EXPOSURES › CVE-2026-33267
CVE-2026-33267
CRITICALApache Traffic Server suffered a critical improper input validation flaw (CVE-2026-33267) affecting versions 9.2.0-9.2.14 and 10.1.0-10.1.3, requiring immediate patching to 9.2.15 or 10.1.4.
This improper input validation vulnerability allows attackers to inject malicious payloads into the Traffic Server, potentially leading to arbitrary code execution or data compromise. DIB organizations must ensure their Apache Traffic Server deployments are patched to the latest versions, as unpatched instances remain vulnerable to exploitation in the wild. Failure to patch exposes the organization to severe compliance risks under NIST 800-171 and CMMC requirements.
Shame score — A critical CVSS 10.0 vulnerability in a widely deployed web proxy was left unpatched for multiple versions, indicating a severe failure in the vendor's patch management and security lifecycle.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.