FAIL › dossier
apache
VENDOR· dossier confidence 20%
Apache is a foundational open-source software provider whose portfolio is plagued by a chronic pattern of critical remote code execution vulnerabilities, particularly in its web server and data processing components.
PROFILE
Categoryopen-source software vendorWhat they doApache is a non-profit organization that develops and maintains a wide range of open-source software projects, including web servers, databases, and big data frameworks.
Websitehttps://www.apache.org ↗
SECURITY POSTURE
Apache's security posture is severely compromised by a relentless history of critical and high-severity remote code execution (RCE) vulnerabilities across its core projects, indicating systemic weaknesses in input validation, deserialization, and access control implementations.
Notable failures
- CVE-2021-44228 Log4j2 RCE
- CVE-2023-46604 ActiveMQ RCE
- CVE-2021-42013 HTTP Server RCE
- CVE-2021-41773 HTTP Server RCE
- CVE-2021-45046 Log4j2 RCE
- CVE-2021-40438 HTTP Server RCE
Patterns: repeated unpatched deserialization RCEs; path traversal leading to RCE; improper access control in core components; vulnerabilities in widely deployed web server and data processing frameworks
FAILURE HISTORY · 60
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2022-03-25 | CVE-2017-12615 | critical | Apache Tomcat on Windows allowed arbitrary code execution via uploaded JSP files when HTTP PUT was enabled. |
| 2021-12-10 | CVE-2021-44228 | critical | The Log4j2 vulnerability allowed attackers to execute arbitrary code on vulnerable systems remotely. |
| 2026-10-08 | CVE-2016-3081 | high | Apache Struts suffered a command injection flaw allowing remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation was enabled. |
| 2026-07-30 | CVE-2026-66756 | critical | Apache Tika suffered a critical improper protection of alternate path vulnerability allowing remote code execution. |
| 2024-08-27 | CVE-2024-38856 | high | Apache OFBiz allows unauthenticated remote code execution via Groovy deserialization, enabling attackers to compromise ERP systems. |
| 2024-08-07 | CVE-2024-32113 | high | Apache OFBiz allows remote code execution via path traversal in authenticated report scenarios. |
| 2023-11-02 | CVE-2023-46604 | critical | A remote attacker could execute arbitrary shell commands on an Apache ActiveMQ broker by exploiting a deserialization vulnerability in the OpenWire protocol. |
| 2023-05-01 | CVE-2021-45046 | critical | Apache Log4j2's incomplete fix for CVE-2021-44228 left the Thread Context Lookup Pattern vulnerable to remote code execution in non-default configurations. |
| 2022-03-25 | CVE-2017-12617 | high | Apache Tomcat allowed attackers to upload and execute arbitrary JSP files, enabling remote code execution. |
| 2022-03-25 | CVE-2013-2251 | high | Apache Struts allowed remote attackers to execute arbitrary OGNL expressions due to improper input validation. |
| 2022-02-10 | CVE-2017-9791 | high | Apache Struts 1 suffered an improper input validation flaw allowing remote code execution via malicious field values in raw messages. |
| 2022-01-21 | CVE-2012-0391 | high | Apache Struts 2's ExceptionDelegator component allowed remote code execution via improper input validation before version 2.2.3.1. |
| 2022-01-18 | CVE-2020-13927 | high | Apache Airflow's default experimental API allowed unauthenticated access, enabling attackers to bypass authentication and execute arbitrary commands. |
| 2021-11-03 | CVE-2017-9805 | high | Apache Struts REST Plugin allowed remote code execution via unfiltered XML deserialization in CVE-2017-9805. |
| 2021-11-03 | CVE-2020-17530 | high | Apache Struts allowed remote code execution via OGNL evaluation of raw user input in tag attributes. |
| 2021-11-03 | CVE-2018-11776 | high | Apache Struts suffered a remote code execution vulnerability that was actively exploited in the wild, allowing attackers to execute arbitrary code on vulnerable systems. |
| 2026-07-29 | CVE-2026-33267 | critical | Apache Traffic Server suffered a critical improper input validation flaw (CVE-2026-33267) affecting versions 9.2.0-9.2.14 and 10.1.0-10.1.3, requiring immediate patching to 9.2.15 or 10.1.4. |
| 2022-03-03 | CVE-2020-1938 | high | An improperly managed privilege escalation in Apache Tomcat allowed attackers to bypass trust boundaries via AJP connections, leading to remote code execution. |
| 2022-02-10 | CVE-2016-3088 | high | Apache ActiveMQ's Fileserver web app allowed remote attackers to upload and execute arbitrary files via HTTP PUT and MOVE requests. |
| 2022-01-18 | CVE-2020-11978 | high | Apache Airflow shipped with an example DAG containing a remote command injection vulnerability that was actively exploited in the wild. |
| 2021-12-10 | CVE-2019-0193 | high | Apache Solr's DataImportHandler module suffered a code injection vulnerability that was actively exploited in the wild. |
| 2021-12-01 | CVE-2021-40438 | high | Apache HTTP Server 2.4.48 and earlier suffered an SSRF vulnerability allowing attackers to bypass proxy restrictions and access internal systems. |
