Apache HTTP Server vulnerabilities and fixes

CVEs that mention Apache HTTP Server, ranked by priority. 8 tracked.

Apache HTTP Server has 8 tracked vulnerabilities, 1 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 5. Most recent: 2026-08-17. Highest priority: CVE-2026-21962 (score 98/100).

• CVE-2026-21962 CRITICAL 10.0 EXPLOITED DOWNGRADE DOWNGRADE Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
• CVE-2026-18598 HIGH 8.8 A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5
• CVE-2026-18600 HIGH 8.8 A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5
• CVE-2026-18599 HIGH 8.0 A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5
• CVE-2026-68005 HIGH 7.5 An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP
• CVE-2026-9031 MEDIUM 6.8 An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-s
• CVE-2026-9030 MEDIUM 6.8 A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instr
• CVE-2026-12495 MEDIUM 5.3 Denial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the

FAQ

How do I fix Apache HTTP Server vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Apache HTTP Server being exploited right now?

Yes: 1 Apache HTTP Server CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which Apache HTTP Server CVE should I patch first?

CVE-2026-21962 currently ranks highest (98/100): Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability.

← Back to latest CVEs