[HIGH PRIORITY] Apache Tomcat Tribes EncryptInterceptor RCE (CVE-2026-34486)

⚠ HIGH PRIORITY — CISA KEV (Aug 4, 2026). CVE-2026-34486 is a fail-open regression in Apache Tomcat Tribes EncryptInterceptor. When decryption fails, raw attacker-controlled bytes reach Java deserialization — enabling unauthenticated remote code execution on TCP port 4000 (NioReceiver).

Affected Tomcat versions

• Apache Tomcat 9.0.116 → fix: 9.0.117
• Apache Tomcat 10.1.53 → fix: 10.1.54
• Apache Tomcat 11.0.20 → fix: 11.0.21
• Only when Tribes clustering + EncryptInterceptor enabled
• Tomcat 8.5.x not affected

Check version

catalina.sh version
rpm -q tomcat 2>/dev/null || dpkg -l tomcat* 2>/dev/null
ss -tlnp | grep 4000
grep -r EncryptInterceptor $CATALINA_HOME/conf/

Patching Method

1. Upgrade Tomcat to 9.0.117, 10.1.54, or 11.0.21.
2. Linux: dnf update tomcat / apt upgrade tomcat* or replace standalone tarball from apache.org.
3. Restart Tomcat service after upgrade: systemctl restart tomcat.
4. Verify fix restores fail-closed behavior on decrypt failure.
5. If clustering not required: disable Tribes and close port 4000.
6. Firewall: restrict TCP 4000 to trusted cluster member IPs only.
7. Monitor catalina.out for repeated Failed to decrypt message errors.
8. Audit classpath for dangerous deserialization gadget libraries.

# Restrict Tribes port
iptables -A INPUT -p tcp --dport 4000 -s CLUSTER_IP/32 -j ACCEPT
iptables -A INPUT -p tcp --dport 4000 -j DROP

Until patched

• Block port 4000 from all non-cluster sources at perimeter firewall
• Disable EncryptInterceptor/Tribes if session replication not needed
• Public PoC exists — prioritize internet-facing Tomcat clusters

CVSS: 7.5 High. Unauthenticated RCE via Java deserialization on port 4000.