com/errata/RHSA-2026:36878"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://access.redhat.com/errata/RHSA-2026:36878"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://access.redhat.com/errata/RHSA-2026:36878"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:36876","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://access.redhat.com/errata/RHSA-2026:36876"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://access.redhat.com/errata/RHSA-2026:36876"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://access.redhat.com/errata/RHSA-2026:36876"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:36877","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://access.redhat.com/errata/RHSA-2026:36877"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://access.redhat.com/errata/RHSA-2026:36877"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://access.redhat.com/errata/RHSA-2026:36877"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:36879","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://access.redhat.com/errata/RHSA-2026:36879"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://access.redhat.com/errata/RHSA-2026:36879"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://access.redhat.com/errata/RHSA-2026:36879"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:39189","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-08-10T12:05:44.488Z","url":"https://access.redhat.com/errata/RHSA-2026:39189"},{"source":"nvd","sourceId":"CVE-2026-34486","modified":"2026-09-21T19:17:04.670","url":"https://access.redhat.com/errata/RHSA-2026:39189"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://access.redhat.com/errata/RHSA-2026:39189"}]},{"url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34486","tags":["ADVISORY","vendor-reference"],"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34486"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34486"},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34486"}]},{"url":"https://github.com/apache/tomcat/commit/1fab40ccc752e22639eccfe290d5624afad7eccd","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://github.com/apache/tomcat/commit/1fab40ccc752e22639eccfe290d5624afad7eccd"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://github.com/apache/tomcat/commit/1fab40ccc752e22639eccfe290d5624afad7eccd"}]},{"url":"https://github.com/apache/tomcat/commit/55f3eb9148233054fccfdf761141c6894a050be1","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://github.com/apache/tomcat/commit/55f3eb9148233054fccfdf761141c6894a050be1"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://github.com/apache/tomcat/commit/55f3eb9148233054fccfdf761141c6894a050be1"}]},{"url":"https://github.com/apache/tomcat/commit/776e12b3e2b0b4507b8a3b62c187ceb0b74bf418","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://github.com/apache/tomcat/commit/776e12b3e2b0b4507b8a3b62c187ceb0b74bf418"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://github.com/apache/tomcat/commit/776e12b3e2b0b4507b8a3b62c187ceb0b74bf418"}]},{"url":"https://github.com/apache/tomcat","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://github.com/apache/tomcat"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://github.com/apache/tomcat"}]},{"url":"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.54","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.54"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.54"}]},{"url":"https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.21","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.21"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.21"}]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.117","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.117"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.117"}]},{"url":"https://www.herodevs.com/vulnerability-directory/cve-2026-34486","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://www.herodevs.com/vulnerability-directory/cve-2026-34486"},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://www.herodevs.com/vulnerability-directory/cve-2026-34486"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34486","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-34486"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}]},{"source":"euvd","sourceId":"EUVD-2026-21056","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21056","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-21056","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21056"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","url":"https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/"}]},{"url":"https://previdian.com/CVE-2026-34486","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","url":"https://previdian.com/CVE-2026-34486"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://www.hkcert.org/security-bulletin/apache-tomcat-multiple-vulnerabilities_20260805","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