# Apache vulnerabilities & exploitation

**CISA KEV** · **Ransomware**

> As of 2026-11-07, Threadlinqs tracks 5 Apache CVEs, 5 in the CISA Known Exploited Vulnerabilities catalog, 1 used in ransomware campaigns, linked to 28 tracked threat campaigns and 12 named threat actors.

**Data as of:** 2026-11-07

## Exploitation timeline

Threadlinqs has recorded 5 Apache CVEs published between 2016-06-15 and 2026-04-15. The busiest month was 2026-04 (1 new CVE). 5 of them (100%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

## Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked Apache CVEs.

- [CVE-2021-44228](https://intel.threadlinqs.com/cve/CVE-2021-44228) — CRITICAL 10 · KEV · Ransomware · EPSS 100% · 2021-12-10
- [CVE-2020-1938](https://intel.threadlinqs.com/cve/CVE-2020-1938) — CRITICAL 9.8 · KEV · EPSS 99.3% · 2020-02-24
- [CVE-2019-17558](https://intel.threadlinqs.com/cve/CVE-2019-17558) — HIGH 7.5 · KEV · EPSS 98.6% · 2019-12-30
- [CVE-2016-4437](https://intel.threadlinqs.com/cve/CVE-2016-4437) — CRITICAL 9.8 · KEV · EPSS 93.1% · 2016-06-07
- [CVE-2026-34197](https://intel.threadlinqs.com/cve/CVE-2026-34197) — HIGH 8.8 · KEV · EPSS 15.5% · 2026-04-01

## Products affected

Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 6 distinct Apache products are affected. The most frequently affected:

- ActiveMQ Classic — 1 CVE
- Aurora — 1 CVE
- Log4j — 1 CVE
- Shiro — 1 CVE
- Solr — 1 CVE
- Tomcat — 1 CVE

## Threat activity

28 tracked threat campaigns reference Apache products or exploit Apache CVEs; the 25 most recent are listed.

- [BO Team (Black Owl) Supply Chain Attack Against a Software Developer's Infrastructure (CVE-2021-44228)](https://intel.threadlinqs.com/threat/TL-2026-5474) — HIGH — 2026-11-07
- [CVE-2026-58115: Max-severity Node-RED unauthenticated flow-deployment flaw (Siemens SIMATIC IoT2050) exploited to deliver Linux malware](https://intel.threadlinqs.com/threat/TL-2026-5105) — CRITICAL — 2026-11-02
- [Unit 42: Retail Peak Season Cyber Threats - Ransomware/Extortion, DDoS, Digital Skimming, Account Takeover and AI-Assisted Intrusion (CVE-2024-34102, CVE-2021-44228)](https://intel.threadlinqs.com/threat/TL-2026-4664) — HIGH — 2026-10-28
- [Doorway Botnet: Large-Scale IoT and Network Device Compromise Campaign (MikroTik RouterOS CVE-2023-30799, Openfire CVE-2023-32315, ActiveMQ CVE-2023-46604, Jenkins, Cameras, ONUs)](https://intel.threadlinqs.com/threat/TL-2026-4640) — HIGH — 2026-10-28
- [Operation Escaneo: MexicanMafia (PanchoVilla) Intrusion Campaign Against Mexican Government Agencies and Latin American Financial Institutions](https://intel.threadlinqs.com/threat/TL-2026-4318) — HIGH — 2026-10-23
- [Atlassian October 2026 Security Bulletin: 176 Flaw Entries in Jira and Confluence (incl. CVE-2026-65637, CVE-2026-58062, CVE-2026-75595) and Actively Exploited CVE-2026-21589](https://intel.threadlinqs.com/threat/TL-2026-4216) — CRITICAL — 2026-10-23
- [Proxyjacking campaign hijacks 143+ edge devices in 34 countries (D-Link, Ubiquiti, SAP) to resell bandwidth via Pawns.app, plus active exploitation of PAN-OS CVE-2026-0322](https://intel.threadlinqs.com/threat/TL-2026-4174) — HIGH — 2026-10-22
- [skynox7: Proxyjacking Edge Devices Into Residential Proxies (D-Link ShareCenter CVE-2024-3272/3273, UniFi Video CVE-2021-44228, SAP NetWeaver CVE-2025-31324)](https://intel.threadlinqs.com/threat/TL-2026-3649) — HIGH — 2026-10-15
- [CISA KEV: Apache Struts Dynamic Method Invocation Remote Code Execution (CVE-2016-3081 / S2-032) Exploited in Attacks](https://intel.threadlinqs.com/threat/TL-2026-3332) — CRITICAL — 2026-10-12
- [Chinese Government-linked Actors Enabled by Integrity Technology Group Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (CISA AA26-281A)](https://intel.threadlinqs.com/threat/TL-2026-3054) — HIGH — 2026-10-08
- [CyberXero: AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure and Global WordPress/E-commerce Platforms](https://intel.threadlinqs.com/threat/TL-2026-2992) — HIGH — 2026-10-07
- [Attacker Maintains Root-Level MeshCentral Backdoor Inside Thai ISP 3BB, Targets RADIUS Subscriber-Credential Databases (CVE-2024-21762 Toolkit Staged)](https://intel.threadlinqs.com/threat/TL-2026-2514) — HIGH — 2026-09-15
- [DragonForce Ransomware Attack on RubberMill, Inc. — ~340GB Data Exfiltration Including PII, Credentials, CAD Files with Defense Mil-Spec References](https://intel.threadlinqs.com/threat/TL-2026-2364) — CRITICAL — 2026-09-06
- [Chinese-Speaking Operator "Nie" Uses SecFlow AI Orchestration Framework (Claude, Qwen, DeepSeek) and GLUTTON Steganographic Webshell in Multi-Country Espionage Campaign](https://intel.threadlinqs.com/threat/TL-2026-2325) — HIGH — 2026-09-04
- [LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)](https://intel.threadlinqs.com/threat/TL-2026-2094) — HIGH — 2026-08-21
- [Attackers Compile khunt Toolkit Inside Oracle Database to Escalate SQL Injection to Windows SYSTEM Access](https://intel.threadlinqs.com/threat/TL-2026-1910) — CRITICAL — 2026-08-06
- [CVE-2026-34486: Apache Tomcat EncryptInterceptor Bypass Actively Exploited in SnowLight and AI-Assisted Campaigns](https://intel.threadlinqs.com/threat/TL-2026-1885) — HIGH — 2026-08-05
- [Khunt Post-Exploitation Toolkit Deployed via Oracle Database JVM (Huntress Discovery)](https://intel.threadlinqs.com/threat/TL-2026-1903) — CRITICAL — 2026-07-27
- [NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio) for Credentials and MCP Tool Access](https://intel.threadlinqs.com/threat/TL-2026-1455) — HIGH — 2026-07-17
- [StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt Strike](https://intel.threadlinqs.com/threat/TL-2026-1237) — HIGH — 2026-07-11
- [SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt Strike](https://intel.threadlinqs.com/threat/TL-2026-1101) — HIGH — 2026-07-03
- [Aquatic Panda (Earth Lusca) APT - Log4Shell Exploitation and Multi-Platform Backdoor Campaigns Targeting 17 Countries](https://intel.threadlinqs.com/threat/TL-2026-0986) — CRITICAL — 2026-06-28
- [SharkLoader Malware Deploys Cobalt Strike Beacon via DLL Side-Loading in StrikeShark Campaign](https://intel.threadlinqs.com/threat/TL-2026-0961) — HIGH — 2026-06-27
- [Cordyceps: Systemic Cross-Workflow Privilege-Escalation Supply-Chain Flaw in GitHub Actions CI/CD Pipelines (Microsoft Azure Sentinel, Google ADK, Apache Doris, Cloudflare Workers SDK, PSF Black)](https://intel.threadlinqs.com/threat/TL-2026-0928) — CRITICAL — 2026-06-23
- [CVE-2026-34197 — Apache ActiveMQ Jolokia Code Injection via Spring XML Context (CISA KEV)](https://intel.threadlinqs.com/threat/TL-2026-0386) — HIGH — 2026-04-17

