CVE-2026-34486: Apache Tomcat Tribes Unauthenticated RCE

Дата публикации: 25-08-2026 08:01:22

Apache Tomcat is an open-source Java application server that provides a robust platform for hosting Java web applications and enterprise services. The Tomcat Tribes module enables clustering functionality, allowing multiple Tomcat instances to communicate for session replication and high availability.
A recently disclosed vulnerability in the Tomcat Tribes clustering component allow an unauthenticated remote attacker to achieve remote code execution (RCE) by sending specially crafted cluster messages to an exposed Tribes receiver. The vulnerability is caused by a fail-open regression introduced during the fix for CVE-2026-29146, which allows malicious messages to bypass encryption validation and reach the deserialization stage. This vulnerability has been assigned CVE-2026-34486. This article analyzes CVE-2026-34486, the vulnerable code path, affected versions, and detection considerations.

Схожие новости

#	Наименование новости	Тональность	Информативность	Дата публикации
1	CVE-2026-34197: Apache ActiveMQ Jolokia API Remote Code Execution	0	10.34	24-08-2026
2	Critical TeamCity Flaw Could Let Unauthenticated Attackers Execute Server Commands	0	4.71	28-07-2026
3	Critical Atlassian Flaw CVE-2026-21589 Hits Eight Products and Lands on CISA’s Exploited List	0	9.22	16-10-2026
4	CVE-2026-46333: Local Root Privilege Escalation and Credential Disclosure in the Linux Kernel ptrace Path	0	7.54	20-05-2026
5	NetScaler CVE-2026-19490 Lets Attackers Bypass Authentication	0	7.33	19-08-2026
6	What is CVE-2026-66066? Protecting Your Rails App from Active Storage RCE	0	7.28	03-08-2026
7	Oracle Security Alert Advisory - CVE-2026-35273	0	10	11-06-2026
8	CVE-2026-17431: PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for	0	11.54	13-08-2026
9	GitLab Patches Critical CVE-2026-19478 GraphQL Vulnerability	0	6.97	19-08-2026
10	How do I fix the CVE-2026-53359 vulnerability?	0	6	08-07-2026

Классификация: . Схожих патентов: 0. Схожих новостей: 10. Тональность: 0. Информативность: 7.47. Источник: community.hpe.com.