","url":"https://www.hkcert.org/security-bulletin/apache-tomcat-multiple-vulnerabilities_20260805"}]},{"url":"https://cydome.io/maritime-cybersecurity-bulletin-august-7th-2026/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","url":"https://cydome.io/maritime-cybersecurity-bulletin-august-7th-2026/"}]},{"url":"https://www.recordedfuture.com/blog/july-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","url":"https://www.recordedfuture.com/blog/july-2026-cve-landscape"}]},{"url":"https://www.tenable.com/blog/the-agentic-ai-threat-cluster-seven-incidents-three-actors-and-what-they-mean","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","url":"https://www.tenable.com/blog/the-agentic-ai-threat-cluster-seven-incidents-three-actors-and-what-they-mean"}]},{"url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape"}]},{"url":"https://vulncheck.com/xdb/afb09f0ad770","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"afb09f0ad770","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"afb09f0ad770","modified":"2026-07-30T00:00:00Z","url":"https://vulncheck.com/xdb/afb09f0ad770"}]},{"url":"https://github.com/striga-ai/CVE-2026-34486","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"afb09f0ad770","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"afb09f0ad770","modified":"2026-07-30T00:00:00Z","url":"https://github.com/striga-ai/CVE-2026-34486"}]},{"url":"https://vulncheck.com/xdb/41dfeadea72e","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"41dfeadea72e","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"41dfeadea72e","modified":"2026-07-30T00:00:00Z","url":"https://vulncheck.com/xdb/41dfeadea72e"}]},{"url":"https://github.com/CypherHippie/CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"41dfeadea72e","modified":"2026-07-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"41dfeadea72e","modified":"2026-07-30T00:00:00Z","url":"https://github.com/CypherHippie/CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj","ecosystem":"Maven","name":"org.apache.tomcat:tomcat-tribes","purl":"pkg:maven/org.apache.tomcat/tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.20"},{"fixed":"11.0.21"}]}],"versions":["11.0.20"],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69r9-qgr7-g2wj/GHSA-69r9-qgr7-g2wj.json"},"modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj"}]},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj","ecosystem":"Maven","name":"org.apache.tomcat:tomcat-tribes","purl":"pkg:maven/org.apache.tomcat/tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.53"},{"fixed":"10.1.54"}]}],"versions":["10.1.53"],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69r9-qgr7-g2wj/GHSA-69r9-qgr7-g2wj.json"},"modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj"}]},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj","ecosystem":"Maven","name":"org.apache.tomcat:tomcat-tribes","purl":"pkg:maven/org.apache.tomcat/tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.116"},{"fixed":"9.0.117"}]}],"versions":["9.0.116"],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69r9-qgr7-g2wj/GHSA-69r9-qgr7-g2wj.json"},"modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj"}]},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj","ecosystem":"Maven","name":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.20"},{"fixed":"11.0.21"}]}],"versions":["11.0.20"],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69r9-qgr7-g2wj/GHSA-69r9-qgr7-g2wj.json"},"modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj"}]},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj","ecosystem":"Maven","name":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.53"},{"fixed":"10.1.54"}]}],"versions":["10.1.53"],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69r9-qgr7-g2wj/GHSA-69r9-qgr7-g2wj.json"},"modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj"}]},{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj","ecosystem":"Maven","name":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.116"},{"fixed":"9.0.117"}]}],"versions":["9.0.116"],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69r9-qgr7-g2wj/GHSA-69r9-qgr7-g2wj.json"},"modified":"2026-09-10T03:50:43.551259310Z","origins":[{"source":"ghsa","sourceId":"GHSA-69r9-qgr7-g2wj","modified":"2026-09-10T03:50:43.551259310Z","url":"https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj"}]}],"pocCandidates":[{"url":"https://github.com/AirSkye/CVE-2026-34486-poc","source":"poc-in-github","sourceId":"CVE-2026-34486","description":"CVE-2026-34486 Apache Tomcat EncryptInterceptor 绕过漏洞复现（使用GLM5.1复现完成）","modified":"2026-08-05T00:07:02Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-34486","url":"https://github.com/AirSkye/CVE-2026-34486-poc"},{"source":"poc-in-github","sourceId":"CVE-2026-34486","modified":"2026-08-05T00:07:02Z","url":"https://github.com/AirSkye/CVE-2026-34486-poc"}],"tags":[]},{"url":"https://github.com/404-src/CVE-2026-34486","source":"poc-in-github","sourceId":"CVE-2026-34486","description":"Apache