CVE-2026-34486 Google Chronicle · YARA-L

Detect Apache Tomcat Missing Encryption of Sensitive Data (CVE-2026-34486) in Google Chronicle

Detects potential exploitation or exposure conditions related to CVE-2026-34486, an Apache Tomcat vulnerability (CWE-311: Missing Encryption of Sensitive Data) allowing sensitive data such as credentials, session identifiers, or configuration secrets to be transmitted or stored without adequate encryption. Actively exploited and listed in CISA KEV; associated with CISA BOD 26-04 prioritized remediation guidance. Detection focuses on plaintext transmission of Tomcat-managed credentials/session tokens over unencrypted channels, anomalous access to Tomcat configuration files (server.xml, context.xml, tomcat-users.xml, web.xml) containing sensitive data, and network indicators of cleartext protocol usage to Tomcat listener ports.

MITRE ATT&CK

Tactic
Credential Access Collection Initial Access

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2026_34486_tomcat_missing_encryption {
  meta:
    description = "Detects access to sensitive Tomcat config files or cleartext HTTP to Tomcat ports, consistent with CVE-2026-34486"
    severity = "HIGH"
  events:
    $file.metadata.event_type = "FILE_OPEN"
    $file.target.file.full_path = /tomcat-users\.xml|server\.xml|context\.xml|web\.xml/ nocase
    $net.metadata.event_type = "NETWORK_HTTP"
    $net.target.port = 8080 or $net.target.port = 8009 or $net.target.port = 80
    $net.network.tls.established = false
  match:
    $file.principal.hostname = $net.principal.hostname over 10m
  condition:
    $file or $net
}
high severity medium confidence

Chronicle YARA-L rule correlating sensitive Tomcat configuration file access with cleartext HTTP network sessions on the same host, indicating potential CVE-2026-34486 exploitation or data exposure.

Data Sources

Chronicle EDR File EventsChronicle Network Events

Required Tables

FILE_OPENNETWORK_HTTP

False Positives & Tuning

  • Config management agents legitimately reading files as part of scheduled compliance checks
  • Internal segmented networks where cleartext HTTP is an accepted risk behind other controls
  • Duplicate detections from multiple EDR sensors on the same host

Other platforms for CVE-2026-34486

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate cleartext credential exposure in tomcat-users.xml

    Expected signal: File creation and read events for tomcat-users.xml containing plaintext credential strings

  2. Test 2Simulate cleartext HTTP request to Tomcat port

    Expected signal: Network connection event to destination port 8080 using HTTP protocol without TLS

  3. Test 3Simulate access to Tomcat server.xml configuration file

    Expected signal: DeviceProcessEvents/DeviceFileEvents showing PowerShell reading server.xml with connector definitions

  4. Test 4Simulate AJP cleartext connector probe

    Expected signal: Network connection attempt logged to destination port 8009 (AJP) without TLS negotiation

Last updated: 2026-08-05 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the affected host is running Apache Tomcat and identify the version to verify it falls within scope of CVE-2026-34486 (missing encryption of sensitive data, CWE-311).
  2. Review Tomcat configuration files (server.xml, context.xml, tomcat-users.xml, web.xml) for cleartext credentials, session secrets, or connector definitions lacking SSL/TLS enforcement.
  3. Check network traffic logs for cleartext HTTP sessions on Tomcat listener ports (80, 8080, 8009/AJP) to determine if sensitive data was transmitted unencrypted.
  4. Correlate any alerts with CISA KEV status and BOD 26-04 prioritized remediation timelines to determine urgency of response.

Containment

  1. Enforce TLS on all Tomcat connectors (HTTP and AJP) and disable or restrict plaintext listeners to internal-only, firewalled segments.
  2. Rotate any credentials or session tokens discovered in plaintext configuration files or logs, including tomcat-users.xml entries.

Evidence Collection

  1. Preserve copies of Tomcat configuration files (server.xml, context.xml, tomcat-users.xml, web.xml) and access logs from the time window of suspected exposure.
  2. Capture network packet captures or flow logs showing cleartext sessions to/from the affected Tomcat instance for forensic review.

