CVE-2026-24072: exploitation status and patch state

CVE-2026-24072 · CVSS 8.8 HIGH · patch available

An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

Is CVE-2026-24072 exploited?

• Not in the CISA KEV catalog.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

• CBL-Mariner Releases

What PlainSec published about CVE-2026-24072

• Debian 13.5 Refreshes Install Media, Not Your Live Fleet (2026-05-18)
• Apache Patch Hides Module-Specific Exposure Across Hosts (2026-05-07)
• Apache Protocol Parsers Expose Servers to RCE and DoS (2026-05-05)

Primary sources

• NVD record

What this record does not say

• No EPSS score.
• No affected package data.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.