# CERT-FR Flags Multiple Apache Tomcat Flaws

Published: 2026-10-21 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/0dd2af84-a3b2-5db8-ad2c-1677f5e216cc/cert-fr-flags-multiple-apache-tomcat-flaws

> CERT-FR advises patching nine vulnerabilities in Apache Tomcat 9.x, 10.1.x and 11.0.x that risk data confidentiality and security bypass.

CERT-FR published an advisory covering multiple vulnerabilities in Apache Tomcat affecting versions 9.0.x prior to 9.0.123, 10.1.x prior to 10.1.61, and 11.0.x prior to 11.0.27. The vulnerabilities could allow an attacker to compromise data confidentiality, bypass security policies, or trigger other unspecified security issues as documented by the vendor. No exploitation in the wild is mentioned in the advisory.

Nine CVEs are referenced (CVE-2026-101296, CVE-2026-101356, CVE-2026-103119, CVE-2026-65183, CVE-2026-74048, CVE-2026-74049, CVE-2026-80353, CVE-2026-88041, CVE-2026-93446), though the advisory provides no technical details on each individual flaw's mechanism. Defenders running affected Tomcat versions should consult the Apache Tomcat security bulletins linked in the advisory and upgrade to the fixed versions (9.0.123, 10.1.61, or 11.0.27) as appropriate for their deployment.

## Mentioned in this report

- Vulnerabilities: CVE-2026-101296, CVE-2026-101356, CVE-2026-103119, CVE-2026-65183, CVE-2026-74048, CVE-2026-74049, CVE-2026-80353, CVE-2026-88041, CVE-2026-93446

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1358

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0dd2af84-a3b2-5db8-ad2c-1677f5e216cc/cert-fr-flags-multiple-apache-tomcat-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup