HighExploited in the wildCISA KEVPublic exploitVulnerability

CVE-2026-34486

Apache Tomcat EncryptInterceptor Encryption Bypass

Published Apr 9, 2026 · Updated 8 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

1 mention · peak 1 in a dayToday

CVSS7.5High · v3.1

EPSS98.5%100th percentile

CISA KEVYesAdded Aug 4, 2026

In the wildActivePer CISA KEV

Vendors: Red HatApache Software FoundationF5

IdentifiersCVE-2026-34486CWE-311 · Missing Encryption of Sensitive Data

CVE-2026-34486 is a missing-encryption vulnerability in Apache Tomcat's EncryptInterceptor, which protects communications in Apache Tribes clustered deployments. The fix for CVE-2026-29146 introduced a flaw that allows specially crafted cluster messages to bypass the interceptor's encryption protections, permitting unencrypted or improperly encrypted messages to reach downstream components. Affected upstream releases are Tomcat 11.0.20, 10.1.53, and 9.0.116. The vulnerability compromises cluster communication confidentiality and can be chained with CVE-2025-24813.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation bypasses encryption protections for Tomcat cluster communications, potentially exposing sensitive data. Active exploitation has been reported, including attempts to deploy Java deserialization-based reverse shells. Chaining with CVE-2025-24813 can introduce additional consequences, including remote code execution, information disclosure, or malicious content injection; these are not established as standalone effects of CVE-2026-34486, and the precise chaining mechanism is currently unavailable.

Mitigation

If you can’t patch tonight, do this now.

Until updates can be applied, restrict Tomcat cluster communication ports to explicitly trusted cluster nodes using firewall rules, network segmentation, and private network paths. Prevent cluster endpoints from accepting traffic from untrusted networks. Review application and network logs for unexpected cluster messages, repeated encryption or decryption failures, and suspicious outbound connections, and investigate exposed systems for compromise. Discontinue affected deployments if effective mitigation is unavailable.

Remediation

Patch, then assume compromise.

Upgrade Apache Tomcat to 11.0.21 or later, 10.1.54 or later, or 9.0.117 or later in the corresponding release branch. For distribution-packaged or embedded Tomcat deployments, apply the relevant vendor security update, accounting for backported fixes rather than relying solely on the upstream version number. Inventory cloud, container, and internal cluster deployments, and verify cluster encryption protections after updating.

Public exploits

Exploits

6 exploits validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.

