Okta investigating Apache HTTP/2 flaw CVE-2026-119618
Original title: Apache HTTP Server's HTTP/2 Vulnerability (CVE-2026-119618)
The notice names the CVE but gives no versions, impact, patch, or sign of exploitation.
On November 12, Okta said it is aware of security disclosures for an Apache HTTP Server HTTP/2 vulnerability tracked as CVE-2026-119618. The company said it is actively investigating the issue across its cloud service environments. The notice does not describe the flaw, affected versions, a fix, or whether Okta services are exposed.
Unconfirmed: Okta has not said whether its environments are affected or what the vulnerability allows.
- Okta published the note on its security site on November 12.
- The disclosure is identified only as an Apache HTTP/2 issue.
- No exploitation status or customer impact is stated.
| Product | Affected |
|---|---|
| Apache HTTP Server | — |
- CVEs
- CVE-2026-119618
- Vendors
- Apache
- Products
- Apache HTTP Server
- Organizations
- Okta
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119618 | Race condition RCE in Apache HTTP Server mod_http2 | 8.1 | <1% | PoC ×9 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | e96a31e0def311f18cfa45ebb28fa0ef | 358&Ver=2&mid=78af2288-f47c-4cc9-80cf-02a1c40b16d6&bo=1&sid=e96a31e0def311f18cfa45ebb28fa0ef&vid=e96ac060def311f1bf6a3d9921c38ea7&vids=1&msclkid=N&pi=91 |
| md5 | e96ac060def311f1bf6a3d9921c38ea7 | -02a1c40b16d6&bo=1&sid=e96a31e0def311f18cfa45ebb28fa0ef&vid=e96ac060def311f1bf6a3d9921c38ea7&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1280&sh=1280&sc=2 |
From the original article
3 min read at sec.okta.comOkta's response We are aware of the Apache HTTP/2 (CVE-2026-119618) security disclosures and are actively investigating across our cloud service environments. ...
sec.okta.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.