A vulnerability marked as problematic has been reported in Apache Tomcat up to 9.0.116/10.1.53/11.0.20. Affected by this vulnerability is an unknown functionality. The manipulation leads to missing encryption of sensitive data. This vulnerability is referenced as CVE-2026-34486. Remote exploitation of the attack is possible.
| Vendor | Product | Versions |
|---|---|---|
| apache | tomcat | 11.0.20, 10.1.53, 9.0.116 |
Updated description with new details, changed severity to HIGH, set CVSS estimate to 7.5, and marked the vulnerability as actively exploited.
Initial creation
