CVE-2026-42356

Think of this like a mailroom that's supposed to only run certain approved programs, but due to a mix-up it sometimes runs a regular document as if it were a program instead. On an affected Apache web server, this mix-up can let an outsider trick the server into running unintended code, which could let them take partial control of the site.

This matters to you if you run Apache HTTP Server, specifically versions 2.4.60 through 2.4.68, with CGI (a feature that lets the server run external scripts) enabled on any directory. It's only a risk for directories configured for CGI where target files lack a recognized file extension — if you don't use CGI at all, this doesn't apply to you.

This is a software weakness that can be triggered remotely without any login or user interaction, and it's reachable by default on servers meeting the conditions above, so it deserves prompt action even though no confirmed real-world attacks have been reported yet. A fix is already available, so there's no reason to delay patching. Treat this as a priority update, not a background task.

Confirm your exact Apache HTTP Server version and audit Options +ExecCGI or ScriptAlias directives across your vhost configs to identify CGI-enabled directories. Affected versions are 2.4.60 through 2.4.68; the fix is in 2.4.69 (see https://httpd.apache.org/security/vulnerabilities_24.html for release notes and upgrade guidance). There is no known breaking change tied to this fix. If immediate patching isn't possible, mitigate by removing CGI handling from directories that don't strictly require it, or ensure all files in CGI directories carry a mod_mime-recognized extension so they can't be misrouted. Monitor Apache error/access logs for unexpected execution attempts against non-script files in CGI directories. No CISA KEV listing or due date currently applies to this CVE.

CVSS 3.1 score is 3.7 (Low), vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, reflecting network reachability but high attack complexity and limited integrity impact only. Weakness class is CWE-430 (Deployment of Wrong Handler), triggered when mod_cgi performs an internal redirect to a target lacking a mod_mime-recognized extension within a CGI-enabled directory, causing it to be executed as CGI. No public exploit code is known, no CISA KEV entry exists, and predicted exploitation likelihood is low with a flat trend. Press attention noted (roundup mention, actor ShinyHunters referenced) but with no dated claim of actual exploitation — this should not be treated as confirmed in-the-wild activity.