Short answer: A security flaw in Apache HTTP Server could let attackers execute code remotely. Users of versions 2.4.55 to 2.4.70 should update to the latest version.
TL;DR
- Security flaw affects Apache HTTP Server versions 2.4.55 to 2.4.70.
- Attackers could execute code remotely if exploited.
- Update to the latest version to fix the issue.
- Check for updates and apply them promptly.
What is CVE-2026-119618?
This issue is a security flaw in Apache HTTP Server's mod_http2 module that could allow unauthenticated attackers to execute code remotely. It occurs in the assign_headers() function and affects versions from 2.4.55 to 2.4.70. Users are advised to update to version 2.4.71 or later to mitigate the risk.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Exploit
- Code or steps that take advantage of a weakness.
Key facts
| Reported by | The Hacker News |
|---|---|
| Date reported | 12 Nov 2026 |
| CVE | CVE-2026-119618 |
| CVSS | Not scored by NVD yet |
| Weakness | CWE-362 (race condition) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| Vendor advisory | httpd.apache.org |
| CVE | CVE-2026-23918 |
| CVSS | 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-1341 (see NVD), CWE-415 (see NVD) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| Vendor advisory | httpd.apache.org |
| Affected product | Apache HTTP |
| Published in NVD | 2026-11-11 (CVE-2026-119618) |
| Published in NVD | 2026-05-04 (CVE-2026-23918) |
How it works
Apache HTTP Server 2.4.55 to 2.4.70 had a problem in mod_http2. When handling headers, attackers could exploit this to run code on the server. This happened because of how the headers were processed, allowing unauthenticated access.
- Attacker reaches the Apache HTTP over the internet / network
- Attacker needs a normal (low-privilege) account
- Sends crafted input that triggers the flaw
- Impact: data can be read, data or code can be changed, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
- T1190 Exploit Public-Facing Application
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-05-04 | CVE-2026-23918 published in NVD | NVD |
| 2026-11-11 | CVE-2026-119618 published in NVD | NVD |
| 2026-11-12 | Reported by The Hacker News | The Hacker News |
| 2026-11-12 | This Skillmate explainer published | Skillmate |
How to fix it
- Update Apache HTTP to the fixed release named in the vendor advisory.
- Read the vendor advisory for CVE-2026-119618 and upgrade to the fixed release it lists.
- Read the vendor advisory for CVE-2026-23918 and upgrade to the fixed release it lists.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
What is confirmed and what is not
| Confirmed | Not confirmed yet |
|---|---|
| CVE-2026-119618 is a real NVD record | NVD has not published a CVSS score for CVE-2026-119618 yet |
| CVE-2026-23918 is a real NVD record scored 8.8 HIGH | CISA KEV does not list CVE-2026-119618 as exploited in the wild |
| Reported by The Hacker News | CISA KEV does not list CVE-2026-23918 as exploited in the wild |
| Reported by access.redhat.com | |
| Reported by explore.alas.aws.amazon.com | |
| Reported by httpd.apache.org |
Why it matters
Companies and users worldwide need to update servers to avoid unauthorised code execution, protecting against data breaches and system compromises.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is RCE?
RCE means Remote Code Execution, where attackers can run their own code on your server.
How can I protect my server?
Keep your Apache HTTP Server updated to the latest version, which includes fixes for security issues.
Related Skillmate posts
Sources
- Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely (The Hacker News)
- Primary source / advisory (access.redhat.com)
- Primary source / advisory (explore.alas.aws.amazon.com)
- Vendor advisory CVE-2026-119618 (httpd.apache.org)
- Apache (primary source) (httpd.apache.org)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.