# Apache HTTP Server mod_http2 RCE flaw patched

Published: 2026-11-12 · Severity: elevated
Canonical: https://vorant.io/reports/dfe76850-b1f1-5032-b91e-c4abad5c2154/apache-http-server-mod-http2-rce-flaw-patched
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> A critical concurrency bug in Apache HTTP Server's mod_http2/mod_h2 modules allows unauthenticated remote code execution on servers with HTTP/2 enabled.

Source: advisories.ncsc.nl — https://advisories.ncsc.nl/2026/ncsc-2026-0484.html

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

NCSC-NL published an advisory for a vulnerability in Apache HTTP Server's mod_http2 module (versions 2.4.55 to 2.4.70) and mod_h2 module (versions 2.0.8 to 2.0.42). The flaw, tracked as CVE-2026-119618 with a CVSS v3 score of 9.8, is a concurrency issue (improper synchronization leading to a heap-based buffer overflow) in the assign_headers function of both modules.

The vulnerability allows unauthenticated, remote attackers to execute arbitrary commands, potentially achieving remote code execution on affected servers. Exploitation requires HTTP/2 to be enabled; servers that only support HTTP/1.1 are not affected. Apache has released updates to address the issue. The advisory does not indicate active exploitation in the wild at the time of publication. Defenders running affected Apache HTTP Server versions with HTTP/2 enabled should prioritize patching immediately given the critical severity and remote, unauthenticated attack vector.

## Mentioned in this report

- Vulnerabilities: CVE-2026-119618

## Detection guidance (public sample)

### Apache HTTP Server Spawning Shell With Download or Reverse-Shell Commands (Linux)

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Apache httpd/apache2 spawning a shell whose command line shows download-and-execute or reverse-shell behaviour, a post-exploitation sign after exploiting a web-server RCE such as the mod_http2 flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Apache HTTP Server Spawning Shell With Download or Reverse-Shell Commands (Linux)
description: Detects the Apache web server process (httpd or apache2) spawning a shell
  whose command line contains download-and-execute, reverse shell or encoded payload
  patterns. Post-exploitation behaviour for web-server RCE such as the mod_http2 assign_headers
  flaw (CVE-2026-119618).
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /httpd
    - /apache2
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - /dev/tcp/
    - curl
    - wget
    - nc -e
    - ncat
    - base64 -d
    - python -c
    - perl -e
    - mkfifo
    - chmod +x
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Legacy CGI scripts on the web server that legitimately call curl or wget through
  a shell
- Web-based administration panels that run maintenance scripts via Apache
level: high
id: 8db6c432-93c8-5f9d-ab6c-412c38706a8e
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0484.html
```

### Apache HTTP Server Spawning Command Interpreter or Recon Tools (Windows)

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

httpd.exe spawning cmd, PowerShell or common recon and download utilities, indicating possible web-server RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Apache HTTP Server Spawning Command Interpreter or Recon Tools (Windows)
description: Detects httpd.exe spawning cmd.exe, PowerShell or living-off-the-land
  utilities. Web-server RCE exploitation (for example the mod_http2 flaw CVE-2026-119618)
  would yield this parent/child relation, which is rare on hardened hosts.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \httpd.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
    - \mshta.exe
    - \curl.exe
  condition: selection
falsepositives:
- CGI applications hosted on Apache for Windows that invoke cmd.exe
- Administrative scripts launched by the Apache service for log rotation or deployment
level: medium
id: 7a300f90-306c-5a1c-bf80-2d2f3efeac72
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0484.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0484.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/dfe76850-b1f1-5032-b91e-c4abad5c2154/apache-http-server-mod-http2-rce-flaw-patched.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup