Apache Software Foundation vulnerabilities & exploitation

Exploitation timeline

Threadlinqs has recorded 22 Apache Software Foundation CVEs published between 2018-07-15 and 2026-09-15. The busiest month was 2026-08 (7 new CVEs). 1 of them (5%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 22 of 22 tracked Apache Software Foundation CVEs.

• CVE-2026-34486high 7.5KEVEPSS 42.6%2026-04-09
• CVE-2021-39275critical 9.8EPSS 39.4%2021-09-16
• CVE-2018-8007high 7.2EPSS 11.7%2018-07-11
• CVE-2026-43512critical 9.8EPSS 1.2%2026-05-12
• CVE-2026-23918high 8.8EPSS 1%2026-05-04
• CVE-2026-40860critical 9.8EPSS 0.9%2026-04-27
• CVE-2026-40453critical 9.9EPSS 0.9%2026-04-27
• CVE-2026-30898high 8.8EPSS 0.8%2026-04-18
• CVE-2026-33454critical 9.4EPSS 0.6%2026-04-27
• CVE-2026-68763high 7.5EPSS 0.5%2026-08-25
• CVE-2026-68525critical 9.1EPSS 0.5%2026-08-25
• CVE-2026-65637critical 9.8EPSS 0.5%2026-08-25
• CVE-2026-65927high 7.5EPSS 0.5%2026-08-25
• CVE-2026-65182critical 9.1EPSS 0.5%2026-08-25
• CVE-2026-68569high 8.1EPSS 0.4%2026-08-25
• CVE-2026-66422high 8.1EPSS 0.4%2026-08-25
• CVE-2026-97636medium 6.5EPSS 0.4%2026-09-24
• CVE-2026-55957high 7.3EPSS 0.2%2026-06-29
• CVE-2026-50229medium 6.1EPSS 0.2%2026-06-29
• CVE-2026-55276critical 9.1EPSS 0.2%2026-06-29
• CVE-2026-55956medium 6.5EPSS 0.2%2026-06-29
• CVE-2026-55955medium 6.5EPSS 0.1%2026-06-29

Products affected

Threadlinqs normalises CPE and CNA product records across all 22 CVEs; 9 distinct Apache Software Foundation products are affected. The most frequently affected:

• Apache Tomcat 14 CVEs
• Apache Camel 2 CVEs
• Apache HTTP Server 2 CVEs
• Apache Airflow 1 CVE
• Apache Airflow HashiCorp provider 1 CVE
• Apache Camel CoAP 1 CVE
• Apache Camel Google PubSub 1 CVE
• Apache Camel JMS 1 CVE
• Apache CouchDB 1 CVE

Threat activity

20 tracked threat campaigns reference Apache Software Foundation products or exploit Apache Software Foundation CVEs:

• Multiple Vulnerabilities in Apache HTTP Server 2.4.0 through 2.4.68 (20 CVEs, fixed in 2.4.69)MEDIUM2026-10-02
• Endor Labs Discloses 14 Critical/High Vulnerabilities Across Seven AI Orchestration Platforms (NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, Apache Airflow)CRITICAL2026-09-10
• Chinese-Speaking Operator "Nie" Uses SecFlow AI Orchestration Framework (Claude, Qwen, DeepSeek) and GLUTTON Steganographic Webshell in Multi-Country Espionage CampaignHIGH2026-09-04
• Apache Tomcat 11.0.25 Fixes 11 Vulnerabilities Including HTTP/2 DoS, Authorization Bypass, and Auth Fail-Open Flaws — NVD Scores 5 of 11 CRITICAL/HIGH Despite Apache's Low/Moderate RatingsCRITICAL2026-08-26
• AI-Assisted "HTTP Terminator" Uncovers Novel HTTP Desync Techniques and Apache Traffic Server Zero-Day (CVE-2026-63078)HIGH2026-08-09
• CVE-2026-34486: Apache Tomcat EncryptInterceptor Bypass Actively Exploited in SnowLight and AI-Assisted CampaignsHIGH2026-08-05
• Pre-auth RCE chains in Bonita BPM 10.4.3 and Apache OFBiz 24.09.05 (CVE-2026-31986)CRITICAL2026-08-05
• Apache Syncope Patches 12 CVEs Including Groovy Sandbox Bypass RCE and Audit Search SQLiCRITICAL2026-07-24
• Russian Intelligence Services Hijack Unsecured IP Cameras Across NATO, EU and Ukraine to Surveil Weapons Deliveries (AIVD/MIVD Advisory, Censys Analysis)HIGH2026-07-22
• HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats Server Memory With 11-Byte PayloadMEDIUM2026-07-17
• OpenSSL "HollowByte" TLS Handshake Memory-Amplification DoS (No CVE Assigned)MEDIUM2026-07-17
• SAP July 2026 Patch Day: Critical Memory Corruption in NetWeaver ABAP (CVE-2026-44747, CVSS 9.9) Among 16 Security NotesCRITICAL2026-07-14
• RustDuck Botnet Rebuilt in Rust with Enhanced C2 Capabilities and Multi-Vector ExploitationCRITICAL2026-06-30
• Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub Repositories (Microsoft, Google, Apache, Cloudflare, PSF) to Supply-Chain AttacksCRITICAL2026-06-30
• HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference Compression Bomb + Zero-Window Flow-Control Hold Affecting nginx, Apache httpd, IIS, Envoy & Cloudflare Pingora (CVE-2026-49975, Public PoC)HIGH2026-06-03
• Apache ActiveMQ MessageServlet HTTP Response Header Injection (CVE-2026-42253) and Jolokia Default-Permission Privilege Issue (CVE-2026-49157)HIGH2026-06-03
• BadHost CVE-2026-48710 — Starlette HTTP Host Header Authentication Bypass Affecting FastAPI/AI Infrastructure (MCP, vLLM, LiteLLM)CRITICAL2026-05-27
• CVE-2026-23918 — Apache HTTP Server mod_http2 Double Free Enabling Unauthenticated DoS and Possible RCECRITICAL2026-05-07
• Apache ActiveMQ OpenWire Deserialization RCE (CVE-2023-46604) — 6,400 Brokers Actively Exploited by HelloKitty, Kinsing, TellYouThePass and Andariel (Lazarus)CRITICAL2026-04-21
• Apache ActiveMQ Classic RCE via Jolokia JMX-HTTP Bridge (CVE-2026-34197)HIGH2026-04-08

Threat actors targeting Apache Software Foundation

Named threat actors attributed to campaigns that involve Apache Software Foundation products or CVEs, with the number of linked campaigns:

• Andariel 1
• UNC5174 1

How to prioritise Apache Software Foundation patching

This order follows the data Threadlinqs holds for Apache Software Foundation, not a generic severity checklist:

• 1 of 22 Apache Software Foundation CVEs (5%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2026-34486.
• Outside KEV, the highest EPSS scores are CVE-2021-39275 (39.4%), CVE-2018-8007 (11.7%), CVE-2026-43512 (1.2%).
• 9 CVEs score Critical and 9 High on CVSS v3 (maximum 9.9, average 8.3); sequence these after KEV and high-EPSS items.
• 7 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily.