{"vulnerability": "CVE-2026-34486", "sightings": [{"uuid": "8278e0ba-3d9a-4457-88e7-c6c0d0a0ab83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/80527", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-34486-Tribes\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a helGayhub233\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-16 09:48:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nApache Tomcat Tribes \u534f\u8bae\u63a2\u6d4b\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-16T10:00:04.000000Z"}, {"uuid": "970cf089-32e2-4664-91d8-4bd1b8fe1ee3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mj3xbf5a7m2m", "content": "", "creation_timestamp": "2026-04-09T23:23:44.460625Z"}, {"uuid": "531a8f23-5345-49f2-bd0e-45ea6c7a5add", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3mj42l3ynn223", "content": "", "creation_timestamp": "2026-04-10T00:22:52.040393Z"}, {"uuid": "c2d00888-0795-4ef6-8e97-4bfed7c40900", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mj5ediuo5m2z", "content": "", "creation_timestamp": "2026-04-10T12:50:14.566614Z"}, {"uuid": "402dfd68-40d2-4684-ae54-01f24d6e0b44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjbouv6jrq2w", "content": "", "creation_timestamp": "2026-04-12T06:09:37.070978Z"}, {"uuid": "537660c6-5bd4-4466-a620-59e60824156c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/116398533911788291", "content": "", "creation_timestamp": "2026-04-13T17:17:56.610927Z"}, {"uuid": "c4ca1c45-76bf-4349-ae72-60e74e023fdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mjfepkuor22c", "content": "", "creation_timestamp": "2026-04-13T17:18:19.469062Z"}, {"uuid": "f796e08e-5aae-425e-b613-49ce353ae6ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://threatintel.cc/2026/04/13/apache-tomcat-vulnerabilities-enables-bypass.html", "content": "", "creation_timestamp": "2026-04-13T15:18:02.000000Z"}, {"uuid": "c331642c-41f4-44aa-b56e-2d31c8692090", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/modat-io.bsky.social/post/3mjhaxbrnf22g", "content": "", "creation_timestamp": "2026-04-14T11:16:24.840235Z"}, {"uuid": "bfe444b0-ba5b-4ef9-a20e-01a2dfa99df9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/80406", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #Remote\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-34486\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 404-src\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-15 13:00:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nApache Tomcat EncryptInterceptor Bypass \u2192 Unauthenticated RCE (CVE-2026-34486)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-15T13:00:43.000000Z"}, {"uuid": "e0476b45-7eb1-4411-8e37-a280d083c868", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/80372", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a tomcat-cve-2026-34486\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a punitdarji\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-15 06:55:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE labs \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-15T07:00:04.000000Z"}, {"uuid": "ad2d5a68-41cd-4e46-aaf3-d2a13c33cac2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "published-proof-of-concept", "source": "Telegram/erN7IpzCRCEbk-BjWUA3pp0zUmJycQB5Op0ThvHAcoJSrI0", "content": "", "creation_timestamp": "2026-04-16T15:00:06.000000Z"}, {"uuid": "727a8f04-2c2e-4b83-9a74-93cdfd164a84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "Telegram/VmPzW9vK7p7Zve81sAsPaRrR_R2EIHLwag0ULU7f22817b0", "content": "", "creation_timestamp": "2026-04-10T23:26:51.000000Z"}, {"uuid": "de98a44d-95cf-4fba-88c8-69af64875720", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3msbjenzkam2b", "content": "\ud83d\uded1 CVE-2026-34486\nApache Tomcat\nCVSS 7.5 / EPSS 43% / KEV \u2705\nTL;DR: Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-202\u2026\nhttps://cvesentinel.com/report/CVE-2026-34486?