Apache known exploited vulnerabilities
Every Apache CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 41 in all, 3 added in the last 12 months.
- CVE-2016-3081Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackerorg.apache.struts:struts2-core
- CVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2026-34197Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansApache Software Foundation Apache ActiveMQ Broker · Apac… +3
- CVE-2024-38475Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.Apache Software Foundation Apache HTTP Server
- CVE-2025-24813Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2024-45195Apache OFBiz: Confused controller-view authorization logic (forced browsing)Apache Software Foundation Apache OFBiz
- CVE-2024-27348Apache HugeGraph-Server: Command execution in gremlinApache Software Foundation Apache HugeGraph-Server · org… +1
- CVE-2024-38856Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering codeApache Software Foundation Apache OFBiz
- CVE-2024-32113Apache OFBiz: Path traversal leading to RCEApache Software Foundation Apache OFBiz
- CVE-2020-17519Apache Flink directory traversal attack: reading remote files through the REST APIApache Software Foundation Apache Flink · org.apache.fli… +1
- CVE-2023-27524Apache Superset: Session validation vulnerability when using provided default SECRET_KEYApache Software Foundation Apache Superset · superset +1
- CVE-2023-46604Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attackApache Software Foundation Apache ActiveMQ · org.apache.… +1
- CVE-2023-33246Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration functionApache Software Foundation Apache RocketMQ · org.apache.… +2
- CVE-2016-8735Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x beforeApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attackApache Software Foundation Apache Log4j · org.apache.log… +1
- CVE-2022-33891Apache Spark shell command injection vulnerability via Spark UIApache Software Foundation Apache Spark · org.apache.spa… +1
- CVE-2022-24706Remote Code Execution Vulnerability in PackagingApache Software Foundation Apache CouchDB
- CVE-2022-24112apisix/batch-requests plugin allows overwriting the X-REAL-IP headerApache Software Foundation Apache APISIX
- CVE-2017-9791The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message tApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2016-3088The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTorg.apache.activemq:activemq-client
- CVE-2012-0391The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception haorg.apache.struts:struts2-core · org.apache.struts.xwork:xw…
- CVE-2006-1547ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service vstruts:struts
- CVE-2020-13927The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security riApache Airflow · apache-airflow
- CVE-2020-11978An issue was found in Apache Airflow versions 1.10.10 and below.Apache Software Foundation Apache Airflow · apache-airflow
- CVE-2019-0193In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whiApache Solr · org.apache.solr:solr-core
- CVE-2020-17530Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.Apache Software Foundation Apache Struts · org.apache.strut…
- CVE-2019-17558Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter.Apache Solr · org.apache.solr:solr-core
- CVE-2019-0211In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes orApache HTTP Server
- CVE-2018-11776Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (eiApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2017-9805The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStreaApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2017-5638The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-mesApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2016-4437Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitorg.apache.shiro:shiro-core
- CVE-2020-1956Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, aApache Kylin · org.apache.kylin:kylin-core-common
- CVE-2017-12617When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.Apache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2017-12615When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.Apache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2013-2251Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:,org.apache.struts:struts2-core
- CVE-2020-1938When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core
- CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsApache Software Foundation Apache Log4j2 · org.apache.lo… +4
- CVE-2021-40438mod_proxy SSRFApache Software Foundation Apache HTTP Server
- CVE-2021-42013Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)Apache Software Foundation Apache HTTP Server
- CVE-2021-41773Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49Apache Software Foundation Apache HTTP Server
FAQ
Apache KEV questions.
How many Apache vulnerabilities are in CISA KEV?
41 Apache vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 3 of them added in the last 12 months. The newest is CVE-2016-3081 (Apache Struts Command Injection Vulnerability), added 2026-10-08.
Which Apache products are in CISA KEV?
21 products, including Struts, Tomcat, ActiveMQ. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Apache KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 8 of the 41 Apache entries.