Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Critical Remote Code Execution Vulnerability in Apache HTTP Server

Successful exploitation of CVE-2026-119618 could allow an unauthenticated attacker to achieve remote code execution

Threat ID:
CC-4892
Threat Severity:
High
Published:
12 November 2026 12:46 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Successful exploitation of CVE-2026-119618 could allow an unauthenticated attacker to achieve remote code execution

Threat details

Proof-of-concept exploit released

Security researchers have published a proof-of-concept exploit for CVE-2026-119618.

The NHS England National CSOC assesses exploitation as likely.

Introduction

The Apache Software Foundation has released a security update to address a critical severity vulnerability in Apache HTTP Server. Successful exploitation could allow an unauthenticated attacker to achieve remote code execution (RCE).

  • CVE‑2026‑119618 – "Race Condition" vulnerability – Critical severity

Remediation advice

Affected organisations must review the Apache HTTP Server 2.4.71 advisory, and complete the remediation steps detailed below.

Remediation steps

Type Step
Patch

Required: Patch to a fixed version

Affected organisations must patch their Apache HTTP Server instances to a fixed, supported version:

  • Apache HTTP Server 2.4.71 or later

Note: The open-source icing/mod_h2 repository was archived in June 2026 and will not receive security updates. Organisations must migrate to using the HTTP/2 implementation in Apache HTTP Server.  


https://httpd.apache.org/security/vulnerabilities_24.html
Guidance

Temporary mitigation: Restrict the active protocol to HTTP/1.1 until a patch can be applied

Where immediate patching is not possible, organisations are strongly recommended to temporarily disable HTTP/2 by removing h2 and h2c from the Protocols directive and restricting servers to HTTP/1.1, subject to compatibility and performance requirements.

Last edited: 12 November 2026 12:46 pm