Apache vulnerabilities in CISA KEV
Apache has 41 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 7th highest of any vendor. 3 were added in the last 12 months; 8 are linked to known ransomware use (19.5% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 3 to 182), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Struts, with 6 entries. Other frequently affected products: Tomcat (6); HTTP Server (4).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor apache --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
41
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-10-08
most recent entry
┌─ last 12 months
3
entries added
┌─ ransomware use
8 of 41
19.5% linked to ransomware
┌─ distinct products
21
affected products
$ awk -F, {print $1} /var/log/kev/apache.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 12 | 5 |
| 2022 | 13 | 1 |
| 2023 | 5 | 2 |
| 2024 | 5 | 0 |
| 2025 | 3 | 0 |
| 2026 | 3 | 0 |
$ sort /var/log/kev/apache.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Struts 6 entries
- Tomcat 6 entries
- HTTP Server 4 entries
- ActiveMQ 3 entries
- OFBiz 3 entries
$ kev-due-dates --vendor apache
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Apache
21 days (range 3 to 182)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/apache.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (39 of 41 have at least one CWE).
- CWE-20 ↗ 8 entries
- CWE-502 ↗ 4 entries
- CWE-1188 ↗ 3 entries
$ grep -ril 'Apache' /var/log/news | head -5
Our reporting that names Apache or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
$ wc -l ./apache.kev · 41 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2016-3081
Struts
Apache Struts Command Injection Vulnerability
due 2026-10-11 · CWE-77
$ cat CVE-2016-3081.txt
Description. Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-34486
Tomcat
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
due 2026-08-07 · CWE-311
$ cat CVE-2026-34486.txt
Description. Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-34197
ActiveMQ
Apache ActiveMQ Improper Input Validation Vulnerability
due 2026-04-30 · CWE-20 CWE-94
$ cat CVE-2026-34197.txt
Description. Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-38475
HTTP Server
Apache HTTP Server Improper Escaping of Output Vulnerability
due 2025-05-22 · CWE-116
$ cat CVE-2024-38475.txt
Description. Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-24813
Tomcat
Apache Tomcat Path Equivalence Vulnerability
due 2025-04-22 · CWE-44 CWE-502
$ cat CVE-2025-24813.txt
Description. Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-45195
OFBiz
Apache OFBiz Forced Browsing Vulnerability
due 2025-02-25 · CWE-425
$ cat CVE-2024-45195.txt
Description. Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-27348
HugeGraph-Server
Apache HugeGraph-Server Improper Access Control Vulnerability
due 2024-10-09 · CWE-284
$ cat CVE-2024-27348.txt
Description. Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-38856
OFBiz
Apache OFBiz Incorrect Authorization Vulnerability
due 2024-09-17 · CWE-863
$ cat CVE-2024-38856.txt
Description. Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-32113
OFBiz
Apache OFBiz Path Traversal Vulnerability
due 2024-08-28 · CWE-22
$ cat CVE-2024-32113.txt
Description. Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2020-17519
Flink
Apache Flink Improper Access Control Vulnerability
due 2024-06-13 · CWE-552
$ cat CVE-2020-17519.txt
Description. Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-27524
Superset
Apache Superset Insecure Default Initialization of Resource Vulnerability
due 2024-01-29 · CWE-1188
$ cat CVE-2023-27524.txt
Description. Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-46604
ActiveMQ [RANSOMWARE]
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
due 2023-11-23 · CWE-502
$ cat CVE-2023-46604.txt
Description. Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-33246
RocketMQ
Apache RocketMQ Command Execution Vulnerability
due 2023-09-27 · CWE-94
$ cat CVE-2023-33246.txt
Description. Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2016-8735
Tomcat
Apache Tomcat Remote Code Execution Vulnerability
due 2023-06-02 · CWE-284
$ cat CVE-2016-8735.txt
Description. Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Required action. Apply updates per vendor instructions.
- CVE-2021-45046
Log4j2 [RANSOMWARE]
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
due 2023-05-22 · CWE-917
$ cat CVE-2021-45046.txt
Description. Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.
Required action. Apply updates per vendor instructions.
- CVE-2022-33891
Spark
Apache Spark Command Injection Vulnerability
due 2023-03-28 · CWE-78
$ cat CVE-2022-33891.txt
Description. Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.
Required action. Apply updates per vendor instructions.
- CVE-2022-24112
APISIX
Apache APISIX Authentication Bypass Vulnerability
due 2022-09-15 · CWE-290
$ cat CVE-2022-24112.txt
Description. Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2022-24706
CouchDB
Apache CouchDB Insecure Default Initialization of Resource Vulnerability
due 2022-09-15 · CWE-1188
$ cat CVE-2022-24706.txt
Description. Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.
Required action. Apply updates per vendor instructions.
- CVE-2013-2251
Struts
Apache Struts Improper Input Validation Vulnerability
due 2022-04-15 · CWE-20
$ cat CVE-2013-2251.txt
Description. Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.
Required action. Apply updates per vendor instructions.
- CVE-2017-12615
Tomcat [RANSOMWARE]
Apache Tomcat on Windows Remote Code Execution Vulnerability
due 2022-04-15 · CWE-434
$ cat CVE-2017-12615.txt
Description. When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Required action. Apply updates per vendor instructions.
- CVE-2017-12617
Tomcat
Apache Tomcat Remote Code Execution Vulnerability
due 2022-04-15 · CWE-434
$ cat CVE-2017-12617.txt
Description. When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Required action. Apply updates per vendor instructions.
- CVE-2020-1956
Kylin
Apache Kylin OS Command Injection Vulnerability
due 2022-04-15 · CWE-78
$ cat CVE-2020-1956.txt
Description. Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2020-1938
Tomcat
Apache Tomcat Improper Privilege Management Vulnerability
due 2022-03-17
$ cat CVE-2020-1938.txt
Description. Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.
Required action. Apply updates per vendor instructions.
- CVE-2016-3088
ActiveMQ
Apache ActiveMQ Improper Input Validation Vulnerability
due 2022-08-10 · CWE-20
$ cat CVE-2016-3088.txt
Description. The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
Required action. Apply updates per vendor instructions.
- CVE-2017-9791
Struts 1
Apache Struts 1 Improper Input Validation Vulnerability
due 2022-08-10 · CWE-20
$ cat CVE-2017-9791.txt
Description. The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Required action. Apply updates per vendor instructions.
- CVE-2006-1547
Struts 1
Apache Struts 1 ActionForm Denial-of-Service Vulnerability
due 2022-07-21
$ cat CVE-2006-1547.txt
Description. ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
Required action. Apply updates per vendor instructions.
- CVE-2012-0391
Struts 2
Apache Struts 2 Improper Input Validation Vulnerability
due 2022-07-21 · CWE-20
$ cat CVE-2012-0391.txt
Description. The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2020-11978
Airflow
Apache Airflow Command Injection
due 2022-07-18 · CWE-78
$ cat CVE-2020-11978.txt
Description. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
Required action. Apply updates per vendor instructions.
- CVE-2020-13927
Airflow's Experimental API
Apache Airflow's Experimental API Authentication Bypass
due 2022-07-18 · CWE-1188 CWE-306
$ cat CVE-2020-13927.txt
Description. The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
Required action. Apply updates per vendor instructions.
- CVE-2019-0193
Solr
Apache Solr DataImportHandler Code Injection Vulnerability
due 2022-06-10 · CWE-94
$ cat CVE-2019-0193.txt
Description. The optional Apache Solr module DataImportHandler contains a code injection vulnerability.
Required action. Apply updates per vendor instructions.
- CVE-2021-44228
Log4j2 [RANSOMWARE]
Apache Log4j2 Remote Code Execution Vulnerability
due 2021-12-24 · CWE-20 CWE-400 CWE-502
$ cat CVE-2021-44228.txt
Description. Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
Required action. For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
- CVE-2021-40438
Apache [RANSOMWARE]
Apache HTTP Server-Side Request Forgery (SSRF)
due 2021-12-15 · CWE-918
$ cat CVE-2021-40438.txt
Description. A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Required action. Apply updates per vendor instructions.
- CVE-2016-4437
Shiro
Apache Shiro Code Execution Vulnerability
due 2022-05-03 · CWE-284
$ cat CVE-2016-4437.txt
Description. Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.
Required action. Apply updates per vendor instructions.
- CVE-2017-5638
Struts [RANSOMWARE]
Apache Struts Remote Code Execution Vulnerability
due 2022-05-03 · CWE-20
$ cat CVE-2017-5638.txt
Description. Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2017-9805
Struts
Apache Struts Deserialization of Untrusted Data Vulnerability
due 2022-05-03 · CWE-502
$ cat CVE-2017-9805.txt
Description. Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
Required action. Apply updates per vendor instructions.
- CVE-2018-11776
Struts
Apache Struts Remote Code Execution Vulnerability
due 2022-05-03 · CWE-20
$ cat CVE-2018-11776.txt
Description. Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.
Required action. Apply updates per vendor instructions.
- CVE-2019-0211
HTTP Server
Apache HTTP Server Privilege Escalation Vulnerability
due 2022-05-03 · CWE-416
$ cat CVE-2019-0211.txt
Description. Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.
Required action. Apply updates per vendor instructions.
- CVE-2019-17558
Solr
Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability
due 2022-05-03 · CWE-74
$ cat CVE-2019-17558.txt
Description. The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2020-17530
Struts
Apache Struts Remote Code Execution Vulnerability
due 2022-05-03 · CWE-917
$ cat CVE-2020-17530.txt
Description. Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2021-41773
HTTP Server [RANSOMWARE]
Apache HTTP Server Path Traversal Vulnerability
due 2021-11-17 · CWE-22
$ cat CVE-2021-41773.txt
Description. Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.
Required action. Apply updates per vendor instructions.
- CVE-2021-42013
HTTP Server [RANSOMWARE]
Apache HTTP Server Path Traversal Vulnerability
due 2021-11-17 · CWE-22
$ cat CVE-2021-42013.txt
Description. Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.
Required action. Apply updates per vendor instructions.