Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-abt4-b2cv-eygv
Vulnerability ID VCID-abt4-b2cv-eygv
Aliases CVE-2026-34486
GHSA-69r9-qgr7-g2wj
Summary
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-311 Missing Encryption of Sensitive Data
CWE-807 Reliance on Untrusted Inputs in a Security Decision
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34486.json
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2026-34486
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2026-34486
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2026-34486
apache_tomcat Important https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34486
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-69r9-qgr7-g2wj
cvssv3.1 7.5 https://github.com/apache/tomcat
generic_textual HIGH https://github.com/apache/tomcat
cvssv3.1 7.5 https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
generic_textual HIGH https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
ssvc Track https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2026-34486
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-34486
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34486.json
https://api.first.org/data/v1/epss?cve=CVE-2026-34486
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/apache/tomcat
https://github.com/apache/tomcat/commit/1fab40ccc752e22639eccfe290d5624afad7eccd
https://github.com/apache/tomcat/commit/55f3eb9148233054fccfdf761141c6894a050be1
https://github.com/apache/tomcat/commit/776e12b3e2b0b4507b8a3b62c187ceb0b74bf418
https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
https://nvd.nist.gov/vuln/detail/CVE-2026-34486
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.54
https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.21
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.117
2457027 https://bugzilla.redhat.com/show_bug.cgi?id=2457027
CVE-2026-34486 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34486
CVE-2026-34486 https://www.herodevs.com/vulnerability-directory/cve-2026-34486
GHSA-69r9-qgr7-g2wj https://github.com/advisories/GHSA-69r9-qgr7-g2wj
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34486.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/tomcat
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T20:20:09Z/ Found at https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-34486
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.01804
EPSS Score 0.00012
Published At April 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-10T00:03:25.879246+00:00 Apache Tomcat Importer Import https://tomcat.apache.org/security-11.html 38.1.0