Apache

CVE-2025-23048 allows an attacker to bypass client certificate authentication in Apache HTTP Server versions 2.4.35 through 2.4.62 by resuming a TLS 1.3 session across virtual hosts with different CA configurations.

CVE-2024-27348 is a critical RCE vulnerability in Apache HugeGraph-Server (<= 3.7.1) that allows attackers to execute arbitrary Java code via the /gremlin endpoint, facilitating the deployment of web shells.

The camel-azure-files component in Apache Camel is vulnerable to path traversal (CVE-2026-79986) due to insufficient validation of filenames returned during Azure File share listing, allowing unauthorized file access, deletion, or renaming.

A path traversal vulnerability (CVE-2025-55752) in the Apache Tomcat RewriteValve component allows unauthenticated attackers to bypass security constraints and access protected files like /WEB-INF/web.xml by abusing an improper URL normalization-before-decoding processing order.

Apache Qpid Proton C versions through 0.40.0 contain a stack buffer overflow read vulnerability triggered by misconfigured wildcard TLS certificates.

An integer overflow vulnerability in Apache Kafka Streams allows an attacker to cause a StreamThread hang by supplying a record with a near-maximum timestamp.

Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property.

A vulnerability in the Kafka Connect configuration validation REST API allows an attacker to exfiltrate sensitive secrets intended to be resolved only at runtime.

An authenticated principal in Apache Kafka can leverage crafted IncrementalAlterConfigs or AlterConfigs requests to perform arbitrary file and environment variable reads from the broker host.

A command injection vulnerability in the Apache Airflow SSH provider allows attackers to achieve remote code execution on SSH hosts by injecting shell syntax into the environment parameter of SSHRemoteJobOperator.

Apache Ranger versions 2.8.0 and earlier are vulnerable to OS command injection via the UnixUserGroupBuilder component when processing crafted usernames containing shell metacharacters.

Apache Unomi versions prior to 1.5.2 are vulnerable to remote code execution (RCE) via crafted MVEL or OGNL expressions injected into the /context.json endpoint.

The Apache Camel Saxon component is affected by an Improper Restriction of XML External Entity Reference vulnerability. The issue occurs when XQueryBuilder parses a message body that is already a javax.xml.transform.Source, causing the component to use Saxon's default parser settings, which resolve external entities.

The retired Apache Abdera library is vulnerable to XML external entity (XXE) injection, enabling unauthenticated remote attackers to access sensitive files or perform server-side requests via malicious XML input.

Apache Pulsar Manager is vulnerable to missing authentication and authorization, leading to potential administrative credential disclosure, and will not receive patches due to the project reaching end-of-life status.

Apache Traffic Server is vulnerable to request smuggling due to the improper handling of shared origin connections when client request bodies are incomplete, allowing cache poisoning and access control bypass.

Apache bRPC versions prior to 1.18.0 are vulnerable to stack exhaustion and process crashes when processing maliciously crafted, deeply nested mcpack data requests.

Apache IoTDB versions 2.0.0 through 2.0.10 contain a privilege escalation vulnerability where the Legacy Pipe receiver protocol uses a hardcoded root identity to perform unauthorized data operations.

The camel-fop component in Apache Camel is vulnerable to XXE injection when a third-party JAXP TransformerFactory is present, enabling local file disclosure and SSRF via maliciously crafted XSL-FO documents.

An unintended proxy mode classification in Apache Camel via prefix matching allows unauthenticated request forgery, potentially exposing internal services to unauthorized access.

A buffer under-read vulnerability in Apache Tomcat versions 11.0.0-M25 through 11.0.26 allows for sensitive data leakage or request failure by incorrectly mixing response bodies between consecutive requests on the same connection.

An input validation vulnerability in Apache Camel’s SagaProcessor allows unauthorized actors to hijack saga associations via the Long-Running-Action header, potentially leading to incorrect compensation or workflow manipulation.

CVE-2026-85296 allows cross-partner signing key leakage in Apache Camel AS2 deployments due to improper state management of per-request keys in shared instance fields.