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-08-04T17:17:46.074184Z"}, {"uuid": "2460db39-3f4f-4c2e-b687-ba23486e76ad", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4e9a3540-8de8-40a3-980a-a0e3aeded844", "content": "", "creation_timestamp": "2026-08-04T18:00:26.443155Z"}, {"uuid": "f8b3d8a7-7d8f-43b8-9903-768e3228fa51", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ac2344a6-31bc-4723-9ed3-ced1cafad44a", "content": "", "creation_timestamp": "2026-08-04T18:00:01.756844Z"}, {"uuid": "3d73fab1-ac6e-4382-aad5-6beb3f4314c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3msbrambj542u", "content": "CVE-2026-34486 \u00b7 trending #7\n\nCurrently trending CVE - Hype Score: 5 - Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache T... https://cvemon.intruder.io/cves/CVE-2026-34486", "creation_timestamp": "2026-08-04T19:38:38.991666Z"}, {"uuid": "3ccc29dc-dc0a-4077-9302-7aefb507775f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "MISP/cfdb2abf-6c64-4005-9614-a35e97f306a7", "content": "", "creation_timestamp": "2026-08-04T12:15:16.265522Z"}, {"uuid": "702503da-026c-4739-bc5f-8475d502a8da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "Telegram/e8LfDRtTf8nzcOa5URmJo_p6nGHeOtUQSV0vmQsSJYMEaqg", "content": "", "creation_timestamp": "2026-05-11T21:00:05.000000Z"}, {"uuid": "26ff5f4e-9fe8-4a3c-8721-7dcdef7cc489", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-34486.yaml", "content": "", "creation_timestamp": "2026-05-12T07:34:13.000000Z"}, {"uuid": "29d182ad-3e3f-44a5-a669-b00f3cdf087f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/116572623784727448", "content": "CVE-2026-34486 - Tomcat\n- Only exploitable if a certain feature is used, if it's endpoint is reachable and if port 4000.  It's pretty niche.", "creation_timestamp": "2026-05-14T11:11:24.771696Z"}, {"uuid": "0048d677-983a-49d7-ab7f-1ef5d13c7e6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "MISP/cfdb2abf-6c64-4005-9614-a35e97f306a7", "content": "", "creation_timestamp": "2026-08-05T00:15:03.172836Z"}, {"uuid": "67e15006-23ac-4426-8c6a-75cdbd3defcd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mscjv5grby2e", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u60273\u4ef6\u3092\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 \n\nCISA Adds Three Known Exploited Vulnerabilities to Catalog  #CISA (Aug 4)\n\nCVE-2026-9198 IBM Langflow \u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\nCVE-2026-18556 N-able N-central\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\uff08\u4ee3\u66ff\u30d1\u30b9\u307e\u305f\u306f\u30c1\u30e3\u30cd\u30eb\u306e\u4f7f\u7528\uff09\u306e\u8106\u5f31\u6027\nCVE-2026-34486 Apache Tomcat\u306b\u304a\u3051\u308b\u6a5f\u5bc6\u30c7\u30fc\u30bf\u306e\u6697\u53f7\u5316\u306e\u6b20\u843d\u306e\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-08-05T02:59:38.108164Z"}, {"uuid": "59f85169-c978-4a5a-8237-d15d4b0d0a87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3msctz7uf622d", "content": "Nieuwe kwetsbaarheid in Apache Tomcat maakt systemen wereldwijd kwetsbaar voor a\n\nDe U.S. Cybersecurity and Infrastructure Security Agency (CISA) heeft de kwetsbaarheid CVE-2026-34486 toegevoegd aan de catalogus van bekende ge\u00ebxploiteerde kwetsbaarheden, wat aangeeft dat deze kwetsbaarheid a...", "creation_timestamp": "2026-08-05T06:00:53.055152Z"}, {"uuid": "6ad35e2d-d25d-408a-8590-8cd4806d1b76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mscvo5lypd2p", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-34486: \u26a0\ufe0f CVE-2026-34486: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 42.6%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-34486-missing-encryption-of-sensitive-data-vulnerability", "creation_timestamp": "2026-08-05T06:30:29.429249Z"}, {"uuid": "8f6ff9b7-3cc7-4cd2-a804-05e0094c0a26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1995", "content": "", "creation_timestamp": "2026-08-05T08:45:10.207359Z"}, {"uuid": "d0940acd-b131-446a-9c76-95435c0357a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3msdhghbvtz26", "content": "\ud83d\udea8 CISA KEV ALERT: CVE-2026-34486 exposes Apache Tomcat installations to EncryptInterceptor bypasses and data interception. Active exploitation confirmed. Get the forensic breakdown, Splunk/KQL/Chronicle detection queries, and hardening steps: https://thecybermind.co/it1p\n\nTop-of-the-Line LinkedIn\u2026", "creation_timestamp": "2026-08-05T11:48:17.708706Z"}, {"uuid": "71aff906-45e7-4d6e-8d79-a16d77d32353", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/hack0day.bsky.social/post/3mnplvp2nq22x", "content": "Apache Tomcat RCE CVE-2026-34486\nwww.striga.ai/research/tom...", "creation_timestamp": "2026-06-07T16:34:46.369827Z"}, {"uuid": "6c9207ac-0f24-4970-a405-03981bd43820", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mseeyfddjh2b", "content": "\ud83e\udd16 CISA KEV adds 3 exploited flaws: CVE-2026-9198 (9.8) Langflow RCE; CVE-2026-18576 N-central admin hijack; CVE-2026-34486 (7.5) Tomcat. Patch in 3 days.