Tomcat EncryptInterceptor Bypass → Unauthenticated RCE (CVE-2026-34486)","modified":"2026-10-13T19:10:19Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-34486","url":"https://github.com/404-src/CVE-2026-34486"},{"source":"poc-in-github","sourceId":"CVE-2026-34486","modified":"2026-10-13T19:10:19Z","url":"https://github.com/404-src/CVE-2026-34486"}],"tags":[]},{"url":"https://github.com/striga-ai/CVE-2026-34486","source":"poc-in-github","sourceId":"CVE-2026-34486","description":"EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization.","modified":"2026-10-13T19:10:35Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-34486","url":"https://github.com/striga-ai/CVE-2026-34486"},{"source":"poc-in-github","sourceId":"CVE-2026-34486","modified":"2026-10-13T19:10:35Z","url":"https://github.com/striga-ai/CVE-2026-34486"}],"tags":[]},{"url":"https://github.com/razureink/cve-2026-34486-tomcat_encrypt_bypass_reproduction","source":"poc-in-github","sourceId":"CVE-2026-34486","description":"CVE Reproduction: cve-2026-34486-tomcat_encrypt_bypass_reproduction","modified":"2026-07-23T03:46:40Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-34486","url":"https://github.com/razureink/cve-2026-34486-tomcat_encrypt_bypass_reproduction"},{"source":"poc-in-github","sourceId":"CVE-2026-34486","modified":"2026-07-23T03:46:40Z","url":"https://github.com/razureink/cve-2026-34486-tomcat_encrypt_bypass_reproduction"}],"tags":[]},{"url":"https://github.com/CypherHippie/CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization","source":"poc-in-github","sourceId":"CVE-2026-34486","description":"EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization.","modified":"2026-08-19T00:52:29Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-34486","url":"https://github.com/CypherHippie/CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization"},{"source":"poc-in-github","sourceId":"CVE-2026-34486","modified":"2026-08-19T00:52:29Z","url":"https://github.com/CypherHippie/CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"afb09f0ad770","url":"https://vulncheck.com/xdb/afb09f0ad770","cve":"CVE-2026-34486","dateAdded":"2026-05-11T17:52:35Z","modified":"2026-07-30T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/striga-ai/CVE-2026-34486","observations":[{"dateAdded":"2026-05-11T17:52:35Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"afb09f0ad770","modified":"2026-07-30T00:00:00Z","url":"https://vulncheck.com/xdb/afb09f0ad770"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"41dfeadea72e","url":"https://vulncheck.com/xdb/41dfeadea72e","cve":"CVE-2026-34486","dateAdded":"2026-08-19T17:08:47Z","modified":"2026-07-30T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/CypherHippie/CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization","observations":[{"dateAdded":"2026-08-19T17:08:47Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"41dfeadea72e","modified":"2026-07-30T00:00:00Z","url":"https://vulncheck.com/xdb/41dfeadea72e"}]}],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-5.redhat_00004.1.el10jws.noarch","product":"jws7-tomcat-0:11.0.21-5.redhat_00004.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10","status":"fixed","remediations":[{"category":"vendor_fix","details":"Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:39188"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/jws7-tomcat@11.0.21-5.redhat_00004.1.el10jws?arch=noarch","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"7Server-ELS:tomcat-jsp-2.2-api-0:7.0.76-18.el7_9.noarch","product":"tomcat-jsp-2.2-api-0:7.0.76-18.el7_9.noarch as a component of Red Hat Enterprise Linux Server (v. 7 ELS)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:38505"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/tomcat-jsp-2.2-api@7.0.76-18.el7_9?arch=noarch","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-5.redhat_00004.1.el8jws.noarch","product":"jws7-tomcat-admin-webapps-0:11.0.21-5.redhat_00004.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8","status":"fixed","remediations":[{"category":"vendor_fix","details":"Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:39188"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/jws7-tomcat-admin-webapps@11.0.21-5.redhat_00004.1.el8jws?arch=noarch","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-5.redhat_00004.1.el9jws.noarch","product":"jws7-tomcat-jsp-3.1-api-0:11.0.21-5.redhat_00004.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9","status":"fixed","remediations":[{"category":"vendor_fix","details":"Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:39188"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/jws7-tomcat-jsp-3.1-api@11.0.21-5.redhat_00004.1.el9jws?arch=noarch","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"AppStream-10.0.Z.E2S:tomcat9-1:9.0.87-6.el10_0.src","product":"tomcat9-1:9.0.87-6.el10_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:36789"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/tomcat9@9.0.87-6.el10_0?arch=src&epoch=1","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"AppStream-10.2.Z:tomcat-lib-1:10.1.49-3.el10_2.noarch","product":"tomcat-lib-1:10.1.49-3.