CVE-2026-85260 is an information disclosure vulnerability in the Apache Camel MLLP component where sensitive HL7 clinical messages are written to application logs by default, exposing protected health information.

CVE-2024-34693 is an arbitrary file read vulnerability in Apache Superset (versions < 3.1.3 and 4.0.1) that allows authenticated attackers to leverage rogue MariaDB servers and the LOAD DATA LOCAL INFILE command to exfiltrate sensitive files.

Apache Answer versions 2.0.2 and earlier contain an authentication bypass vulnerability in the reaction API that allows unauthorized users to access restricted metadata and manipulate content reactions.

CVE-2026-85251 allows for unauthorized credential exposure when the camel-http component follows HTTP redirects to attacker-controlled hosts.

An XML External Entity (XXE) vulnerability in the Apache Camel camel-xpath component allows attackers to trigger local file disclosure or server-side request forgery when documentType is set to InputSource.

An information disclosure vulnerability (CVE-2026-84180) in the camel-knative HTTP consumer allows remote attackers to retrieve internal application details, stack traces, and configuration data via intentional route failures.

An integrity-verification downgrade in camel-crypto-pgp allows attackers to bypass modification detection by using legacy OpenPGP packets, potentially leading to the acceptance and decryption of malleable ciphertext.

A vulnerability in the camel-thrift component, CVE-2026-85245, allows cross-tenant data disclosure by reusing a shared object instance for unmarshalling Thrift payloads.

CVE-2026-85246 allows remote attackers to trigger route failures in Apache Camel Mina consumers, causing the disclosure of internal exception details, file paths, and hostnames over TCP/UDP sockets.

Vulnerabilities in Apache Camel HTTP producers allow unauthenticated users to trigger arbitrary property resolution and bean method invocation via manipulated CamelHttpUri or CamelRestHttpUri headers.

Apache Airflow is affected by multiple vulnerabilities that could allow an attacker to bypass security measures or perform unauthorized information disclosure.

Apache Camel's camel-ftp component contains a path traversal vulnerability (CVE-2026-79983) allowing unauthorized file operations outside the intended directory via malicious server-supplied file listings.

Apache CXF is vulnerable to multiple security flaws including security constraint bypass, data manipulation, unauthorized data disclosure, open redirection, and denial-of-service conditions associated with CVE-2024-37554, CVE-2024-38709, and CVE-2024-38710.

The US government disrupted infrastructure supporting Integrity Technology Group tools MicroScan and FishHub, which Chinese state-sponsored actors, including Flax Typhoon, used to compromise critical infrastructure.

Apache Jackrabbit contains multiple vulnerabilities that allow remote, unauthenticated attackers to bypass security restrictions and perform unauthorized file manipulation or data corruption.

Integrity Technology Group, a Chinese for-profit entity, is conducting multi-year cyber espionage targeting government, healthcare, and religious institutions using automated vulnerability scanning, credential harvesting, and specialized data exfiltration tools.

Multiple security vulnerabilities in Apache HTTP Server versions prior to 2.4.69 allow for remote code execution, denial of service, and data integrity compromise.

Apache ActiveMQ Artemis versions prior to 2.34.0 are vulnerable to remote code execution or state manipulation via insecure reflection in the FederationStreamConnectMessage.getFederationPolicy() method.

CVE-2022-42889, or Text4Shell, is a critical remote code execution vulnerability in Apache Commons Text versions 1.5-1.9 that allows attackers to execute arbitrary code via malicious string lookups.

This brief covers the detection of automated reconnaissance activities, such as vulnerability scanning and fuzzing, which manifest as significant spikes in web server error logs.

Threat actors are exploiting web application command injection vulnerabilities to execute arbitrary code by submitting crafted HTTP requests containing interpreter invocations, downloader utilities, or shell commands.

Attackers may force HTTP protocol downgrades from secure versions like HTTP/2 to legacy versions to exploit header parsing inconsistencies and facilitate request smuggling or cache poisoning.

Adversaries often delete web server access logs to destroy forensic evidence and evade detection after unauthorized activity, a behavior monitorable through file deletion events on common web server log paths.

