Apache Tomcat EncryptInterceptor Bypass Added to KEV — Patch by Aug 7

Exploitation confirmed. CISA added CVE-2026-34486 — an Apache Tomcat flaw — to the Known Exploited Vulnerabilities catalog on August 4, in a three-CVE batch. FCEB remediation deadline is August 7. Fixed builds already exist. If you run clustered Tomcat, this is your afternoon.

What it is

CWE-311, missing encryption of sensitive data. The flaw lets an attacker bypass Tomcat’s EncryptInterceptor — the component that encrypts node-to-node traffic in a clustered (Tomcat Tribes) deployment. Bypass it and the cluster communication that is supposed to be encrypted no longer is.

Root cause, per the vendor: an error in the fix for CVE-2026-29146. This is a regression in a prior patch, not a fresh defect — confirmed by the Apache Tomcat security notes and Red Hat’s tracking. Severity: CVSS 7.5, High (source: NVD/vendor, not our estimate).

Affected and fixed

• Affected: 11.0.20, 10.1.53, 9.0.116.
• Fixed: 11.0.21, 10.1.54, 9.0.117.

Upgrade to the fixed build on your branch. There is no configuration toggle that substitutes for the patch here — if you depend on EncryptInterceptor for cluster confidentiality, its guarantee is void on a vulnerable build.

Exploitation status

Active. Reporting attributes in-the-wild activity to a Chinese-speaking threat actor running an AI-assisted campaign, with observed attempts to deploy Java deserialization-based reverse shells against vulnerable Tomcat servers (CyberSecurityNews). Treat the deserialization angle as the payload path to watch, not a single indicator — we are not publishing exploitation detail.

Confidence: KEV listing and patch availability are confirmed. The specific threat-actor attribution and campaign tooling are as reported — credible, single-lane sourcing, not independently verified here. Act on the confirmed part; don’t wait on the attribution.

Do this

1. Inventory Tomcat by exact build, not “we run Tomcat.” The three affected builds are narrow — you either match one or you don’t.
2. Upgrade to 11.0.21 / 10.1.54 / 9.0.117.
3. If you run a cluster with EncryptInterceptor, assume node traffic on a vulnerable build was interceptable and scope accordingly.
4. Don’t expose the management or cluster surfaces to the open internet while you stage the upgrade.

This landed the same week as the N-able N-central KEV bypass — two actively-exploited entries, both fixes-of-fixes. The pattern this week is incomplete patches, not novel bugs. Verify the build number, not the changelog.

Sources: CISA KEV alert (Aug 4, 2026); Apache Tomcat security pages; Red Hat; CyberSecurityNews. Version and CVSS details as published by the vendor and CISA — verify against your own Apache advisory before acting.