Apache known exploited vulnerabilities
Every Apache CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 41 in all, 3 added in the last 12 months.
- CVE-2023-46604Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attackApache Software Foundation Apache ActiveMQ · org.apache.… +1
- CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attackApache Software Foundation Apache Log4j · org.apache.log… +1
- CVE-2017-12615When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.Apache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsApache Software Foundation Apache Log4j2 · org.apache.lo… +4
- CVE-2021-40438mod_proxy SSRFApache Software Foundation Apache HTTP Server
- CVE-2021-42013Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)Apache Software Foundation Apache HTTP Server
- CVE-2021-41773Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49Apache Software Foundation Apache HTTP Server
- CVE-2017-5638The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-mesApache Software Foundation Apache Struts · org.apache.strut…
FAQ
Apache KEV questions.
How many Apache vulnerabilities are in CISA KEV?
41 Apache vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 3 of them added in the last 12 months. The newest is CVE-2016-3081 (Apache Struts Command Injection Vulnerability), added 2026-10-08.
Which Apache products are in CISA KEV?
21 products, including Struts, Tomcat, ActiveMQ. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Apache KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 8 of the 41 Apache entries.