# CERT-FR Flags Multiple Apache Kafka CVEs

Published: 2026-10-29 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/eacb94d0-3aef-5960-9ba5-5b0ce5760e61/cert-fr-flags-multiple-apache-kafka-cves
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory lists multiple Apache Kafka vulnerabilities allowing denial of service, data integrity and confidentiality breaches; patch to 4.3.2 or 4.2.2.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1415

## What to check

- Applies to: The 12 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR published an advisory describing multiple vulnerabilities affecting Apache Kafka, a widely used distributed event-streaming platform. The flaws impact Apache Kafka versions 4.3.x prior to 4.3.2, all versions prior to 4.2.2, and (for CVE-2026-110952 specifically) versions prior to 4.4.0. Collectively, the vulnerabilities could allow a remote attacker to cause denial of service, compromise data confidentiality, undermine data integrity, or bypass security policies.

The advisory does not indicate active exploitation in the wild; it is a standard vendor-coordinated disclosure referencing Apache's own CVE list published 28 October 2026. No technical details of individual flaws are provided beyond the CVE identifiers, and no proof-of-concept or exploitation activity is mentioned.

Defenders running Apache Kafka should prioritize upgrading to the fixed versions (4.3.2, 4.2.2, or 4.4.0 depending on the specific CVE) as referenced in Apache's official security bulletin. Given the range of impacts across confidentiality, integrity, and availability, organizations should treat this as a routine but important patching cycle for Kafka deployments, particularly those exposed to untrusted networks or multi-tenant environments.

## Mentioned in this report

- Vulnerabilities: CVE-2026-110952, CVE-2026-110985, CVE-2026-111073, CVE-2026-111108, CVE-2026-111115, CVE-2026-111496, CVE-2026-111551, CVE-2026-112375, CVE-2026-114349, CVE-2026-115644, CVE-2026-116593, CVE-2026-83525

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1415

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/eacb94d0-3aef-5960-9ba5-5b0ce5760e61/cert-fr-flags-multiple-apache-kafka-cves.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup