PT-2026-103933

CVE-2026-59797

Published

2026-10-01

Updated

2026-11-10

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.68

Description An improper privilege management issue exists in the mod ssl module. The flaw occurs when using SSLRequire in conjunction with file-related expressions via ap expr file functions, which can lead to improper privilege escalation without requiring authentication.

Recommendations Update Apache HTTP Server to a version later than 2.4.68.

Exploitability

Exploit

Fix

Impacts

Researchers

Charles Vosburgh

Juthawong Naisanguansee