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:36788"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/tomcat-lib@10.1.49-3.el10_2?arch=noarch&epoch=1","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"AppStream-8.10.0.Z.MAIN.EUS:tomcat-docs-webapp-1:9.0.87-2.el8_10.noarch","product":"tomcat-docs-webapp-1:9.0.87-2.el8_10.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:37137"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/tomcat-docs-webapp@9.0.87-2.el8_10?arch=noarch&epoch=1","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"AppStream-8.8.0.Z.TUS:tomcat-1:9.0.87-2.el8_8.noarch","product":"tomcat-1:9.0.87-2.el8_8.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:37136"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/tomcat@9.0.87-2.el8_8?arch=noarch&epoch=1","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.87-2.el9_2.noarch","product":"tomcat-lib-1:9.0.87-2.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:36878"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/tomcat-lib@9.0.87-2.el9_2?arch=noarch&epoch=1","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"AppStream-9.6.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-4.el9_6.noarch","product":"tomcat-docs-webapp-1:9.0.87-4.el9_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:36877"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"purl":"pkg:rpm/redhat/tomcat-docs-webapp@9.0.87-4.el9_6?arch=noarch&epoch=1","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"Red Hat JBoss Web Server 7.0.0","product":"Red Hat JBoss Web Server 7.0.0","status":"fixed","remediations":[{"category":"vendor_fix","details":"Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.","url":"https://access.redhat.com/errata/RHSA-2026:39189"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"red_hat_enterprise_linux_6:tomcat6","product":"tomcat6 as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/tomcat6","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"red_hat_enterprise_linux_6:tomcat6-admin-webapps","product":"tomcat6-admin-webapps as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/tomcat6-admin-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"red_hat_enterprise_linux_6:tomcat6-el-2.1-api","product":"tomcat6-el-2.1-api as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/tomcat6-el-2.1-api","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"red_hat_enterprise_linux_6:tomcat6-javadoc","product":"tomcat6-javadoc as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/tomcat6-javadoc","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"red_hat_enterprise_linux_6:tomcat6-jsp-2.1-api","product":"tomcat6-jsp-2.1-api as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/tomcat6-jsp-2.1-api","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"red_hat_enterprise_linux_6:tomcat6-lib","product":"tomcat6-lib as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/tomcat6-lib","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"red_hat_enterprise_linux_6:tomcat6-servlet-2.5-api","product":"tomcat6-servlet-2.5-api as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/tomcat6-servlet-2.5-api","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"red_hat_enterprise_linux_6:tomcat6-webapps","product":"tomcat6-webapps as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/tomcat6-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"red_hat_enterprise_linux_6:tomcat6.src","product":"tomcat6.src as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/tomcat6?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"red_hat_enterprise_linux_9:pki-servlet-engine","product":"pki-servlet-engine as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"no_fix_planned","details":"Will not fix"}],"purl":"pkg:rpm/redhat/pki-servlet-engine","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"red_hat_enterprise_linux_9:pki-servlet-engine.src","product":"pki-servlet-engine.src as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"no_fix_planned","details":"Will not fix"}],"purl":"pkg:rpm/redhat/pki-servlet-engine?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"10Base-JWS-7.0:jws7-build-0:1-1.el10jws.x86_64","product":"jws7-build-0:1-1.el10jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws7-build@1-1.el10jws?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"10Base-JWS-7.0:jws7-jboss-logging-0:3.6.2-1.Final_redhat_00001.1.el10jws.src","product":"jws7-jboss-logging-0:3.6.2-1.Final_redhat_00001.1.el10jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws7-jboss-logging@3.6.2-1.Final_redhat_00001.1.el10jws?