A critical remote code execution vulnerability (CVE-2024-53677) in Apache Struts versions 2.0.0 through 6.3.0.2 allows attackers to leverage path traversal during file uploads to execute arbitrary code.

Apache Tika-server versions prior to 1.18 are susceptible to unauthenticated remote command injection via malicious HTTP headers in PUT requests, allowing arbitrary code execution.

A vulnerability in Apache ActiveMQ allows a remote, authenticated attacker to perform a denial-of-service attack and manipulate data.

A vulnerability in Apache Airflow allows a remote, unauthenticated attacker to escalate privileges and gain unauthorized user access within the workflow orchestration environment.

A critical remote code execution vulnerability (CVE-2025-24813) in Apache Tomcat with a CVSS score of 10.0 is now being targeted by publicly available proof-of-concept exploit tools.

A vulnerability in the Apache Solr create core API allows unauthenticated or low-privileged attackers to perform UNC path injection, potentially leading to NTLM hash exposure or remote code execution.

A vulnerability in Apache Commons Configuration allows a remote, unauthenticated attacker to trigger a denial of service condition through improper variable interpolation handling.

OpenSAGRES XDocReport is vulnerable to a critical server-side template injection (SSTI) flaw via the Apache Velocity engine, allowing unauthenticated remote code execution through malicious .docx uploads.

CVE-2025-48734 enables attackers to enumerate the Java classpath and ClassLoader via property injection, facilitating RCE when chained with unsafe deserialization endpoints.

An authenticated, remote attacker can exploit a vulnerability in Apache CloudStack to induce a Denial of Service condition on the infrastructure.

Attackers are utilizing automated SQL injection payloads to perform reconnaissance and exploit web applications, leveraging diverse techniques such as boolean-blind, time-based, and stacked query attacks.

A public proof-of-concept exploit for CVE-2026-73633 allows unauthenticated attackers to perform denial-of-service attacks by forcing excessive CPU and memory consumption via the Apache Struts JSON plugin.

A vulnerability in Apache Kafka allows a remote, unauthenticated attacker to trigger a Denial of Service condition by exploiting CVE-2024-27309.

An unauthenticated remote attacker can exploit a deserialization vulnerability in Apache Jackrabbit to achieve remote code execution.

Apache Gravitino versions 1.0.0 through 1.2.1 contain an authenticated SSRF vulnerability (CVE-2026-49876) allowing attackers to perform internal network reconnaissance or access metadata services.

Apache Airflow is affected by multiple vulnerabilities, specifically CVE-2024-48792 and CVE-2024-48793, which allow a remote, authenticated attacker to perform unauthorized information disclosure.

CVE-2025-49506 describes a timing attack vulnerability in the apr_password_validate function of the Apache Portable Runtime Utility library, which uses non-constant time comparisons to verify passwords.

Dinky v1.2.5 and development builds contain an authentication bypass in the SysConfigController.getAll handler, allowing unauthenticated remote attackers to retrieve cleartext system credentials and service tokens.

Apache Lucy, a retired project, contains an uncontrolled recursion vulnerability (CVE-2026-61483) for which no patch will be issued due to the project's end-of-life status.

An unauthenticated path-traversal vulnerability in the Apache Kyuubi REST API (CVE-2026-52680) allows remote attackers to write arbitrary files to the filesystem, leading to remote code execution.

A vulnerability in Apache HttpComponents allows a remote, unauthenticated attacker to trigger a Denial of Service condition on targeted applications.

Detection logic targeting unauthorized Apache Thrift RPC method invocations from external IP addresses to identify exposed internal microservices or potential exploitation of data platforms.

Adversaries can exploit the creation of JavaScript-based user-defined functions in Apache Cassandra to escape the Nashorn sandbox and achieve remote code execution, particularly when vulnerable to CVE-2021-44521.

A critical vulnerability, CVE-2026-66299, has been discovered in Apache Tomcat versions 9.0.x prior to 9.0.121, 10.1.x prior to 10.1.58, and 11.0.x prior to 11.0.25, allowing a remote attacker to cause a denial of service (DoS).