\n\nhttps://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-langflow-n-central-apache-tomcat-flaws/", "creation_timestamp": "2026-08-05T20:37:17.588944Z"}, {"uuid": "c7164a0c-1d13-4a83-9fd6-0a823fffadcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://gist.github.com/albertotrindade131-png/9c164247cb64ddc15993e8b7a3f49581", "content": "I verified it. The chain is Apache Tomcat EncryptInterceptor: CVE-2026-29146 was the padding-oracle issue, fixed in Tomcat 9.0.116 / 10.1.53 / 11.0.20, but that fix introduced CVE-2026-34486, where the EncryptInterceptor could be bypassed; the follow-up fix is in 9.0.117 / 10.1.54 / 11.0.21. The key diff is that super.messageReceived(msg) was moved outside the decrypt-success path in the first patch, then moved back in the regression fix. \n\nApache Tomcat patch regression: CVE-2026-29146 -> CVE-2026-34486\n\nI was looking at these two Apache Tomcat CVEs because they are a clean example of a security fix creating a new bug.\n\nThe CVEs are:\n\n- CVE-2026-29146\n- CVE-2026-34486\n\nThis is about Tomcat's \"EncryptInterceptor\", which is used in Tomcat clustering / Tribes communication.\n\nQuick summary\n\nCVE-2026-29146 was a padding oracle issue in \"EncryptInterceptor\".\n\nThe fix changed the encryption handling and also changed part of the message receive flow.\n\nThe problem is that this fix accidentally allowed \"EncryptInterceptor\" to be bypassed.\n\nThat follow-up bug became CVE-2026-34486.\n\nSo the chain is basically:\n\nCVE-2026-29146\n  -> patch changes EncryptInterceptor\n  -> patch accidentally forwards messages even after decrypt failure\n  -> CVE-2026-34486\n\nAffected / fixed versions\n\nFor CVE-2026-29146:\n\nTomcat line| Affected| Fixed in\n11.x| 11.0.0-M1 to 11.0.18| 11.0.20\n10.x| 10.0.0-M1 to 10.1.52| 10.1.53\n9.x| 9.0.13 to 9.0.115| 9.0.116\n8.5.x| 8.5.38 to 8.5.100| no normal current-line fix\n7.x| 7.0.100 to 7.0.109| no normal current-line fix\n\nFor CVE-2026-34486:\n\nTomcat line| Affected| Fixed in\n11.x| 11.0.20| 11.0.21\n10.x| 10.1.53| 10.1.54\n9.x| 9.0.116| 9.0.117\n\nPatch commits I checked\n\nFor Tomcat 9:\n\n- CVE-2026-29146 fix: \"0112ed22abfccc3d54e44d91eb08804d0886acd1\"\n- CVE-2026-34486 fix: \"776e12b3e2b0b4507b8a3b62c187ceb0b74bf418\"\n\nFor Tomcat 10:\n\n- CVE-2026-29146 fix: \"607ebc0fa522bd9e8c05517baa2d179bbd1e659c\"\n- CVE-2026-34486 fix: \"55f3eb9148233054fccfdf761141c6894a050be1\"\n\nFor Tomcat 11:\n\n- CVE-2026-29146 fix: \"6d955cceca841f2eabf2d6c46b59a8c7e1cd6eaa\"\n- CVE-2026-34486 fix: \"1fab40ccc752e22639eccfe290d5624afad7eccd\"\n\nWhat changed in the bad patch\n\nThe interesting part is in:\n\njava/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java\n\nBefore the regression, the message was only passed forward after decrypt worked.\n\nThe CVE-2026-29146 patch moved this call:\n\nsuper.messageReceived(msg);\n\nso it happened after the \"catch\".\n\nThat means if decrypt failed, the code logged the error, but then still continued and passed the message forward.\n\nThat is the regression.\n\nSimplified version:\n\ntry {\n    decrypt(message);\n} catch (GeneralSecurityException e) {\n    log.error(\"decrypt failed\", e);\n}\n\nsuper.messageReceived(msg);\n\nThis is bad because the interceptor is supposed to stop bad encrypted messages, not just log the problem and continue.\n\nWhat the second patch fixed\n\nThe CVE-2026-34486 patch moved \"super.messageReceived(msg)\" back into the successful decrypt path.\n\nSimplified version:\n\ntry {\n    decrypt(message);\n    super.messageReceived(msg);\n} catch (GeneralSecurityException e) {\n    log.error(\"decrypt failed\", e);\n}\n\nNow if decrypt fails, the message is not forwarded.\n\nThis is a tiny diff, but the security meaning is big.\n\nWhy I think this is a good regression example\n\nThis was not a huge rewrite.\n\nThe regression was basically a control-flow mistake.\n\nThe code still caught the decrypt error, so at first glance it may look safe.\n\nBut catching the error is not enough.\n\nThe important question is:\n\nAfter decrypt fails, does the message stop?