UBUNTU-CVE-2026-59797: Critical severity ubuntu/apache2 vulnerability

Q: Does exploitation require an authenticated account or user interaction?

No. The supplied CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What impact should be assumed if exploitation succeeds?

The supplied CVSS vector rates confidentiality, integrity, and availability impact as high. Treat affected deployments as potentially exposed to full compromise of those security properties.

Q: Which deployments should be prioritized for review?

Prioritize Ubuntu systems running the apache2 package where Apache HTTP Server is between 2.4.0 and 2.4.68 and uses mod_ssl with SSLRequire and file-related expressions.

Published Oct 1, 2026

Updated

Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Affected Software

8 affected componentsFixes available

ubuntu/apache2<2.4.7-1ubuntu4.22+esm16

2.4.7-1ubuntu4.22+esm16

ubuntu/apache2<2.4.18-2ubuntu3.17+esm21

2.4.18-2ubuntu3.17+esm21

ubuntu/apache2<2.4.29-1ubuntu4.27+esm12

2.4.29-1ubuntu4.27+esm12

ubuntu/apache2<2.4.41-4ubuntu3.23+esm8

2.4.41-4ubuntu3.23+esm8

ubuntu/apache2<2.4.52-1ubuntu4.24

2.4.52-1ubuntu4.24

ubuntu/apache2<2.4.58-1ubuntu8.16

2.4.58-1ubuntu8.16

ubuntu/apache2*

ubuntu/apache2<2.4.66-2ubuntu2.5

2.4.66-2ubuntu2.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.7-1ubuntu4.22+esm16
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.18-2ubuntu3.17+esm21
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.29-1ubuntu4.27+esm12
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.41-4ubuntu3.23+esm8
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.52-1ubuntu4.24
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.58-1ubuntu8.16
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.66-2ubuntu2.5

Event History

Oct 1, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

No. The supplied CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

What impact should be assumed if exploitation succeeds?

The supplied CVSS vector rates confidentiality, integrity, and availability impact as high. Treat affected deployments as potentially exposed to full compromise of those security properties.

Which deployments should be prioritized for review?

Prioritize Ubuntu systems running the apache2 package where Apache HTTP Server is between 2.4.0 and 2.4.68 and uses mod_ssl with SSLRequire and file-related expressions.

UBUNTU-CVE-2026-59797: Critical severity ubuntu/apache2 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

What impact should be assumed if exploitation succeeds?

Which deployments should be prioritized for review?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

What impact should be assumed if exploitation succeeds?

Which deployments should be prioritized for review?