CVE-2026-44119

Analyzed Analyzed - Analysis Complete

Improper Privilege Management in Apache HTTP Server

Publication date: 2026-06-08

Last updated on: 2026-06-11

Assigner: Apache Software Foundation

Description

Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. This issue affects Apache HTTP Server: from through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-08

Last Modified

2026-06-11

Generated

2026-06-29

AI Q&A

2026-06-08

EPSS Evaluated

2026-06-27

NVD

CVE-2026-44119

EUVD

EUVD-2026-35094

Affected Vendors & Products

Vendor	Product	Version / Range
apache	http_server	From 2.4.0 (inc) to 2.4.68 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Privilege Management issue in Apache HTTP Server version 2.4.67 and earlier. It allows local .htaccess authors to read files using the privileges of the httpd user, which means they can access files they might not normally have permission to read.

Impact Analysis

The impact of this vulnerability is that a local user who can create or modify .htaccess files could read sensitive files on the server with the privileges of the httpd user. This could lead to unauthorized access to confidential information or system files.

Mitigation Strategies

To mitigate this vulnerability, users are recommended to upgrade Apache HTTP Server to version 2.4.68, which fixes the issue.

Compliance Impact

The provided information does not specify how the CVE-2026-44119 vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-44119. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70