CISA added CVE-2026-34486 to its Known Exploited Vulnerabilities catalog on August 4, giving federal civilian agencies until today, August 7, to patch or disconnect affected Apache Tomcat clustering deployments. Unit 42 has already tied the flaw to an active, AI-assisted intrusion campaign attributed to a Chinese-speaking threat actor. The bug is notable less for its raw severity — CVSS 7.5 — than for what it represents: the second failed attempt to close a hole in Tomcat’s cluster communication encryption.

What’s broken

Tomcat’s optional clustering module, Tribes, lets multiple Tomcat instances share session state over the network. Because that traffic can carry sensitive session data, Tomcat offers EncryptInterceptor, a component that wraps cluster messages in pre-shared-key encryption so only nodes holding the shared key can read or inject traffic on the cluster channel.

Earlier this year, Apache patched CVE-2026-29146 (CVSS 9.8), a critical flaw in EncryptInterceptor involving missing encryption of cluster traffic. CVE-2026-34486 is the sequel: that fix was incomplete. The interceptor now correctly attempts decryption, but when decryption fails — meaning the message wasn’t encrypted with the correct pre-shared key, exactly the condition EncryptInterceptor exists to catch — the code path was found to still hand the message off to downstream interceptors instead of discarding it. An attacker who can reach the cluster receiver port (default 4000) doesn’t need the pre-shared key at all; they just need Tomcat’s deserialization-based cluster protocol to accept an unauthenticated, unencrypted message as if it had passed the encryption check.

From there it’s a standard Java deserialization primitive: a crafted cluster message triggers deserialization of attacker-controlled data on the receiving Tomcat node, which — depending on what’s on the classpath — can be turned into arbitrary code execution with no authentication and no valid pre-shared key required.

Affected: Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 (i.e., the versions that shipped the incomplete CVE-2026-29146 fix), and presumably any earlier release running the same EncryptInterceptor code path with clustering enabled.

Fixed in: 11.0.21, 10.1.54, and 9.0.117.

Deployments that don’t enable the Tribes clustering module, or don’t use EncryptInterceptor, are not exposed by this specific CVE — but that also means any organization relying on EncryptInterceptor for cluster confidentiality has been operating under a false sense of security since the original CVE-2026-29146 advisory shipped.

Active exploitation

Unit 42 reports that a Chinese-speaking threat actor operating under the aliases knaithe and KnYuan, assessed to be based in Zhuhai, China, has been manually probing and exploiting CVE-2026-34486 in the wild, attempting to plant Java deserialization-based reverse shells on at least nine internet-facing Apache Tomcat servers. Notably, researchers link this campaign to an AI-enabled, semi-autonomous attack chain — the actor is reported to have orchestrated targeting and payload delivery through DeepSeek via the “Hermes Agent” framework, using an LLM agent to drive parts of the exploitation workflow rather than scripting it by hand.

CVE-2026-34486 was disclosed alongside two other actively exploited flaws in the same CISA KEV batch — an unauthenticated RCE in Langflow (CVE-2026-9198) and an authentication bypass in N-able N-central (CVE-2026-18577) — both already under active exploitation and covered separately. All three landed in KEV the same week, underscoring how compressed the window from disclosure to weaponization has become for internet-facing infrastructure software.

Impact

Any organization running Tomcat clustering with EncryptInterceptor enabled and the cluster receiver port reachable from an untrusted network is exposed to unauthenticated RCE. Because Tribes clustering typically replicates session state across every node in a cluster, a single compromised node can pivot laterally to the rest of the cluster over the same channel the attack abused to get in. Given that clustering is commonly enabled precisely for high-value, session-heavy production deployments — not throwaway dev boxes — the blast radius tends to land on systems organizations can least afford to have compromised.

Mitigation

  1. Upgrade immediately to Tomcat 11.0.21, 10.1.54, or 9.0.117.
  2. If you can’t patch right away, restrict network access to the cluster receiver port (default 4000, configurable) to only the specific IPs of trusted cluster nodes — it should never be reachable from the general internet or a broad internal network segment.
  3. Rotate the cluster pre-shared key post-patch as a precaution, since the encryption bypass means the key’s confidentiality guarantee was not enforced during the exposure window.
  4. Hunt for indicators: unexpected outbound reverse shell connections from Tomcat server processes, unfamiliar child processes spawned by the java process running Tomcat, and unexplained cluster membership changes.
  5. Federal agencies subject to CISA BOD 22-01 should treat today’s remediation deadline as already past due if not yet actioned.

References