A vulnerability in Apache Tomcat allows a remote, anonymous attacker to perform a Denial of Service attack, potentially disrupting service availability for applications hosted on the affected server.

Multiple vulnerabilities in Apache Traffic Server can be exploited by a remote, anonymous attacker to bypass security measures, disclose or manipulate data, trigger a denial-of-service, and potentially achieve code execution.

An anonymous, remote attacker can exploit a vulnerability in Apache Axis2 to execute arbitrary program code. This flaw allows for critical remote code execution without authentication, posing a significant risk to systems running the affected software.

Multiple vulnerabilities, including decompression bombs (CVE-2026-48586, CVE-2026-49158), an integer overflow (CVE-2026-55969), and a heap out-of-bounds read (CVE-2026-58023), affect Apache Thrift prior to version 0.24.0, potentially leading to denial of service, memory corruption, or arbitrary code execution, and require immediate patching.

An unauthenticated, remote attacker can exploit a vulnerability in Apache Airflow FAB provider to bypass security measures and escalate privileges to gain administrator rights, allowing full control of the affected system.

An anonymous, remote attacker can exploit multiple vulnerabilities in Apache Wicket to perform Cross-Site Scripting (XSS) attacks and bypass existing security measures, potentially leading to unauthorized client-side script execution and further compromise of user sessions or data.

Attackers compromise web servers (Apache, Nginx, Tomcat, PHP) and leverage them to make unexpected outbound network connections to public file-sharing or content hosting services, indicating post-exploitation activity for ingress tool transfer and further compromise.

A vulnerability in the Apache Tomcat mod_jk Connector allows a remote, unauthenticated attacker to bypass security measures or disclose sensitive information, which could enable an adversary to gain unauthorized access or collect confidential data.

A public exploit has been released for CVE-2026-49098, an improper input validation vulnerability in Apache Camel's 'camel-kafka' component, which allows an attacker to perform message-header injection by supplying 'kafka.OVERRIDE_TOPIC' in HTTP headers, enabling cross-topic message injection and integrity compromise of sensitive Kafka topics.

This brief details how attackers exploit Local File Inclusion (LFI) vulnerabilities on web servers such as Nginx, Apache, IIS, and Traefik, by using directory traversal or direct sensitive file path requests to disclose system information, credentials, and configuration files, potentially leading to remote code execution and system compromise.

Unauthenticated attackers can achieve Remote Code Execution (RCE) on default IBM Langflow OSS deployments, versions 1.0.0 through 1.10.0, by chaining access to the `/api/v1/auto_login` endpoint, which mints SUPERUSER tokens, with the `/api/v1/validate/code` endpoint, which executes user-supplied code via `exec()`.

A remote, authenticated attacker can exploit a vulnerability in Apache Ivy to manipulate files on the system, leading to unauthorized modification of data and potential integrity compromise.

The Qilin ransomware group, active since July 2022 and utilizing Golang, has claimed a new victim, Danone (International Delights) in the US Agriculture and Food Production sector, employing double extortion tactics involving data encryption and threatened data release.

Multiple vulnerabilities, including CVE-2026-59083 and CVE-2026-59084, have been discovered in Apache Tomcat versions 10.1.x prior to 10.1.57, 11.0.x prior to 11.0.24, and 9.0.x prior to 9.0.120, allowing an attacker to bypass security policies and cause an unspecified security issue.

A remote, authenticated attacker can exploit a Cross-Site Scripting (XSS) vulnerability in Apache ActiveMQ to execute malicious scripts within a victim's browser.

An attacker can exploit multiple vulnerabilities in Apache Airflow to bypass security controls and escalate their privileges, as reported by CERT-Bund.

An authenticated attacker can exploit CVE-2026-44747, an out-of-bounds write vulnerability in SAP NetWeaver Application Server ABAP, to cause memory corruption leading to unauthorized data access, modification, or system unavailability, severely impacting confidentiality, integrity, and availability.

