CVE-2026-24072: apache software foundation apache http server Improper Privilege Management
CVSS: 8.8v3.1HighAnalyzed
AliasesALPINE-CVE-2026-24072UBUNTU-CVE-2026-24072DEBIAN-CVE-2026-24072
Published 04-05-2026Last modified 05-05-2026
Vulnerability summary
CVE-2026-24072 is a high (CVSS 8.8) Improper Privilege Management vulnerability in apache software foundation apache http server. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.3% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
0.65%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 11 · Related 8Timeline
- 04-05-2026PublishedVulnerability first disclosed.
- 05-05-2026Last modifiedVulnerability information updated.
Description
An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.65%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
0.00 pp
From 0.65% on 18-09-2026
18-09-202618-10-2026
EPSS score0.65%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- apache2< 2.4.67-r0
Apache1 product
- http_server< 2.4.67
Apache software foundation1 product
- apache http server≤ 2.4.66
Debian1 product
- apache2< 2.4.67-1~deb12u2 | < 2.4.67-1~deb13u2 | < 2.4.67-1
Ubuntu1 product
- apache2< 2.4.7-1ubuntu4.22+esm13 | < 2.4.18-2ubuntu3.17+esm18 | < 2.4.29-1ubuntu4.27+esm9 | < 2.4.41-4ubuntu3.23+esm4 | < 2.4.52-1ubuntu4.20 | < 2.4.58-1ubuntu8.12 | < 2.4.64-1ubuntu3.4 | < 2.4.66-2ubuntu2.1
5 vendors · 5 products
References
9 links- httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
