Apache Software FoundationCVE-2026-59797

Apache HTTP Server: improper privilege management

Critical9.8CVE-2026-59797 · Published Oct 1, 2026 · updated Oct 5, 2026

Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Apache Software Foundation advisory

Affected versions

Package	Affected	Fixed in
Apache HTTP Server Product	>= 2.4.0, <= 2.4.68	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: CISA (its enrichment of the CVE record)
Weakness: CWE-269

More Apache Software Foundation advisories

All Apache Software Foundation

Date	Advisory	Severity	Fixed in
Oct 1	Apache HTTP Server: integer overflow High8.8Oct 1 CVE-2026-93546No fix yet	High8.8	No fix yet
Oct 1	Apache HTTP Server: use after free High7.3Oct 1 CVE-2026-73637No fix yet	High7.3	No fix yet
Oct 1	Path equivalence: '/./' Medium5.3Oct 1 CVE-2026-79768No fix yet	Medium5.3	No fix yet
Oct 1	Apache HTTP Server: request smuggling High7.5Oct 1 CVE-2026-63718No fix yet	High7.5	No fix yet
Oct 1	Apache HTTP Server: authentication bypass High8.1Oct 1 CVE-2026-73636No fix yet	High8.1	No fix yet
Oct 1	Apache HTTP Server: exposed files Medium5.3Oct 1 CVE-2026-58415No fix yet	Medium5.3	No fix yet