Multiple vulnerabilities exist in Apache Camel that an attacker can exploit to bypass security controls and execute arbitrary program code, potentially leading to system compromise and unauthorized operations.

Adversaries can exploit the creation of AWS Lambda event source mappings to establish stealthy persistence and execution, or to continuously siphon records from event sources like Amazon SQS, Kinesis, DynamoDB, MSK, Kafka, or MQ, by mapping an event source to an attacker-controlled Lambda function, enabling durable execution and data exfiltration without requiring further interactive access.

Multiple high-severity vulnerabilities discovered in various SAP products, including SQL injection (SQLi), remote indirect code injection (XSS), and security policy bypasses, could allow unauthenticated attackers to compromise sensitive enterprise systems by June 2026.

This rule detects unusual child process executions originating from web server processes on Linux systems, which attackers may use to maintain persistence on a compromised system by exploiting web server vulnerabilities.

Identifies suspicious command executions via a web server on Linux systems, which may suggest a vulnerability and remote shell access.

Identifies suspicious command executions via a web server on Linux systems, potentially indicating a vulnerability exploitation or remote shell access for persistence.

This rule detects potential command execution from a web server parent process on a Linux host, indicating a possible web shell attack where adversaries exploit web server vulnerabilities to execute arbitrary commands.

A public exploit demonstrates improper privilege management in Apache CouchDB (CVE-2017-12635) leading to privilege escalation, which can be combined with CVE-2017-12636 for remote code execution by modifying server configurations via the HTTP API.

A remote, anonymous attacker can exploit a vulnerability in Apache Tika to read sensitive data or trigger malicious requests to internal resources or third-party servers.

A critical deserialization of untrusted data vulnerability (CVE-2025-54539) exists in Apache ActiveMQ NMS AMQP Client <= v2.3.0, where an attacker controlling or impersonating an AMQP broker can send malicious serialized data that the client deserializes unsafely, allowing arbitrary code execution on the client system.

CVE-2026-44930 is an LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF that may allow an attacker to retrieve arbitrary certificates from the repository.

A remote, anonymous attacker can exploit a vulnerability in Apache Tomcat to bypass security measures.

Multiple vulnerabilities in Apache OFBiz could allow an attacker to execute arbitrary code, circumvent security measures, manipulate data, disclose confidential information, or conduct cross-site scripting attacks.

A public exploit has been released for CVE-2019-0227, a Server-Side Request Forgery vulnerability in Apache Axis 1.4 and earlier, allowing unauthenticated remote command execution when `enableRemoteAdmin` is true via deployment of a malicious webservice and webshell.

Multiple vulnerabilities in Apache Camel could allow an attacker to execute arbitrary code, manipulate data, or disclose sensitive information.

A remote, anonymous attacker can exploit a vulnerability in Apache Camel to execute arbitrary program code with the privileges of the service.

Multiple vulnerabilities in Apache Solr could be exploited by an attacker to bypass security measures, manipulate data, and disclose sensitive information.

Siemens Opcenter RDnL is vulnerable to missing authentication in critical function (CVE-2026-27446), where an unauthenticated attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker, potentially leading to availability impacts and message injection.

Apache HertzBeat 1.8.0 is vulnerable to remote code execution due to a newly published exploit, posing a significant risk to unpatched systems.

A local attacker can exploit a vulnerability in Apache Cassandra to execute arbitrary program code, potentially leading to complete system compromise.

A remote, authenticated attacker can exploit multiple vulnerabilities in Apache Airflow Providers OpenSearch and Elasticsearch to disclose sensitive information.

A vulnerability in Apache NiFi allows a remote attacker to execute arbitrary program code on the affected system.

An authenticated, remote attacker can exploit multiple vulnerabilities in Apache NiFi to execute arbitrary code and achieve unspecified impacts.

The OpenSearch logging provider in Apache Airflow Providers OpenSearch versions before 1.9.1 wrote host URLs containing embedded credentials into task logs, potentially exposing them to unauthorized users with task-log read permission (CVE-2026-43826).

A vulnerability in Apache HTTP Server's HTTP/2 protocol can lead to denial of service by crashing worker processes, and in specific configurations (APR with mmap), remote code execution.

