Exploitation timeline
Threadlinqs has recorded 5 Apache CVEs published between and . The busiest month was 2026-04 (1 new CVE). 5 of them (100%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.
Most exploited vulnerabilities
Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked Apache CVEs.
- CVE-2021-44228critical 10KEVRansomwareEPSS 100%
- CVE-2020-1938critical 9.8KEVEPSS 99.3%
- CVE-2019-17558high 7.5KEVEPSS 98.6%
- CVE-2016-4437critical 9.8KEVEPSS 93.1%
- CVE-2026-34197high 8.8KEVEPSS 15.5%
Products affected
Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 6 distinct Apache products are affected. The most frequently affected:
- ActiveMQ Classic 1 CVE
- Aurora 1 CVE
- Log4j 1 CVE
- Shiro 1 CVE
- Solr 1 CVE
- Tomcat 1 CVE
Threat activity
28 tracked threat campaigns reference Apache products or exploit Apache CVEs; the 25 most recent are listed.
- BO Team (Black Owl) Supply Chain Attack Against a Software Developer's Infrastructure (CVE-2021-44228)HIGH
- CVE-2026-58115: Max-severity Node-RED unauthenticated flow-deployment flaw (Siemens SIMATIC IoT2050) exploited to deliver Linux malwareCRITICAL
- Unit 42: Retail Peak Season Cyber Threats - Ransomware/Extortion, DDoS, Digital Skimming, Account Takeover and AI-Assisted Intrusion (CVE-2024-34102, CVE-2021-44228)HIGH
- Doorway Botnet: Large-Scale IoT and Network Device Compromise Campaign (MikroTik RouterOS CVE-2023-30799, Openfire CVE-2023-32315, ActiveMQ CVE-2023-46604, Jenkins, Cameras, ONUs)HIGH
- Operation Escaneo: MexicanMafia (PanchoVilla) Intrusion Campaign Against Mexican Government Agencies and Latin American Financial InstitutionsHIGH
- Atlassian October 2026 Security Bulletin: 176 Flaw Entries in Jira and Confluence (incl. CVE-2026-65637, CVE-2026-58062, CVE-2026-75595) and Actively Exploited CVE-2026-21589CRITICAL
- Proxyjacking campaign hijacks 143+ edge devices in 34 countries (D-Link, Ubiquiti, SAP) to resell bandwidth via Pawns.app, plus active exploitation of PAN-OS CVE-2026-0322HIGH
- skynox7: Proxyjacking Edge Devices Into Residential Proxies (D-Link ShareCenter CVE-2024-3272/3273, UniFi Video CVE-2021-44228, SAP NetWeaver CVE-2025-31324)HIGH
- CISA KEV: Apache Struts Dynamic Method Invocation Remote Code Execution (CVE-2016-3081 / S2-032) Exploited in AttacksCRITICAL
- Chinese Government-linked Actors Enabled by Integrity Technology Group Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (CISA AA26-281A)HIGH
- CyberXero: AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure and Global WordPress/E-commerce PlatformsHIGH
- Attacker Maintains Root-Level MeshCentral Backdoor Inside Thai ISP 3BB, Targets RADIUS Subscriber-Credential Databases (CVE-2024-21762 Toolkit Staged)HIGH
- DragonForce Ransomware Attack on RubberMill, Inc. — ~340GB Data Exfiltration Including PII, Credentials, CAD Files with Defense Mil-Spec ReferencesCRITICAL
- Chinese-Speaking Operator "Nie" Uses SecFlow AI Orchestration Framework (Claude, Qwen, DeepSeek) and GLUTTON Steganographic Webshell in Multi-Country Espionage CampaignHIGH
- LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)HIGH
- Attackers Compile khunt Toolkit Inside Oracle Database to Escalate SQL Injection to Windows SYSTEM AccessCRITICAL
- CVE-2026-34486: Apache Tomcat EncryptInterceptor Bypass Actively Exploited in SnowLight and AI-Assisted CampaignsHIGH
- Khunt Post-Exploitation Toolkit Deployed via Oracle Database JVM (Huntress Discovery)CRITICAL
- NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio) for Credentials and MCP Tool AccessHIGH
- StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt StrikeHIGH
- SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt StrikeHIGH
- Aquatic Panda (Earth Lusca) APT - Log4Shell Exploitation and Multi-Platform Backdoor Campaigns Targeting 17 CountriesCRITICAL
- SharkLoader Malware Deploys Cobalt Strike Beacon via DLL Side-Loading in StrikeShark CampaignHIGH
- Cordyceps: Systemic Cross-Workflow Privilege-Escalation Supply-Chain Flaw in GitHub Actions CI/CD Pipelines (Microsoft Azure Sentinel, Google ADK, Apache Doris, Cloudflare Workers SDK, PSF Black)CRITICAL
- CVE-2026-34197 — Apache ActiveMQ Jolokia Code Injection via Spring XML Context (CISA KEV)HIGH
Threat actors targeting Apache
Named threat actors attributed to campaigns that involve Apache products or CVEs, with the number of linked campaigns:
How to prioritise Apache patching
This order follows the data Threadlinqs holds for Apache, not a generic severity checklist:
- 5 of 5 Apache CVEs (100%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2021-44228, CVE-2020-1938, CVE-2019-17558.
- 1 CVE is known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
- 3 CVEs score Critical and 2 High on CVSS v3 (maximum 10, average 9.2); sequence these after KEV and high-EPSS items.
- 5 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.
About this data
Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-07 and refresh daily.