Multiple vulnerabilities in Apache HTTP Server
Apache HTTP Server versions before 2.4.68 contain multiple flaws enabling privilege escalation, DoS, and XSS.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 13 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR has published an advisory documenting multiple vulnerabilities in Apache HTTP Server affecting all versions prior to 2.4.68. The vulnerabilities enable several attack vectors including remote privilege escalation, remote denial of service, and cross-site scripting (XSS) via indirect code injection. Apache has released version 2.4.68 on June 8, 2026, containing fixes for these issues.
Defenders should prioritize upgrading to Apache HTTP Server 2.4.68 or later immediately. The advisory lists 13 distinct CVE identifiers across the vulnerability set, though specific technical details on each flaw are referenced through the Apache security bulletin and individual CVE records. Organizations running Apache HTTP Server in production should verify their current version and apply the available patches without delay.
Mentioned in this report
Detection guidance
Apache httpd Spawning PowerShell or Recon/Download Utilities on Windows
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Apache httpd.exe spawning PowerShell, whoami, certutil or bitsadmin suggests web-server exploitation followed by command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Apache httpd Spawning PowerShell or Recon/Download Utilities on Windows
description: Detects the Apache HTTP Server process (httpd.exe) spawning PowerShell
or common post-exploitation utilities. This is a typical post-exploitation pattern
after exploiting a public-facing web server, and is rare for normal Apache operation.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \httpd.exe
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \whoami.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Administrative CGI scripts deliberately invoking PowerShell from Apache
- Monitoring or health-check scripts hosted under Apache that call whoami
level: high
id: 8a79cc24-3546-5e72-991d-0952580d2a59
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0710
Apache Web Server Process Spawning Shell With Download or Reverse Shell Pattern on Linux
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
apache2/httpd spawning a shell whose command line downloads payloads or opens a reverse shell indicates exploitation of the web server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Apache Web Server Process Spawning Shell With Download or Reverse Shell Pattern
on Linux
description: Detects apache2 or httpd spawning a shell that runs download, decode,
or reverse-shell commands. Indicates likely exploitation of a public-facing Apache
HTTP Server and follow-on command execution.
tags:
- attack.initial-access
- attack.t1190
- attack.privilege-escalation
- attack.t1548
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /apache2
- /httpd
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- curl
- wget
- /dev/tcp/
- base64 -d
- chmod +x
condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- CGI or PHP applications that shell out to curl or wget for legitimate integrations
- Deployment scripts triggered by a web hook handled through Apache
level: high
id: 5eb95071-4718-5048-8a85-7ecebcb7fb22
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0710
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0710
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs