Tomcat EncryptInterceptor bypass (CVE-2026-34486) + N-central auth bypass (CVE-2026-18556)

Ankit Mehta@Secvyn

•updated Aug 6, 2026•4•1•2

This rule monitors for suspicious activity by detecting two distinct patterns: first, network connections initiated by Java processes located in tomcat/catalina directories on high-risk ports; second, suspicious administrative audit actions (Add admin, Modify credential, Export device list) within N-central where the initiating user context is missing.