CERT-FR: Multiple vulnerabilities in Apache Tomcat 9.0, 10.1 and 11.0 allow data disclosure and security bypass
The CERT-FR advisory CERTFR-2026-AVI-1358 reports multiple vulnerabilities in Apache Tomcat. According to the advisory, an attacker could exploit them to breach data confidentiality, bypass the security policy, or trigger an unspecified security issue. The advisory lists nine CVEs and does not report active exploitation. Apache published fixes on 12 October 2026.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1358 covers nine CVEs in Apache Tomcat: CVE-2026-101296, CVE-2026-101356, CVE-2026-103119, CVE-2026-65183, CVE-2026-74048, CVE-2026-74049, CVE-2026-80353, CVE-2026-88041 and CVE-2026-93446. The advisory says they allow a confidentiality breach, a security policy bypass, or an issue the vendor did not specify. It gives no per-CVE ranking, component, CVSS score or attacker prerequisites, so the most severe cannot be identified. Affected: Tomcat 9.0.x before 9.0.123, 10.1.x before 10.1.61 and 11.0.x before 11.0.27, which are the fixed versions. No active exploitation is reported.
Como funciona
The advisory does not describe how any of the nine flaws works, so the vulnerable process cannot be reconstructed from the available sources. It only states the possible outcomes: disclosure of data, bypass of a security policy, or an unspecified security problem. Per-CVE mechanisms are in the Apache Tomcat security bulletins, which were not included in the material.
Por que é vulnerável
The sources do not state the root cause of any of the nine CVEs, nor why they went unnoticed. They say only that Apache fixed them in Tomcat 9.0.123, 10.1.61 and 11.0.27, without describing what the fixes change. The per-CVE details are on the vendor's security pages.
Como foi descoberta
The CERT-FR advisory, dated 21 October 2026, says multiple vulnerabilities were discovered in Apache Tomcat but does not say who found them or how they were reported. Apache published the fixes in its security bulletins of 12 October 2026 for 9.0.123, 10.1.61 and 11.0.27. No exploitation in the wild is reported.
Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 12:18.
Detalhes técnicos
- Impact categories: confidentiality breach, security policy bypass, and an issue not specified by the vendor.
- Affected versions: Tomcat 9.0.x before 9.0.123, Tomcat 10.1.x before 10.1.61, and Tomcat 11.0.x before 11.0.27.
- CVEs: CVE-2026-101296, CVE-2026-101356, CVE-2026-103119, CVE-2026-65183, CVE-2026-74048, CVE-2026-74049, CVE-2026-80353, CVE-2026-88041, CVE-2026-93446.
- The advisory gives no per-CVE details, CVSS scores or exploitation data.
Remediação
- Upgrade to Tomcat 9.0.123, 10.1.61 or 11.0.27, as listed in the Apache Tomcat security bulletins of 12 October 2026.
- Consult the vendor security pages for per-CVE details.
Linha do tempo
-
CERT-FR: Multiple vulnerabilities in Apache Tomcat 9.0, 10.1 and 11.0 allow data disclosure and security bypass
ler a análise desta fonte ocultar
The CERT-FR advisory CERTFR-2026-AVI-1358 reports multiple vulnerabilities in Apache Tomcat. According to the advisory, an attacker could exploit them to breach data confidentiality, bypass the security policy, or trigger an unspecified security issue. The advisory lists nine CVEs and does not report active exploitation. Apache published fixes on 12 October 2026.
Technical Details
- Impact categories: confidentiality breach, security policy bypass, and an issue not specified by the vendor.
- Affected versions: Tomcat 9.0.x before 9.0.123, Tomcat 10.1.x before 10.1.61, and Tomcat 11.0.x before 11.0.27.
- CVEs: CVE-2026-101296, CVE-2026-101356, CVE-2026-103119, CVE-2026-65183, CVE-2026-74048, CVE-2026-74049, CVE-2026-80353, CVE-2026-88041, CVE-2026-93446.
- The advisory gives no per-CVE details, CVSS scores or exploitation data.
Remediation
- Upgrade to Tomcat 9.0.123, 10.1.61 or 11.0.27, as listed in the Apache Tomcat security bulletins of 12 October 2026.
- Consult the vendor security pages for per-CVE details.