Remote arbitrary code execution affecting Apache Tomcat
A vulnerability affecting Apache Tomcat could allow a remote attacker to bypass a cluster's communications encryption mechanism to cause arbitrary code execution on affected systems.
Description
Technical context and vulnerability details
Apache Tomcat is a web container and application server for Java environments. This solution is affected by a vulnerability labeled CVE-2026-34486 resulting from a regression during the correction of a previous flaw, allowing bypass of the protection mechanism provided by the EncryptInterceptor component. Exploitation of this vulnerability would allow an unauthenticated attacker to remotely execute arbitrary code on affected systems via a deserialization attack. It is classified high with a severity score of 7.5 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Bypassing cluster communications encryption mechanisms;
- Breach of confidentiality, integrity and availability of data;
Affected systems
Products, components and targeted versions
- All versions 9.0.x prior to Apache Tomcat version 9.0.116;
- All versions 10.1.x prior to Apache Tomcat version 10.1.53;
- All versions 11.0.x prior to Apache Tomcat version 11.0.20;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Apache Tomcat to its latest stable version depending on the branch used;
- Restrict network access to the cluster communication port (generally TCP/4000) to only trusted IP addresses, in accordance with good security practices recommended by the publisher;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.