View more in app →

tomcat-cve-2026-34486This repository is a small proof-of-concept exploit lab with 3 files: a Python exploit (poc.py), a Dockerfile that builds a vulnerable Apache Tomcat test container, and a docker-compose.yml exposing ports 8080 and 4000. The main exploit is poc.py, which crafts a raw Tomcat Tribes cluster packet and sends it over TCP to an attacker-specified host and port. The exploit’s core capability is remote command execution. It embeds an attacker-provided command into a serialized Java gadget chain built from Apache Commons Collections classes (notably LazyMap, ChainedTransformer, ConstantTransformer, and InvokerTransformer) that ultimately calls Runtime.exec(). The serialized payload is split into two static byte blobs (T1 and T2), with the command length and command bytes inserted between them. The script then wraps this serialized object inside a custom Tomcat Tribes message format using hardcoded protocol markers (FLT2002/TLF2003 and TRIBES-B/TRIBES-E), a fabricated member structure, and a timestamp/UUID-like field before transmitting it over a TCP socket. The Dockerfile strongly supports the exploit’s intended target and mechanism: it uses a Tomcat 9.0.116 JDK8 image, restores default webapps, downloads commons-collections-3.2.1.jar from Maven Central into Tomcat’s lib directory, and replaces server.xml. This indicates the repository is meant to stand up a local vulnerable environment where the deserialization gadget chain is available on the classpath. docker-compose.yml publishes port 4000, which is likely the Tribes cluster listener targeted by the exploit, and 8080 for normal Tomcat HTTP access. Operationally, the exploit is straightforward: run poc.py with <host> <port> <command>, and it opens a TCP connection, sends the crafted packet, and closes the socket. There is no response parsing, shell management, staging, or payload customization beyond the supplied command, so this is best classified as an operational PoC rather than a weaponized framework module.punitdarji · Disclosed Apr 15, 2026 · python · dockerfile · networkOperational CVE-2026-34486-pocRepository contains a README and one main Bash script, cve-2026-34486-repro.sh. It is a real exploit/reproduction lab for CVE-2026-34486 affecting Apache Tomcat clustering with EncryptInterceptor. The exploit logic is network-based: it prepares two Tomcat instances, enables Tribes clustering and EncryptInterceptor, installs Commons Collections 3.1, downloads ysoserial, generates a Java deserialization gadget payload, and sends a crafted cluster message so that decryption failure does not stop downstream processing. The intended result is arbitrary command execution on the receiving Tomcat node via ObjectInputStream.readObject(), demonstrated by creation of /tmp/CVE-2026-34486-PWNED. The README explains the root cause in EncryptInterceptor.messageReceived(), affected/fixed versions, cluster topology, and expected logs. The script automates dependency installation, vulnerable Tomcat download, XML patching via embedded Python, cluster startup, payload generation, attack execution, and post-exploitation verification. Fingerprintable targets include Tomcat cluster multicast discovery at 228.0.0.4:45564, Tribes TCP ports 4000/4001, HTTP ports 18080/28080, and local file paths used for setup and success verification. Overall, this is an operational PoC/lab automation script for reproducing unauthenticated cluster-message-driven deserialization RCE in vulnerable Tomcat deployments.AirSkye · Disclosed Apr 15, 2026 · markdown · bash · network · webOperational CVE-2026-34486This repository is a small standalone exploit project with two files: a README describing the vulnerability and usage, and a Python exploit script (exp.py). The exploit targets CVE-2026-34486 in Apache Tomcat Tribes EncryptInterceptor, where failed decryption does not stop message processing, allowing raw attacker-controlled bytes to reach Java deserialization logic on the cluster receiver port. The main exploit flow in exp.py is: locate dependencies, generate a Java helper source file (TribesClient.java) from an embedded string, compile it with javac against Tomcat Tribes libraries, invoke ysoserial to build a gadget-based serialized payload, wrap that payload in a crafted Apache Tribes ChannelData/XByteBuffer frame, and send it over TCP to the target host/port. The embedded Java helper uses Tomcat classes such as ChannelData, XByteBuffer, and MemberImpl, and reflectively accesses START_DATA and END_DATA markers to construct a valid Tribes frame. Capabilities include: (1) direct one-shot command execution via -c/--command, (2) command execution with output retrieval via --rce by redirecting stdout/stderr into /usr/local/tomcat/webapps/ROOT/.out.txt and then fetching it over HTTP, and (3) an interactive shell mode that repeatedly executes commands and retrieves output. The default gadget is CommonsCollections6, with several alternate gadget choices exposed on the CLI. The exploit is operational rather than a simple PoC because it automates payload generation, helper compilation, network delivery, and output retrieval. It is not a framework module. The primary attack vector is unauthenticated network access to the Tomcat Tribes receiver, typically TCP port 4000. Secondary HTTP access to port 8080 is used only for convenience in retrieving command output after successful exploitation.404-src · Disclosed Apr 15, 2026 · markdown · python · networkOperational CVE-2026-34486This repository is a working proof-of-concept exploit for CVE-2026-34486, an Apache Tomcat Tribes clustering vulnerability where EncryptInterceptor fails open on decryption errors, allowing unauthenticated attackers to send unencrypted cluster messages that still reach Java deserialization code paths. The repo is small and purpose-built: GadgetGen.java generates a serialized