Multiple vulnerabilities in Apache Wicket could allow an attacker to bypass security measures, perform Cross-Site Scripting (XSS) attacks, disclose confidential information, or manipulate data.

Multiple vulnerabilities in Apache HTTP Server can be exploited by an attacker to gain elevated privileges, execute arbitrary code, bypass security measures, disclose sensitive information, or cause a denial-of-service condition.

Multiple vulnerabilities in Apache HTTP Server versions prior to 2.4.67 can allow remote attackers to execute arbitrary code, escalate privileges, or cause a denial of service.

A critical arbitrary code execution vulnerability (CVE-2026-41635) exists in Apache MINA versions 2.0.0 through 2.0.27, 2.1.0 through 2.1.10, and 2.2.0 through 2.2.5 due to missing class validation in the AbstractIoBuffer.resolveClass() method, potentially allowing attackers to execute arbitrary code on applications using Apache MINA.

BridgeHead FileStore versions prior to 24A are vulnerable to unauthenticated remote code execution via exposed Apache Axis2 administration module with default credentials, enabling attackers to upload malicious web services and execute arbitrary OS commands.

An authenticated remote attacker can exploit multiple vulnerabilities in Apache ActiveMQ to execute arbitrary program code or perform cross-site scripting attacks.

A critical remote code execution vulnerability, CVE-2026-33017, exists in Langflow AI pipelines prior to version 1.9.0 that allows an unauthenticated remote attacker to execute code with full server process privileges, impacting availability, integrity, and confidentiality.

An anonymous, remote attacker can exploit an unspecified vulnerability in Apache Tomcat to achieve arbitrary code execution.

Detection of potential Local File Inclusion (LFI) activity on web servers through HTTP GET requests attempting to access sensitive local files via directory traversal or known file paths, potentially leading to information disclosure and system compromise.

The new_terms rule detects potential HTTP downgrade attacks by identifying HTTP traffic using a different HTTP version than typically used, potentially exposing systems to vulnerabilities in older protocols.

A remote, anonymous attacker can exploit an unspecified vulnerability in Apache Tomcat to bypass security measures, potentially leading to unauthorized access or modification of data.

This brief focuses on detecting malicious activity related to web shells on Windows systems by identifying the execution of command interpreters and scripting engines as child processes of common web server processes, potentially indicating unauthorized command execution and persistent access.

This rule detects potential Remote File Inclusion (RFI) activity on web servers by identifying HTTP GET requests that attempt to access sensitive remote files through directory traversal techniques or known file paths to read sensitive files, gain system information, or further compromise the server.

This rule detects potential web server discovery or fuzzing activity by identifying a high volume of HTTP GET requests resulting in 404 or 403 status codes from a single source IP address within a short timeframe, indicating attackers discovering hidden resources for targeted attacks.

Exploitation of CVE-2023-50164, a critical path traversal vulnerability in Apache Struts 2, is detected by identifying malicious multipart/form-data POST requests with WebKitFormBoundary targeting Struts .action upload endpoints, followed by JSP web shell creation in Tomcat's webapps directories, indicating remote code execution.

The rule detects potential command injection attempts via web server requests by identifying URLs that contain suspicious patterns commonly associated with command execution payloads.

Detection of potential command injection attempts via web server requests by identifying URLs containing suspicious patterns associated with command execution payloads, which attackers exploit to execute arbitrary commands on the server.

Detection of unusual spikes in web server requests with uncommon or suspicious user-agent strings indicative of reconnaissance attempts to identify web application vulnerabilities or brute-force attacks.

OpenMRS Core versions 2.7.8 and earlier, as well as versions 2.8.0 through 2.8.5, contain a path traversal vulnerability in the ModuleResourcesServlet, allowing an unauthenticated attacker to read arbitrary files from the server filesystem by manipulating the URL.

This rule detects potential Local File Inclusion (LFI) exploitation on web servers by identifying HTTP GET requests attempting to access sensitive local files through directory traversal or known file paths, potentially leading to sensitive information disclosure.