Back to the CVE list
CVE-2026-34486 CISA KEV · Actively exploitedSuited to automated attack · CISA

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

CVSS score

7.5

EPSS probability

%6.6

Risk score

1.0

Published

6 mo ago

OverviewPublic Exploits (8)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
striga-ai/CVE-2026-34486
GitHub

Apache Tomcat Tribes EncryptInterceptor fail-open bypass, unauthenticated RCE PoC (★16)

Public PoCSource updated: 12.05.2026 03:48:27
G
AirSkye/CVE-2026-34486-poc
GitHub

CVE-2026-34486 Apache Tomcat EncryptInterceptor 绕过漏洞复现（使用GLM5.1复现完成） (★1)

Public PoCSource updated: 15.04.2026 18:43:33
G
punitdarji/tomcat-cve-2026-34486
GitHub

CVE labs (★0)

Public PoCSource updated: 15.04.2026 15:55:45
G
404-src/CVE-2026-34486
GitHub

Apache Tomcat EncryptInterceptor Bypass → Unauthenticated RCE (CVE-2026-34486) (★0)

Public PoCSource updated: 15.04.2026 22:58:26
G
helGayhub233/CVE-2026-34486-Tribes
GitHub

Tribes 协议探测 (★0)

Public PoCSource updated: 16.04.2026 19:01:46
G
razureink/cve-2026-34486-tomcat_encrypt_bypass_reproduction
GitHub

CVE Reproduction: cve-2026-34486-tomcat_encrypt_bypass_reproduction (★0)

Public PoCSource updated: 23.07.2026 12:46:40
G
CypherHippie/CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization
GitHub

EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization. (★0)

Public PoCSource updated: 19.08.2026 09:39:24
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-34486.yaml
Nuclei

Nuclei: Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-34486"