Vulnerability intelligence

CVE-2026-24072

Apache Software Foundation Apache HTTP Server CWE-269

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

CVSS Score

8.8

High

EPSS — Exploit Probability

0.7%

Riskier than 49% of all CVEs · checked 2026-09-06

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

1 article across 1 outlet · first covered May 5, 2026 · latest May 5, 2026

Coverage timeline

Apache patches HTTP Server and MINA flaws, warns of RCE risk
www.securityweek.com · May 5, 2026

Related CVEs — Apache Software Foundation

CVE-2026-80180 CVE-2026-80181 CVE-2026-81270 CVE-2026-80190 CVE-2026-50112 CVE-2026-63038 CVE-2026-63043 CVE-2026-63044