CVE-2026-34486

Apache Tomcat is like the “front door” and traffic guard for Java web apps. This bug lets an attacker slip past a protection that should encrypt certain sensitive responses, so protected information can be seen instead. Think of it as a door lock that can be tricked into opening without actually unlocking it.

This matters if you run Apache Tomcat (or a product that includes it) on versions 11.0.20, 10.1.53, or 9.0.116. It’s a network-reachable issue and does not require an attacker to be logged in or to trick a user into clicking something. Based on the findings, it becomes a real risk when the affected Tomcat instance is reachable from the attacker’s network path (commonly the internet or any exposed network), since the flaw is triggered over the network without authentication.

This is RED because it’s confirmed to be exploited in the wild and listed in CISA’s Known Exploited Vulnerabilities catalog. Attackers can use it over the network without authentication to bypass encryption protections and access sensitive data, so delaying patching materially increases your chance of compromise. The CISA remediation due date is 2026-08-07.