UNC5174

CVE-2026-34486 — Apache Tomcat: the fix for an earlier EncryptInterceptor flaw reintroduced a bypass, and CISA's KEV listing lands months after a China-nexus campaign was already exploiting it

CISA added CVE-2026-34486 to its Known Exploited Vulnerabilities catalog on 2026-08-04, listing it as an Apache Tomcat missing-encryption-of-sensitive-data vulnerability (CISA, 2026-08-04). The defect is a regression in a security fix: the Tomcat security team records that an error in the fix for CVE-2026-29146 allowed the EncryptInterceptor to be bypassed (Apache Software Foundation, 2026-04-09). That is the whole of the vendor's description, and it carries an important consequence for scoping — only the three releases that shipped the defective fix are affected: 9.0.116, 10.1.53 and 11.0.20. An estate on an older release never received the broken fix and is not exposed to this flaw. The corrected builds are 9.0.117, 10.1.54 and 11.0.21, released 2026-04-04 and public from 2026-04-09.

The exploitation is not new, and that is the finding. SOCRadar's analysis of an exposed adversary staging server places this CVE in an active China-nexus campaign months before the catalog entry, recording it as a Java deserialization path using a CommonsCollections6 gadget, Taiwan-focused, delivering the SNOWLIGHT loader (SOCRadar, 2026-07-31). SOCRadar's own timeline puts that exploitation in late April 2026 — within weeks of the 9 April public disclosure — and its per-CVE table records confirmed live command execution against targets. SOCRadar attributes the SNOWLIGHT family, tracked by Google's threat-intelligence group, to China-nexus access brokers UNC5174 and UNC6586, and describes a campaign whose targeting centres on government infrastructure.

So the honest reading of the KEV addition is not "attackers have started". It is that a defender relying on the catalog as their exploitation signal was, for this flaw, more than three months behind an actor already using it against government targets. That is worth internalising beyond this CVE: KEV records exploitation the catalog has confirmed, not exploitation that exists, and a KEV-driven patch queue inherits that lag.

Note also the scoring tension. Apache's own CNA entry rates the flaw only as 'important' in words; the numeric 7.5 and its confidentiality-only vector come from the CISA and Red Hat enrichment containers on the CVE record, and CISA's alert title frames the flaw as missing encryption of sensitive data — both consistent with "the encrypted cluster channel stopped being encrypted". SOCRadar reports command execution. A team triaging on the CVSS vector alone would have ranked this well below its demonstrated impact.

The exposure profile is narrow, and inverted from the usual instinct. Three conditions must hold: clustering enabled, EncryptInterceptor configured, and the Tribes receiver reachable. The middle one is the uncomfortable part — the exposed population is the operators who turned encryption on for session replication rather than leaving the channel in the clear.

Detection concepts, telemetry class first. Network-flow and firewall telemetry is the cleanest surface, because Tribes membership is normally a fixed, small mesh of known peers: a session to the configured receiver port from any source outside the declared membership has no legitimate explanation. On the host, process-creation telemetry with parent lineage showing a Tomcat or Catalina JVM spawning a shell or a command interpreter is the deserialization payoff, and SOCRadar's recorded operator behaviour — command-execution oracles such as id and whoami run per host — is what the reconnaissance stage looks like. In application logs, an EncryptInterceptor decryption-failure entry followed by successful message processing rather than a discard is the mechanism itself firing.

Triage: a decryption-failure log line alone is not the signal — clock skew, a rolling upgrade with mismatched keys, or a misconfigured new node all produce them, and in those cases the message is dropped and the peer is a known member. The discriminators are whether processing continued after the failure, and whether the source address belongs to the declared membership list.

Builds on: 2026-08-02/unit42-autonomous-campaign-confirmed-impact-was-understated