Published on 6 August 2026
Chinese attackers are currently exploiting a vulnerability in Apache Tomcat to gain complete control over vulnerable servers – and they're doing it with a worrying new method: their attacks are being automated and scaled up by artificial intelligence. On 4 August 2026, the US cybersecurity agency CISA added the security flaw CVE-2026-34486 to its catalogue of actively exploited vulnerabilities (Known Exploited Vulnerabilities, or KEV for short). If you run an Apache Tomcat server, you should act now.
Apache Tomcat is a widely used piece of software that runs Java-based web applications – think of it as the engine that powers many corporate websites and web applications behind the scenes. And it's precisely this engine that contains the flaw.
The vulnerability CVE-2026-34486 (severity CVSS 7.5, "High") is particularly annoying because it is what's known as a regression: it was introduced by a faulty patch for an earlier flaw named CVE-2026-29146. In other words, the attempt to fix an old problem created a new one. The Apache Software Foundation puts it this way:
"An error in the fix for CVE-2026-29146 allowed the EncryptInterceptor to be bypassed." – Apache Software Foundation
Translated, this means: an error in the fix for the previous flaw allows attackers to bypass the so-called EncryptInterceptor. The EncryptInterceptor is a protective function that encrypts communication between multiple interconnected Tomcat servers (a "cluster"). If this protection is bypassed, sensitive data can be transmitted unencrypted and intercepted. Technically, the flaw is classified as "Missing Encryption of Sensitive Data".
The alarming part: the flaw is already being actively exploited. The security firm Palo Alto Networks Unit 42 reported on 30 July 2026 on an attack campaign in which a Chinese-speaking threat actor (known by the aliases knaithe and KnYuan) exploited this and other vulnerabilities. In doing so, the attackers placed so-called reverse shells on nine Apache Tomcat servers. A reverse shell is a hidden connection that gives the attacker full remote control over the system – as if they were sitting right at the keyboard.
What makes these attackers especially dangerous is their approach. According to Unit 42, this is an AI-driven, autonomous attack campaign:
"Unit 42 identified an AI-enabled autonomous hacking campaign carried out by a Chinese-speaking threat actor. They targeted infrastructure using seven vulnerabilities, combining autonomous AI-driven enumeration with manual exploitation that achieved confirmed impact." – Palo Alto Networks Unit 42
The attackers deploy an AI model (DeepSeek, controlled via a so-called "Hermes Agent") to automatically search for and attack vulnerable systems. This means that attacks which used to take human hackers a lot of time now run semi-automatically and on a large scale.
For the actual break-in, the attackers use a technique called Java deserialisation – specifically via a so-called CommonsCollections6 gadget with the well-known tool "ysoserial". Put simply, they inject manipulated data that the server then executes as program code. This gives them Remote Code Execution (RCE) – the remote execution of arbitrary malicious code, the most severe category of compromise.
The malware used here is the SNOWLIGHT malware family. The security firm SOCRadar clearly attributes this to state-linked Chinese actors:
"The core delivery mechanisms have been definitively linked to the SNOWLIGHT malware family. Tracked by the Google Threat Intelligence Group since 2024, identified loaders are heavily associated with China-nexus access brokers UNC5174 and UNC6586." – SOCRadar Threat Research Unit
Important to understand: the patches have been available since April 2026. Anyone who has not updated by now has been vulnerable for months.
All Apache Tomcat installations in versions prior to 11.0.21, 10.1.54 and 9.0.117 are affected. The flaw affects in particular systems that use the EncryptInterceptor for cluster communication.
Even though Apache Tomcat is often used as internal middleware – that is, as an intermediate layer without direct internet exposure – the attack surface is enormous: according to scans, in October 2025 there were more than 540,000 Apache Tomcat instances publicly reachable from the internet worldwide. Tomcat holds a considerable market share among web and application servers, with around 42 percent of customers based in the US – but the software is also widely used in Germany.
For small and medium-sized businesses the risk is very high. If your website, your customer portal or an internal Java-based application is running, chances are good that a Tomcat server is working somewhere in the background – often set up by a service provider and then forgotten.
Should you find any indications relating to point 3 or 4, assume a compromise and immediately bring in an IT security expert – and observe the GDPR reporting obligations mentioned further below.
If your website or application is managed by an external service provider or hosting company, ask today which Tomcat version is in use and whether the patch has already been applied. Get it confirmed in writing.
This vulnerability must be taken particularly seriously for two reasons. First, it is not being exploited by casual hackers, but by highly professional, state-linked Chinese actors. Second, they scale their attacks with artificial intelligence – meaning that even smaller, less prominent targets are found and attacked automatically. The idea of being "too unimportant for attackers" no longer holds up in the face of automated mass scans.
A successful attack leads to a complete compromise of the server. This gives attackers potential access to all data processed on that system – including your customers' personal data.
This is precisely where the General Data Protection Regulation (GDPR) comes into play. Since the flaw is based on the missing encryption of sensitive data and attackers can gain full control over the server, there is a very high risk of data exfiltration. Under Article 33 GDPR, you must report a breach of the protection of personal data to the competent supervisory authority without undue delay and, where feasible, within 72 hours – unless the breach is unlikely to result in a risk to the rights and freedoms of the data subjects.
In the case of a compromise via reverse shell and RCE, this "low risk" is practically no longer given – a report is generally mandatory. In addition, under Article 34 GDPR there may be an obligation to inform the affected data subjects themselves. Anyone who, on top of all this, is demonstrably shown to have taken inadequate protective measures – such as failing to apply patches available for months – risks fines under Article 83 GDPR.
CVE-2026-34486 is a case study in why the prompt installation of security updates is not an optional chore but an obligation. The patches have been available since April 2026 – yet attackers managed to hijack vulnerable servers over the course of months. With its inclusion in the CISA KEV catalogue on 4 August 2026, it is now officially confirmed: this flaw is being actively exploited, and by highly professional, AI-driven actors.
For small and medium-sized businesses, this means concretely: check today whether and in which version Apache Tomcat is in use at your organisation, and update immediately to 11.0.21, 10.1.54 or 9.0.117. Shield your servers from the open internet and examine your logs for the indicators of compromise mentioned above. And if you have entrusted operations to a service provider: demand written confirmation that the patch has been applied.
The combination of an available patch, active exploitation and a high GDPR risk leaves no room for delay. Act now – before the attackers' automation finds your server.