# CERT-FR flags multiple Apache Tomcat flaws

Published: 2026-10-21 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/dae9d750-9dad-5ed5-a9f7-e8e454ad4cbd/cert-fr-flags-multiple-apache-tomcat-flaws

> CERT-FR advisory covers multiple Apache Tomcat vulnerabilities allowing data confidentiality breaches and security bypass; patches available.

CERT-FR has published an advisory describing multiple vulnerabilities affecting Apache Tomcat versions 10.1.x prior to 10.1.61, 11.0.x prior to 11.0.27, and 9.0.x prior to 9.0.123. The flaws can allow an attacker to compromise data confidentiality and bypass security policy controls; at least one issue is described by the vendor without further specification of impact. No exploitation in the wild is mentioned in this advisory.

Nine CVEs are referenced (CVE-2026-101296, CVE-2026-101356, CVE-2026-103119, CVE-2026-65183, CVE-2026-74048, CVE-2026-74049, CVE-2026-80353, CVE-2026-88041, CVE-2026-93446). Defenders running affected Tomcat installations should apply the vendor patches referenced in the Apache Tomcat security bulletins for the 9.0.123, 10.1.61, and 11.0.27 releases as soon as possible.

## Mentioned in this report

- Vulnerabilities: CVE-2026-101296, CVE-2026-101356, CVE-2026-103119, CVE-2026-65183, CVE-2026-74048, CVE-2026-74049, CVE-2026-80353, CVE-2026-88041, CVE-2026-93446

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1358

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/dae9d750-9dad-5ed5-a9f7-e8e454ad4cbd/cert-fr-flags-multiple-apache-tomcat-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup