CISA KEV: Apache Tomcat CVE-2026-34486 (CVSS 3.1 7.5 HIGH) - Tomcat Missing Encryption of Sensitive Data Vulnerability

How we got to 8.5

1. 1
   CVSS technical severity (40%)

   Industry-standard exploitability + impact score. We prefer CVSS 4.0 and fall back to 3.1 per the FDA's Feb 2026 premarket cybersecurity guidance. Missing CVSS scores get a neutral 4.0 so unknown vulns are not over- or under-rated.

   3.1 base 7.5 × 40% = +3.00
2. 2
   Patient safety impact (35%)

   What happens to a patient if this vuln is exploited on a connected device. Auto-inferred from headline, dek, tags, and device class against a curated MedTech keyword library (pacemaker, infusion pump, EHR, PACS, etc.).

   Life-threatening → 10 × 35% = +3.50
3. 3
   Exploit maturity (15%)

   Is anyone actually using this in attacks? KEV listing > weaponized exploit > public PoC > none. KEV alone forces tier=critical regardless of CVSS.

   On CISA KEV (in-the-wild) → 10 × 15% = +1.50
4. 4
   MedTech exposure (10%)

   How likely this affects clinical operations: presence in our MedTech feed (+4 baseline), network-reachable signals (+3), known device-class tags (+2), identified MedTech vendor (+1).

   Exposure 5/10 × 10% = +0.50

Tier cutoffs: Critical ≥ 8.5 · High 7.0–8.4 · Notable 4.0–6.9 · Info < 4.0. Full methodology, weights, and changelog at /goatfeed/risk-rubric.