CommonsCollections6-style gadget chain that executes an arbitrary command via Runtime.exec; send_payload.py constructs a Tomcat Tribes ChannelData packet with FLT2002/TLF2003 framing and sends the serialized object over TCP to the Tribes receiver; server.xml configures a vulnerable Tomcat cluster with EncryptInterceptor enabled and a receiver on port 4000; Dockerfile builds a reproducible Tomcat 11.0.20 lab image; and run.sh automates dependency download, payload generation, container build/start, exploit delivery, and verification. The main exploit capability is unauthenticated network-based RCE against affected Tomcat versions with Tribes clustering exposed. The included payload is operational but basic: it defaults to creating /tmp/pwned in the target container to prove code execution. The exploit path is not through HTTP but through the Tomcat Tribes cluster receiver on TCP/4000. The repository is not a scanner or detector; it is an actual exploit PoC with end-to-end reproduction steps.striga-ai · Disclosed May 11, 2026 · dockerfile · java · network · webOperational CVE-2026-34486---unauthenticated-RCE-via-Java-deserializationThis repository is a working proof-of-concept exploit for CVE-2026-34486, described as an Apache Tomcat Tribes EncryptInterceptor fail-open bypass that leads to unauthenticated remote code execution through Java deserialization. It is not a scanner or detector; it builds a vulnerable Tomcat environment, generates a malicious serialized object, sends it over the Tomcat Tribes clustering protocol, and verifies code execution. Repository structure and purpose: - Dockerfile: Builds a demo target from tomcat:11.0.20-jdk21, replaces server.xml, and copies commons-collections-3.1.jar into Tomcat's lib directory so the gadget classes are available during deserialization. - server.xml: Configures a SimpleTcpCluster/GroupChannel with a Tribes NioReceiver bound to 0.0.0.0:4000 and an EncryptInterceptor using AES/GCM/NoPadding. This is the vulnerable target configuration the exploit abuses. - GadgetGen.java: Generates a serialized CommonsCollections6-variant gadget chain. The chain culminates in Runtime.exec(), with OS-aware execution wrappers (/bin/sh -c on Unix, cmd /c on Windows). Default command is touch /tmp/pwned and output file is payload.bin. - send_payload.py: Crafts a raw Tomcat Tribes packet using FLT2002/TLF2003 framing and a forged member structure, then sends the unencrypted serialized payload to a chosen host and port over TCP. - run.sh: End-to-end orchestrator. It downloads commons-collections-3.1.jar from Maven Central if missing, compiles GadgetGen.java, generates payload.bin, builds and runs the Dockerized Tomcat target, sends the payload to localhost:4000, and confirms exploitation by checking for /tmp/pwned in the container. - README.md: Documents affected/fixed versions and one-command reproduction. Main exploit capability: The exploit achieves unauthenticated network RCE against vulnerable Tomcat Tribes receivers by sending an unencrypted serialized Java object even when EncryptInterceptor is configured. According to the included comments, decryption fails but the message is still forwarded for deserialization, allowing attacker-controlled gadget execution. Operational flow: 1. Prepare vulnerable target with clustering and EncryptInterceptor enabled. 2. Ensure commons-collections gadget classes exist on the target classpath. 3. Generate malicious serialized object payload.bin. 4. Wrap payload in Tomcat Tribes ChannelData/member framing. 5. Send packet to the receiver TCP port 4000. 6. Target deserializes object and executes the embedded command. 7. Demo verifies success via creation of /tmp/pwned. This is best classified as OPERATIONAL: it contains a real payload and complete delivery logic, but the payload is basic and hardcoded by default rather than being part of a larger exploitation framework.CypherHippie · Disclosed Aug 19, 2026 · dockerfile · java · network · localOperational cve-2026-34486-tomcat_encrypt_bypass_reproductionRepository contains a small standalone proof-of-concept for CVE-2026-34486, plus a README explaining the regression in Apache Tomcat's EncryptInterceptor. The codebase is minimal: one Python script (exploit.py) and one documentation file. The exploit is not framework-based. The Python PoC constructs a Tomcat cluster message using a simple 4-byte big-endian length prefix followed by serialized payload bytes. By default it uses a minimal Java serialization stream containing a dummy object descriptor ('ExampleMessage'), but it also supports loading arbitrary serialized bytes from a local file via the --payload argument. It then opens a TCP connection to a user-specified host and port and sends the frame directly to the Tomcat cluster receiver. Its main capability is demonstrating a network-based plaintext message injection/bypass against vulnerable Tomcat cluster nodes configured with EncryptInterceptor. It does not include post-exploitation logic, authentication bypass chaining, remote code execution primitives, or a reverse shell. It is therefore best classified as a PoC that validates the vulnerable receive path by delivering unencrypted cluster traffic that should have been rejected. Operationally, the exploit requires a reachable Tomcat cluster receiver and a vulnerable version/configuration: Apache Tomcat 11.0.20, 10.1.53, or 9.0.116 with clustering enabled and EncryptInterceptor in use. The README notes common receiver ports 4000 or 5000, though the script itself accepts any user-supplied port. The provided result is successful delivery of a crafted unencrypted cluster frame that may be accepted and forwarded by the vulnerable interceptor chain despite decryption failure.razureink · Disclosed Jul 23, 2026 · markdown · python · networkPoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Apache Software FoundationTomcatapplication

