Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

🚨SEVERITY: HIGH — CVSS 7.5Security Advisory

TL;DR 📌

  • Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
  • Highest CVSS: 7.5 (High).
  • Listed in CISA KEV (2026-08-04) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-34486.

What it is

Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.

For leadership 🧭

Executive summary. An unauthenticated attacker with network access to a Tomcat cluster can bypass the encryption meant to protect inter-node traffic, exposing sensitive data in transit, and this is already being exploited. Given its presence in CISA’s Known Exploited Vulnerabilities catalogue, this needs attention this week, not at the next routine patch cycle.

Why it matters:

  • The flaw lets an attacker bypass the EncryptInterceptor, the component specifically responsible for encrypting traffic between clustered Tomcat nodes, undermining that protection entirely.
  • No authentication or user interaction is required and the attack can be carried out remotely over the network (AV:N, PR:N, UI:N), so any exposed clustered deployment is at risk.
  • It is confirmed to be actively exploited, having been added to CISA’s Known Exploited Vulnerabilities catalogue.
  • It can reportedly be chained with a separate Tomcat vulnerability, increasing the potential impact beyond data exposure alone.

Now / Next / Later:

  • Now: Identify every Tomcat deployment running clustering with the EncryptInterceptor enabled and check whether it is reachable from untrusted networks.
  • Next: Apply the vendor’s fixed Tomcat release to all affected clustered instances during the next available change window.
  • Later: Review cluster network segmentation so inter-node Tomcat traffic is never exposed beyond trusted hosts, regardless of the encryption layer’s integrity.

Source