CVE-2026-24072 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 17%

Affected Products (NVD)

Vendor	Product	Version
apache	http_server	𝑥 < 2.4.67

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

apache2

bookworm	vulnerable
bookworm (security)	2.4.67-1~deb12u2 fixed
bullseye	vulnerable
bullseye (security)	2.4.67-1~deb11u1 fixed
forky	vulnerable
sid	2.4.67-1 fixed
trixie	vulnerable
trixie (security)	2.4.67-1~deb13u2 fixed

Ubuntu Releases

Ubuntu Product

Codename

apache2

bionic	needs-triage
focal	needs-triage
jammy	Fixed 2.4.52-1ubuntu4.20 released
noble	Fixed 2.4.58-1ubuntu8.12 released
questing	Fixed 2.4.64-1ubuntu3.4 released
resolute	Fixed 2.4.66-2ubuntu2.1 released
trusty	needs-triage
xenial	needs-triage

Common Weakness Enumeration

CWE-269 - Improper Privilege Management
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Vulnerability Media Exposure

[GERMAN] Apache HTTP Server: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
Published: 2026-05-04T22:00:00+00:00
[GERMAN] Apache HTTP Server: Hochriskante Lücken ermöglichen Einschleusen von Schadcode
Im Apache HTTP Server 2.4.67 stopfen die Entwickler mehrere Sicherheitslücken, die teils das Einschleusen von Schadcode ermöglichen.
Published: 2026-05-06T11:28:00+00:00

References

https://httpd.apache.org/security/vulnerabilities_24.html

http://www.openwall.com/lists/oss-security/2026/05/04/18