F5Traffix Sdcapplication

Red HatEnterprise Linux Elsoperating_system

Red HatEnterprise Linux Eusoperating_system

Red HatEnterprise Linux Tusoperating_system

Red HatEnterprise Linux Update Services For Sap Solutionsoperating_system

Red HatJboss Web Serverapplication

Red HatRed Hat Enterprise Linuxoperating_system

External references

References

MITRE CVEcve.org · CVE-2026-34486 NVDnvd.nist.gov/vuln/detail/CVE-2026-34486 MITRE CWE · CWE-311Missing Encryption of Sensitive Data Vendor Advisorylists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly Mitigationvicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat Third Party Advisoryaccess.redhat.com/errata/RHSA-2026:36787 Third Party Advisoryaccess.redhat.com/errata/RHSA-2026:36788 Third Party Advisoryaccess.redhat.com/errata/RHSA-2026:36789 Third Party Advisoryaccess.redhat.com/errata/RHSA-2026:36790 Third Party Advisoryaccess.redhat.com/errata/RHSA-2026:36876 Third Party Advisoryaccess.redhat.com/errata/RHSA-2026:36877 Third Party Advisoryaccess.redhat.com/errata/RHSA-2026:36878 +12 more referencesview more in app

Activity feed

Recent activity

88 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

tenable nessus pluginsNews · Oct 1, 2026Rocky Linux 10.2 [CIQ] Security Update: tomcat / tomcat-admin-... | Tenable®An Apache Tomcat EncryptInterceptor bypass that can result in missing encryption of sensitive data. It affects installed packages on Rocky Linux 10.2 hosts covered by CIQ advisory crlsa-2026_36788.Read more ↗nuclei templates pull requestsNews · Sep 18, 2026Improved CVE-2026-34486 to honor host:port targets (fallback remains 4000) by shreyas-malhotra · Pull Request #17275 · projectdiscovery/nuclei-templatesA vulnerability addressed by changing handling of the -u host argument so a supplied host:port is honored rather than always checking hardcoded port 4000.Read more ↗cyberveilleNews · Aug 7, 2026CISA ordonne la correction de 3 vulnérabilités activement exploitées : Langflow, N-central, Apache Tomcat | CyberVeilleA high-severity Apache Tomcat vulnerability stemming from an incomplete fix for CVE-2026-29146; it was reportedly manually exploited to deploy reverse shells on Tomcat servers.Read more ↗malware newsNews · Aug 7, 2026July 2026 CVE Landscape - Malware Analysis - Malware Analysis, News and IndicatorsAn Apache Tomcat vulnerability listed among vulnerabilities actively exploited or operationally weaponized in July 2026.Read more ↗

+30 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidence4Every report linking this CVE to a named adversary.

Associated malware2Malware families linked to this CVE, with evidence and IOCs.

Detection signatures2YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity38Community discussion across Reddit, Mastodon, and other social sources.