CVE-2026-34486

This repository contains a functional exploit PoC for CVE-2026-34486, demonstrating a bypass in Apache Tomcat's EncryptInterceptor due to incorrect placement of the super.messageReceived() call outside the try-catch block, leading to deserialization of unencrypted payloads.

This repository contains a Python script designed to detect Apache Tomcat Tribes cluster nodes by sending crafted Tribes protocol packets and analyzing responses. It does not exploit CVE-2026-34486 but serves as a scanner to identify vulnerable targets.

This repository contains a functional exploit for CVE-2026-34486, targeting Apache Tomcat's Tribes clustering module. The exploit leverages a deserialization vulnerability in the EncryptInterceptor to achieve unauthenticated RCE on port 4000.

This repository contains a functional exploit for CVE-2026-34486, targeting a deserialization vulnerability in Apache Tomcat's Tribes EncryptInterceptor. The PoC crafts a malicious serialized payload and sends it via a custom network packet to achieve remote code execution (RCE).