## Threat actors targeting Apache

Named threat actors attributed to campaigns that involve Apache products or CVEs, with the number of linked campaigns:

- [StrikeShark](https://intel.threadlinqs.com/actor/StrikeShark) — 2 campaigns
- [Akira](https://intel.threadlinqs.com/actor/Akira) — 1 campaign
- [ALPHV](https://intel.threadlinqs.com/actor/ALPHV) — 1 campaign
- [APT41](https://intel.threadlinqs.com/actor/APT41) — 1 campaign
- [Cl0p](https://intel.threadlinqs.com/actor/Cl0p) — 1 campaign
- [DragonForce](https://intel.threadlinqs.com/actor/DragonForce) — 1 campaign
- [Earth Lusca](https://intel.threadlinqs.com/actor/Earth%20Lusca) — 1 campaign
- [Flax Typhoon](https://intel.threadlinqs.com/actor/Flax%20Typhoon) — 1 campaign
- [GhostEmperor](https://intel.threadlinqs.com/actor/GhostEmperor) — 1 campaign
- [LockBit](https://intel.threadlinqs.com/actor/LockBit) — 1 campaign
- [NoName057(16)](https://intel.threadlinqs.com/actor/NoName057(16)) — 1 campaign
- [Qilin](https://intel.threadlinqs.com/actor/Qilin) — 1 campaign

## How to prioritise Apache patching

This order follows the data Threadlinqs holds for Apache, not a generic severity checklist:

- 5 of 5 Apache CVEs (100%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2021-44228](https://intel.threadlinqs.com/cve/CVE-2021-44228), [CVE-2020-1938](https://intel.threadlinqs.com/cve/CVE-2020-1938), [CVE-2019-17558](https://intel.threadlinqs.com/cve/CVE-2019-17558).
- 1 CVE is known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
- 3 CVEs score Critical and 2 High on CVSS v3 (maximum 10, average 9.2); sequence these after KEV and high-EPSS items.
- 5 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

## About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-07 and refresh daily.

Canonical: https://intel.threadlinqs.com/vendors/apache
All vendors: https://intel.threadlinqs.com/vendors
Full detection coverage and IOCs for threats exploiting Apache products unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp