AI analysis
Apache HTTP Server 2.4.0 through 2.4.68 has an improper privilege management flaw (CWE-269) in mod_ssl involving the SSLRequire directive and file-related expressions. Reporting on CVE-2026-59797 indicates that SSLRequire can allow a .htaccess file to use ap_expr file functions that should not be available in that context. Someone who can place or change .htaccess, or otherwise supply SSLRequire configuration, may cross that privilege boundary and invoke those file-related expressions; remote code execution is not stated. Every deployment still on that 2.4 range is in scope, with practical risk highest where mod_ssl is enabled and untrusted users can write .htaccess. No public proof-of-concept is known, the issue is not in CISA KEV, and CVSS has not been scored.
What to do: Move Apache HTTP Server off the 2.4.0 through 2.4.68 range as soon as a vendor release outside that range is available, and confirm the running build. Until then, stop untrusted users from setting SSLRequire in .htaccess by tightening AllowOverride and directory write permissions, and review existing SSLRequire directives. Prioritize internet-facing hosts where mod_ssl is loaded and .htaccess is writable; no public exploit is known.
Affected
| Apache Software Foundation HTTP Server | 2.4.0 through 2.4.68 |
Estimated exposure
massmillions of Apache httpd 2.4 installations (order of 1M+ servers; exploitable configurations are a subset) — Apache HTTP Server is one of the most widely deployed web servers, and public market-share data plus internet scans have long indicated millions of httpd instances; 2.4.0–2.4.68 covers essentially the whole current 2.4 line, though only…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.