CVE-2026-24072

CVSS 3.1: 8.8 high
EPSS: <1%p49
Published: May 4, 2026 · May 4, 2026
Modified: Oct 26, 2026

Analyze CVE-2026-24072 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

Vendors: apache

Products: http server

Weakness: CWE-269

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news

1 story

Debian 13.5 point release lands with security fixes, bug patches

Help Net SecurityMay 18, 00:00 UTC · May 18, 2026VulnerabilityCVE-2026-23918 CVE-2026-24072 CVE-2026-33006+144 · 1 read