Search/CVE-2026-24072
● CVE — High

CVE-2026-24072

VendorapacheProducthttp serverDiscoveredMay 4, 2026UpdatedOct 26, 2026

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

View graph Watch Export
CVSS v3.1
8.8 HIGH
EPSS
0.65%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
1
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Connections
3 relationships
Timeline
disclosure → media coverage
May 4, 2026
Disclosure — published as a CVE record. · last revised by NVD Oct 26, 2026
May 6, 2026
ubuntu.com reports: USN-8239-1: Apache HTTP Server vulnerabilities
Public PoC (1)
github.com/meh098/CVE-2026-24072-Analysis
Unverified third-party code — review before executing.