Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-34486.
Unlock with Pro - from £29/user/moDetect Apache Tomcat Missing Encryption of Sensitive Data (CVE-2026-34486) in Microsoft Sentinel
Detects potential exploitation or exposure conditions related to CVE-2026-34486, an Apache Tomcat vulnerability (CWE-311: Missing Encryption of Sensitive Data) allowing sensitive data such as credentials, session identifiers, or configuration secrets to be transmitted or stored without adequate encryption. Actively exploited and listed in CISA KEV; associated with CISA BOD 26-04 prioritized remediation guidance. Detection focuses on plaintext transmission of Tomcat-managed credentials/session tokens over unencrypted channels, anomalous access to Tomcat configuration files (server.xml, context.xml, tomcat-users.xml, web.xml) containing sensitive data, and network indicators of cleartext protocol usage to Tomcat listener ports.
MITRE ATT&CK
KQL Detection Query
// Detect plaintext access/config-file reads and cleartext HTTP traffic to Tomcat services indicative of CVE-2026-34486 exposure
let TomcatPorts = dynamic([8080,8009,80]);
union isfuzzy=true
(DeviceProcessEvents
| where FileName in~ ("cat","type.exe","more.exe","findstr.exe","grep")
| where ProcessCommandLine has_any ("tomcat-users.xml","server.xml","context.xml","web.xml")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName),
(DeviceNetworkEvents
| where RemotePort in (TomcatPorts)
| where Protocol == "Tcp" and isnotempty(RemoteUrl)
| where RemoteUrl startswith "http://"
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName)
| sort by TimeGenerated descIdentifies local access to sensitive Tomcat configuration files that may contain unencrypted credentials, and cleartext HTTP connections to common Tomcat listener ports, consistent with exploitation of CVE-2026-34486.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrator reviewing Tomcat configuration files for maintenance
- Internal HTTP traffic on lab/dev networks where TLS termination happens upstream
- Automated configuration management tools (Ansible/Chef/Puppet) reading config files as part of normal deployment
Other platforms for CVE-2026-34486
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate cleartext credential exposure in tomcat-users.xml
Expected signal: File creation and read events for tomcat-users.xml containing plaintext credential strings
- Test 2Simulate cleartext HTTP request to Tomcat port
Expected signal: Network connection event to destination port 8080 using HTTP protocol without TLS
- Test 3Simulate access to Tomcat server.xml configuration file
Expected signal: DeviceProcessEvents/DeviceFileEvents showing PowerShell reading server.xml with connector definitions
- Test 4Simulate AJP cleartext connector probe
Expected signal: Network connection attempt logged to destination port 8009 (AJP) without TLS negotiation
References (4)
- https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-34486
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-34486 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month