🔴 Critical | Source: CISA Known Exploited Vulnerabilities
A vulnerability in Apache Tomcat allows attackers to bypass the EncryptInterceptor, meaning data that should be encrypted in transit between cluster nodes is exposed in plaintext. This is a known exploited vulnerability, confirmed by CISA as being actively used in attacks. Organisations running Apache Tomcat in clustered environments are at direct risk of sensitive data interception.
Security Architect’s Take: Patch Apache Tomcat immediately to a version that resolves this bypass, and audit any clustered Tomcat deployments — particularly those exposed within internal VPCs or Kubernetes environments — to confirm EncryptInterceptor is functioning as intended. Consider temporarily disabling cluster replication over untrusted network segments until patching is complete.
Original advisory: CVE-2026-34486: Apache Tomcat