High7.5Apache Software Foundation Exploited CISA KEV

High [CVE-2026-29146 +1] Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

This high-severity Apache Software Foundation advisory covers CVE-2026-29146 and CVE-2026-34486 affecting Apache Tomcat.

CVE-2026-34486 Published Apr 9, 2026Updated by vendor Aug 6, 2026

CVE-2026-29146 CVE-2026-34486

Affected products & platforms

Apache Software FoundationTomcat

Open vendor advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

CISA Known Exploited Vulnerability

Listed:: Aug 4, 2026 · federal remediation due Aug 7, 2026
Required action:: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware use:: Unknown

KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.

Affected versions

Apache Tomcat 11.0.20
Apache Tomcat 10.1.53
Apache Tomcat 9.0.116

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Fixed versions

11.0.21
10.1.54
9.0.117

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Sources

Official and corroborating records used to build this advisory.

CVE.org CNA affected-product recordCVE.org
Structured CNA affected[] data independently confirmed the affected product scope; native advisory content remains authoritative.
CVE Program
NVD discovery recordNVD
Independent discovery and scoring cross-reference. Vendor remediation guidance takes precedence. Discovered from the machine-readable feed https://services.nvd.nist.gov/rest/json/cves/2.0; this link opens the NVD record for CVE-2026-29146 instead of the raw feed document.
NIST National Vulnerability Database

Cross-references

Validate CVE metadata against the authoritative registries.

Official resources

Apache Tomcat security bulletins (per major version) (target: 11.0.21 / 10.1.54 / 9.0.117)
Official documentation
This advisory names 11.0.21 / 10.1.54 / 9.0.117 as the first fixed releases — official upgrade documentation for Apache Tomcat security bulletins (per major version).
ASF Security — reporting & CVE process
Official documentation
The Apache Software Foundation's official security page: how ASF CVEs are published and where each project's advisories live.
Apache project downloads (fixed releases)
Official documentation
Official ASF download tree — fetch the fixed release named in this advisory from the project's directory.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.