39 matches found
CVE-2026-34486
CVE-2026-34486 Apache Tomcat Tribes クラスタリングにおける EncryptInterceptor のフェイルオープンバイパスにより、Java デシリアライゼーションを介した未認証 RCE に至る脆弱性。 影響を受けるバージョン: 11.0.19+、10.1.53+、9.0.116+。 修正済みバージョン: 11.0.21、10.1.54、9.0.117。 Bartlomiej Dmitruk striga.ai によって発見・報告されました。 解説: https://striga.ai/research/tomcat-tribes-unauth-rce...
Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. id: CVE-2026-34486 info: name: Apache Tomcat Tribes EncryptInterceptor Bypass - Remote...
CVE-2026-34486
CVE-2026-34486 — Apache Tomcat EncryptInterceptor 远程代码执行 Apache Tomcat Tribes 集群通信模块在 EncryptInterceptor 解密失败时未能丢弃消息，允许未认证攻击者通过 Java 反序列化在 4000 端口触发远程代码执行 。 漏洞详情 字段| 信息 ---|--- CVE ID| CVE-2026-34486 CVSS 评分| 7.5（高危） 组件| Apache Tomcat Tribes EncryptInterceptor 受影响版本| 9.0.0.M1 – 9.0.116 / 10.1.0-M...
CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization
CVE-2026-34486 Apache Tomcat Tribes 集群中 EncryptInterceptor 的 fail-open 绕过，导致通过 Java 反序列化实现未授权远程代码执行（RCE）。 受影响版本：11.0.19+、10.1.53+、9.0.116+。 修复版本：11.0.21、10.1.54、9.0.117。 发现并报告者：Bartlomiej Dmitruk（striga.ai）。 技术分析：https://striga.ai/research/tomcat-tribes-unauth-rce 环境要求 Docker Java 21 Python 3 用法...
Security Bulletin: Deserialization of Untrusted Data in Apache Axis2 affects AS4 of IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-66713)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-66713 DESCRIPTION: Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java...
CVE-2026-66713
A flaw was found in Apache Axis2/Java, specifically within its Tribes-based clustering component. When this clustering feature is enabled on Apache Tomcat, an attacker can exploit a vulnerability related to the deserialization of untrusted data. This allows an unauthenticated remote attacker, wit...
Deserialization of Untrusted Data
Overview org.apache.axis2:axis2-kernel is a Web Services / SOAP / WSDL engine, the successor to the widely used Apache Axis SOAP stack. Affected versions of this package are vulnerable to Deserialization of Untrusted Data the Tribes-based clustering channel in...
CVE-2026-66713
Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...
CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data
Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...
CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data
Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...
CVE-2026-66713
Apache Axis2/Java (versions through 2.0.0 ) is vulnerable to a Deserialization of Untrusted Data (CWE-502) flaw within the Tribes-based clustering component when running on Apache Tomcat . If Tribes clustering is enabled, an unauthenticated remote attacker with network access to the clustering po...
EUVD-2026-49849
Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...
CVE-2026-66713
Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...
CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data
Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...
CVE-2026-66713: Deserialization of Untrusted Data
Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...
PT-2026-65496
Name of the Vulnerable Software and Affected Versions Apache Axis2/Java versions prior to 2.0.1 Description An issue exists in the Tribes-based clustering component when running on Apache Tomcat. When Tribes clustering is enabled, an unauthenticated remote attacker with network access to the...
Exploit for Reliance on Untrusted Inputs in a Security Decision in Apache Tomcat
Lab Description This lab focuses on CVE-2026-34486, a hig...
CVE-2026-55955
A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component. Mitigation This vulnerability only...