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-2.redhat_2.el10jws.x86_64","product":"jws7-tomcat-native-0:1.3.7-2.redhat_2.el10jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws7-tomcat-native@1.3.7-2.redhat_2.el10jws?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"8Base-JWS-7.0:jws7-ecj-0:4.38.0-1.redhat_00001.1.el8jws.noarch","product":"jws7-ecj-0:4.38.0-1.redhat_00001.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws7-ecj@4.38.0-1.redhat_00001.1.el8jws?arch=noarch","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.0-1.Final_redhat_00001.1.el8jws.noarch","product":"jws7-mod_cluster-0:2.1.0-1.Final_redhat_00001.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws7-mod_cluster@2.1.0-1.Final_redhat_00001.1.el8jws?arch=noarch","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-2.redhat_2.el8jws.x86_64","product":"jws7-tomcat-native-debuginfo-0:1.3.7-2.redhat_2.el8jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws7-tomcat-native-debuginfo@1.3.7-2.redhat_2.el8jws?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"9Base-JWS-7.0:jws7-javapackages-filesystem-0:6.0.0-1.el9jws.noarch","product":"jws7-javapackages-filesystem-0:6.0.0-1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws7-javapackages-filesystem@6.0.0-1.el9jws?arch=noarch","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.0-1.Final_redhat_00001.1.el9jws.src","product":"jws7-mod_cluster-0:2.1.0-1.Final_redhat_00001.1.el9jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws7-mod_cluster@2.1.0-1.Final_redhat_00001.1.el9jws?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"9Base-JWS-7.0:jws7-tomcat-vault-0:1.1.11-4.Final_redhat_00003.1.el9jws.noarch","product":"jws7-tomcat-vault-0:1.1.11-4.Final_redhat_00003.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws7-tomcat-vault@1.1.11-4.Final_redhat_00003.1.el9jws?arch=noarch","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]},{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","productId":"red_hat_jboss_web_server_6:tomcat","product":"tomcat as a component of Red Hat JBoss Web Server 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:maven/org.apache.tomcat/tomcat","origins":[{"source":"redhat","sourceId":"CVE-2026-34486","modified":"2026-08-07T19:13:47+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json"}]}],"vendorCoverage":{"total":226,"shown":32,"omitted":194,"source":"redhat"},"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-07-30T00:00:00Z","modified":"2026-07-30T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Apache","product":"Tomcat","dueDate":"2026-08-07T00:00:00Z","cisaDateAdded":"2026-08-04T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","modified":"2026-07-30T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","catalog":"VulnCheck KEV","kind":"report","url":"https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/","dateAdded":"2026-07-30T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","url":"https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","catalog":"VulnCheck KEV","kind":"report","url":"https://socradar.io/blog/snowlight-government-chinese-campaign/","dateAdded":"2026-07-31T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","url":"https://socradar.io/blog/snowlight-government-chinese-campaign/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","catalog":"VulnCheck KEV","kind":"report","url":"https://previdian.com/CVE-2026-34486","dateAdded":"2026-08-04T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","url":"https://previdian.com/CVE-2026-34486"},{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","catalog":"VulnCheck KEV","kind":"report","url":"https://www.hkcert.org/security-bulletin/apache-tomcat-multiple-vulnerabilities_20260805","dateAdded":"2026-08-05T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","url":"https://www.hkcert.org/security-bulletin/apache-tomcat-multiple-vulnerabilities_20260805"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","catalog":"VulnCheck KEV","kind":"report","url":"https://cydome.io/maritime-cybersecurity-bulletin-august-7th-2026/","dateAdded":"2026-08-07T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","url":"https://cydome.io/maritime-cybersecurity-bulletin-august-7th-2026/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","url":"https://www.recordedfuture.com/blog/july-2026-cve-landscape"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","catalog":"VulnCheck KEV","kind":"report","url":"https://www.tenable.com/blog/the-agentic-ai-threat-cluster-seven-incidents-three-actors-and-what-they-mean","dateAdded":"2026-08-14T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","url":"https://www.tenable.com/blog/the-agentic-ai-threat-cluster-seven-incidents-three-actors-and-what-they-mean"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","catalog":"VulnCheck KEV","kind":"report","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape","dateAdded":"2026-09-08T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-34486","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape"}]}]}