# Multiple vulnerabilities in Apache HTTP Server

Published: 2026-06-09 · Severity: elevated
Canonical: https://vorant.io/reports/32fd3c88-c3f5-588f-939c-f62c4c673542/multiple-vulnerabilities-in-apache-http-server
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Apache HTTP Server versions before 2.4.68 contain multiple flaws enabling privilege escalation, DoS, and XSS.

Source: cert.ssi.gouv.fr — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0710

## What to check

- Applies to: The 13 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR has published an advisory documenting multiple vulnerabilities in Apache HTTP Server affecting all versions prior to 2.4.68. The vulnerabilities enable several attack vectors including remote privilege escalation, remote denial of service, and cross-site scripting (XSS) via indirect code injection. Apache has released version 2.4.68 on June 8, 2026, containing fixes for these issues.

Defenders should prioritize upgrading to Apache HTTP Server 2.4.68 or later immediately. The advisory lists 13 distinct CVE identifiers across the vulnerability set, though specific technical details on each flaw are referenced through the Apache security bulletin and individual CVE records. Organizations running Apache HTTP Server in production should verify their current version and apply the available patches without delay.

## Mentioned in this report

- Vulnerabilities: CVE-2026-29167, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356, CVE-2026-42535, CVE-2026-42536, CVE-2026-43951, CVE-2026-44119, CVE-2026-44185, CVE-2026-44186, CVE-2026-44631, CVE-2026-48913, CVE-2026-49975

## Detection guidance (public sample)

### Apache httpd Spawning PowerShell or Recon/Download Utilities on Windows

ATT&CK: T1059.001

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Apache httpd.exe spawning PowerShell, whoami, certutil or bitsadmin suggests web-server exploitation followed by command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Apache httpd Spawning PowerShell or Recon/Download Utilities on Windows
description: Detects the Apache HTTP Server process (httpd.exe) spawning PowerShell
  or common post-exploitation utilities. This is a typical post-exploitation pattern
  after exploiting a public-facing web server, and is rare for normal Apache operation.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \httpd.exe
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \whoami.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Administrative CGI scripts deliberately invoking PowerShell from Apache
- Monitoring or health-check scripts hosted under Apache that call whoami
level: high
id: 8a79cc24-3546-5e72-991d-0952580d2a59
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0710
```

### Apache Web Server Process Spawning Shell With Download or Reverse Shell Pattern on Linux

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

apache2/httpd spawning a shell whose command line downloads payloads or opens a reverse shell indicates exploitation of the web server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Apache Web Server Process Spawning Shell With Download or Reverse Shell Pattern
  on Linux
description: Detects apache2 or httpd spawning a shell that runs download, decode,
  or reverse-shell commands. Indicates likely exploitation of a public-facing Apache
  HTTP Server and follow-on command execution.
tags:
- attack.initial-access
- attack.t1190
- attack.privilege-escalation
- attack.t1548
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /apache2
    - /httpd
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - base64 -d
    - chmod +x
  condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- CGI or PHP applications that shell out to curl or wget for legitimate integrations
- Deployment scripts triggered by a web hook handled through Apache
level: high
id: 5eb95071-4718-5048-8a85-7ecebcb7fb22
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0710
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0710

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/32fd3c88-c3f5-588f-939c-f62c4c673542/multiple-vulnerabilities-in-apache-http-server.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup