Apache Tomcat CVE-2026-34486: the patch created the bug
CISA added Apache Tomcat CVE-2026-34486 to its exploited list. The flaw was introduced by an earlier security fix — patch tracking has to be a loop.
CISA added three actively exploited flaws to its Known Exploited Vulnerabilities catalog on August 4, with a federal patch deadline of August 7. The one worth your attention isn't the scariest by score — it's Apache Tomcat CVE-2026-34486, because that vulnerability was created by the fix for a previous vulnerability. If you patched Tomcat quickly in March and then moved on, you are the exposed one.
What actually happened
Per The Hacker News and SecurityWeek, CVE-2026-34486 is a missing-encryption flaw rated CVSS 7.5. It lets an attacker bypass EncryptInterceptor, the Tomcat cluster component that wraps pre-shared-key encryption around traffic between cluster nodes. Bypass it and session data moving between nodes travels in the clear.
The origin matters: the bug was introduced by the fix for CVE-2026-29146, a padding oracle issue in that same interceptor. The bad versions are the ones that took that fix — 11.0.20, 10.1.53, and 9.0.116. It was corrected in April in 11.0.21, 10.1.54, and 9.0.117.
Exploitation is attributed to a Chinese-speaking operator running DeepSeek through the Hermes agent framework for autonomous recon and exploitation — the same campaign pattern we wrote about last week.
The other two CISA entries tell the same story from a different angle. Langflow CVE-2026-9198 is an unauthenticated RCE at CVSS 9.8, fixed in 1.10.1 back in July, with a public proof-of-concept now circulating. And N-able N-central shipped two auth-bypass CVEs at CVSS 8.2 — CVE-2026-18556 and CVE-2026-18577 — because the first patch was incomplete.
Why it matters for your business
Two of the three exploited bugs in this batch exist because a patch didn't hold. That kills the mental model most small teams run on: patch once, close the ticket, feel safe for a quarter.
Track fixed versions, not patch events. "We patched Tomcat in March" is not an answer; "we're on 11.0.21" is. If your hosting provider or dev agency manages the stack, that's the exact question to put in writing.
Then check whether you run Tomcat clustering at all. Plenty of small deployments run a single node, where EncryptInterceptor is irrelevant and this CVE is noise. Knowing which of your services actually use a component is what turns a CVE feed from anxiety into a ten-minute task.
Key takeaways
- CVE-2026-34486 (CVSS 7.5) bypasses Tomcat's EncryptInterceptor, exposing cluster traffic that should be encrypted
- The flaw was introduced by the fix for CVE-2026-29146 — only versions 11.0.20, 10.1.53, and 9.0.116 are affected
- Fixed in 11.0.21, 10.1.54, and 9.0.117; CISA's federal deadline was August 7
- Same KEV batch: Langflow CVE-2026-9198 (CVSS 9.8 unauth RCE, PoC public) and two N-able N-central bypasses where the first patch was incomplete
- Track the version number you're running, not the date you last patched
Nobody can name the versions you're running? We build a real inventory of your stack, wire advisories to the components you actually use, and set patch windows that survive a busy week. See how we harden your stack or book an exposure review.
Sources: CISA, The Hacker News, SecurityWeek.
- #apache-tomcat
- #cve-2026-34486
- #cisa-kev
- #patching
- #security
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Rust's new LLM policy ships with a circuit breaker
Five Rust teams adopted an LLM policy: use AI to review, not to create. Disclosure is mandatory and there's an automatic kill switch. Copy the structure.
Read it77 malicious Open VSX extensions mapped developer machines
An evil-twin campaign put 77 fake extensions on Open VSX that fingerprinted dev machines, Git repos, and CI pipelines. What to check in your editor today.
Read it