Escalation Criteria

  • !Escalate to incident response if evidence shows sensitive credentials or session tokens were transmitted in cleartext and potentially intercepted by an unauthorized party.
  • !Escalate to vulnerability management/patch teams if the Tomcat instance is internet-facing and unpatched, given active KEV exploitation status and BOD 26-04 mandated remediation deadlines.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Tomcat configuration files: server.xml, context.xml, tomcat-users.xml, web.xml
  • >Tomcat access and catalina logs showing connector protocol usage and client IPs
  • >Network flow/packet capture data showing cleartext HTTP or AJP sessions to Tomcat ports

Tuning Guidance

Baseline expected administrative access patterns to Tomcat configuration files (who, when, from where) to reduce noise from legitimate config management. Exclude known internal load balancers or health-check sources that intentionally use cleartext HTTP within segmented, low-risk network zones. Increase confidence when config file access is followed closely by outbound network connections or when the host is internet-facing.

Hunting Queries

Hunts for recent modifications to Tomcat configuration files and repeated cleartext HTTP access patterns that may indicate reconnaissance or active exploitation of the missing-encryption weakness.

Hunting — KQL
kql 
DeviceFileEvents
| where FileName in~ ("tomcat-users.xml","server.xml","context.xml","web.xml")
| where ActionType in ("FileModified","FileCreated")
| project TimeGenerated, DeviceName, FileName, InitiatingProcessAccountName
Hunting — SPL
spl 
index=* sourcetype=tomcat_access
| search "http://" AND ("8080" OR "8009")
| stats count by host, uri, clientip
| sort -count

Atomic Red Team Tests

Test 1 Simulate cleartext credential exposure in tomcat-users.xml
linux

Creates a test tomcat-users.xml file containing a plaintext password to simulate the missing-encryption condition described in CVE-2026-34486.

Command

bash 
mkdir -p /tmp/atomic-tomcat && printf '<tomcat-users>\n  <user username="testadmin" password="PlaintextPass123" roles="manager-gui"/>\n</tomcat-users>' > /tmp/atomic-tomcat/tomcat-users.xml && cat /tmp/atomic-tomcat/tomcat-users.xml

Cleanup

bash 
rm -rf /tmp/atomic-tomcat

Expected Telemetry

File creation and read events for tomcat-users.xml containing plaintext credential strings

Expected Detection

KQL/SPL rule flags process access to tomcat-users.xml with sensitive keyword match

Test 2 Simulate cleartext HTTP request to Tomcat port
linux

Sends an HTTP (non-TLS) request to a local test listener on port 8080 to simulate cleartext transmission to a Tomcat connector.

Command

bash 
python3 -m http.server 8080 --bind 127.0.0.1 & sleep 1; curl -s http://127.0.0.1:8080/manager/html -o /dev/null; kill %1

Cleanup

bash 
pkill -f 'http.server 8080' || true

Expected Telemetry

Network connection event to destination port 8080 using HTTP protocol without TLS

Expected Detection

EQL/QRadar rule flags cleartext HTTP session to Tomcat listener port

Test 3 Simulate access to Tomcat server.xml configuration file
windows

Reads a mock server.xml file to simulate an attacker or insider accessing Tomcat connector configuration that may lack SSL enforcement.

Command

powershell 
New-Item -Path $env:TEMP\server.xml -ItemType File -Value '<Server><Connector port="8080" protocol="HTTP/1.1"/></Server>' -Force; Get-Content $env:TEMP\server.xml

Cleanup

powershell 
Remove-Item $env:TEMP\server.xml -Force

Expected Telemetry

DeviceProcessEvents/DeviceFileEvents showing PowerShell reading server.xml with connector definitions

Expected Detection

KQL rule flags process command line referencing server.xml file access

Test 4 Simulate AJP cleartext connector probe
macos

Attempts a raw TCP connection to port 8009 (AJP) to simulate probing of an unencrypted Tomcat AJP connector, a known vector for missing-encryption exposure.

Command

bash 
nc -zv 127.0.0.1 8009

Cleanup

bash 
true

Expected Telemetry

Network connection attempt logged to destination port 8009 (AJP) without TLS negotiation

Expected Detection

Chronicle/CrowdStrike rule flags network connection to AJP port 8009

Related Detections

Tactic Hubs

TA0006Credential AccessTA0009CollectionTA0001Initial Access

Related Techniques

T1040Network SniffingT1552.001Credentials In Files

Same Tactic: Credential Access

Popular Detections