\n\nIn the broken patch, the answer was no.\n\nThat is why the second CVE exists.\n\nMain lesson\n\nFor security code, error handling is part of the security boundary.\n\nIf the security check fails, the code should usually stop right there.\n\nLogging the error is not the same as blocking the message.\n\nIn this case, the first patch fixed the crypto issue, but accidentally changed the message flow.\n\nThe second patch fixed the flow.\n\nMy takeaway\n\nThis is the kind of bug that is easy to miss in review because the code looks cleaner after moving the call outside the \"try\".\n\nBut for security checks, cleaner code can still be wrong.\n\nThe safer review question would have been:\n\nCan any message reach super.messageReceived(msg) if decrypt fails?\n\nIf yes, that is a bug.\n\nReferences\n\n- Apache Tomcat security page for Tomcat 9\n- Apache Tomcat security page for Tomcat 10\n- Apache Tomcat security page for Tomcat 11\n- NVD entry for CVE-2026-29146\n- NVD entry for CVE-2026-34486\n- Apache Tomcat commit \"0112ed22\"\n- Apache Tomcat commit \"776e12b3\"\n- Apache Tomcat commit \"607ebc0f\"\n- Apache Tomcat commit \"55f3eb91\"\n- Apache Tomcat commit \"6d955cce\"\n- Apache Tomcat commit \"1fab40cc\"", "creation_timestamp": "2026-06-22T08:31:57.000000Z"}, {"uuid": "8ebe2be4-4d1e-4aa4-af22-3dc7bc2b185e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3msqps52pfv2x", "content": "\ud83d\udea8 CRITICAL THREAT ALERT: CVE-2026-34486 in Apache Tomcat is under active CISA KEV exploitation. Missing encryption allows intercept of sensitive corporate data. Review our strategic C-Suite brief on technical vectors, persistence checks, and endpoint hardening to protect your data streams.\u2026", "creation_timestamp": "2026-08-10T18:22:37.215666Z"}, {"uuid": "80e2c3f6-1cd4-4c27-b9c5-9460cf1ee62d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://t.me/GithubRedTeam/92520", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-34486\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a elmossaidayoub\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-08 13:59:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-34486 LAB\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:07.611631Z"}, {"uuid": "c0da8803-ac0f-476e-8df6-2299b2dfdfb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://t.me/GithubRedTeam/92520", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-34486\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a elmossaidayoub\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-08 13:59:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-34486 LAB\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:17.924329Z"}, {"uuid": "a7128232-bd20-420a-9de4-108e3dc2788e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92520", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-34486\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a elmossaidayoub\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-08 13:59:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-34486 LAB\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:32.795427Z"}, {"uuid": "3144ed21-7e95-444b-991c-c7196dbb2cdc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3msix5bqafw2u", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-34486", "creation_timestamp": "2026-08-07T16:14:58.656250Z"}, {"uuid": "22ca9bb0-cf5b-4f76-a52d-2150821567a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "Telegram/8kp3z1YgJqt82_8nhjr-9Er-wafKuXLQ2iMVx1buNQjBOA", "content": "", "creation_timestamp": "2026-07-16T21:00:03.503456Z"}, {"uuid": "53731880-dbcd-41ec-b323-13fa323325e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "published-proof-of-concept", "source": "Telegram/8kp3z1YgJqt82_8nhjr-9Er-wafKuXLQ2iMVx1buNQjBOA", "content": "", "creation_timestamp": "2026-07-17T00:00:10.809366Z"}, {"uuid": "9cdc5038-1e69-478f-a371-5214bb36cb6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "seen", "source": "Telegram/lyQjgrzss-14q92fKQzooVmz9KnQq83SmXqNbV8WBn3n-CQ", "content": "", "creation_timestamp": "2026-07-23T11:00:03.456087Z"}, {"uuid": "e64300c1-e443-4338-8858-803c8e773282", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34486", "type": "published-proof-of-concept", "source": "Telegram/lyQjgrzss-14q92fKQzooVmz9KnQq83SmXqNbV8WBn3n-CQ", "content": "", "creation_timestamp": "2026-07-24T00:00:09.085743Z"}]}