Vulnerability intelligence
CVE-2026-24072
An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
CVSS Score
8.8
High
EPSS — Exploit Probability
0.7%
Riskier than 47% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
Patch available
Vendor fix published
1 article across 1 outlet · first covered May 5, 2026 · latest May 5, 2026
Coverage timeline
-
Apache patches HTTP Server and MINA flaws, warns of RCE riskwww.securityweek.com · May 5, 2026