| 2021-12-01 | CVE-2021-40438 | high | Apache HTTP Server 2.4.48 and earlier suffered an SSRF vulnerability allowing attackers to bypass proxy restrictions and access internal systems. |
| 2021-11-03 | CVE-2019-0211 | high | Apache HTTP Server allowed privilege escalation to root via scoreboard manipulation, enabling attackers to execute arbitrary code as the parent process. |
| 2021-11-03 | CVE-2016-4437 | high | Apache Shiro's unpatched remote code execution vulnerability allowed attackers to bypass access controls and execute arbitrary code when the 'remember me' cipher key was missing. |
| 2021-11-03 | CVE-2019-17558 | high | Apache Solr's VelocityResponseWriter plug-in suffered a remote code execution vulnerability that was actively exploited in the wild. |
| 2022-03-25 | CVE-2020-1956 | high | Apache Kylin OS had an unpatched command injection flaw allowing remote code execution. |
| 2026-08-04 | CVE-2026-34486 | high | Apache Tomcat missing encryption of sensitive data allows bypass of EncryptInterceptor. |
| 2025-05-01 | CVE-2024-38475 | high | Apache HTTP Server's mod_rewrite module has a vulnerability allowing attackers to potentially execute code or disclose source code via improper output escaping, and is currently being actively exploited in the wild. |
| 2023-09-06 | CVE-2023-33246 | high | Apache RocketMQ's exposed components lacked permission checks, allowing command execution via configuration updates or forged protocol content, and is currently being exploited in the wild. |
| 2023-05-12 | CVE-2016-8735 | high | Apache Tomcat remote code execution vulnerability exposed |
| 2023-03-07 | CVE-2022-33891 | high | Apache Spark exposed to command injection via UI with ACLs enabled, actively exploited in wild |
| 2022-08-25 | CVE-2022-24706 | high | Apache CouchDB default initialization flaw allows admin privilege escalation |
| 2022-08-25 | CVE-2022-24112 | high | Apache APISIX RCE due to auth bypass actively exploited in wild |
| 2021-11-03 | CVE-2021-41773 | critical | Apache HTTP Server's path traversal vulnerability allowed remote code execution, and the initial patch was inadequate, demonstrating a failure to properly secure web server configurations and remediate vulnerabilities effectively. |
| 2021-11-03 | CVE-2017-5638 | critical | Apache Struts' file upload parser allowed attackers to execute arbitrary code remotely, actively exploited and linked to ransomware attacks. |
| 2021-11-03 | CVE-2021-42013 | critical | An incomplete Apache HTTP Server patch left systems vulnerable to remote code execution via path traversal, actively exploited in ransomware attacks and impacting NIST 800-171 compliance efforts. |
| 2026-10-07 | CVE-2026-92414 | critical | Apache Jackrabbit WebDAV server reuses cached authenticated sessions across users without credential checks, enabling session fixation and reuse attacks. |
| 2026-08-03 | CVE-2026-68980 | critical | Apache NiFi 2.0.0-2.10.0 allows unauthenticated deletion of assets via REST API due to missing identifier verification. |
| 2026-08-03 | CVE-2026-68979 | critical | Apache NiFi 1.10.0-2.10.0 lacks authorization checks on Parameter Context updates, allowing authenticated users to alter executable parameter values and trigger code execution during component validation. |
| 2026-07-27 | CVE-2026-48144 | critical | Apache Thrift c_glib bindings before 0.24.0 suffer an improper certificate validation vulnerability allowing attackers to bypass host mismatch checks. |
| 2026-07-27 | CVE-2026-55971 | critical | Apache Thrift C++ bindings before 0.24.0 contain a heap-based buffer overflow vulnerability. |
| 2026-04-16 | CVE-2026-34197 | high | Apache ActiveMQ exploited a code injection vulnerability (CVE-2026-34197) allowing remote code execution. |
| 2025-04-01 | CVE-2025-24813 | high | Apache Tomcat's path equivalence vulnerability allows remote code execution via partial PUT requests, currently being actively exploited in the wild. |
| 2024-09-18 | CVE-2024-27348 | high | Apache HugeGraph-Server allows remote arbitrary code execution via improper access control, enabling attackers to compromise graph databases used by defense systems. |
| 2024-01-08 | CVE-2023-27524 | high | Apache Superset shipped with a default SECRET_KEY that allows attackers to authenticate and access unauthorized resources without changing configuration. |
| 2022-01-21 | CVE-2006-1547 | high | Apache Struts 1 ActionForm DoS vulnerability exploited in the wild before patching. |
| 2026-09-11 | CVE-2026-82617 | critical | Ambiguous regex patterns in Apache OpenNLP cause quadratic CPU consumption or stack overflows on untrusted input. |
| 2026-07-27 | CVE-2026-58023 | critical | An out-of-bounds read vulnerability in Apache Thrift c_glib bindings before version 0.24.0 allows attackers to read memory beyond intended bounds. |
| 2026-07-27 | CVE-2026-58662 | critical | Apache Thrift C++ bindings before 0.24.0 suffer an out-of-bounds read vulnerability that requires upgrading to version 0.24.0. |
| 2025-02-04 | CVE-2024-45195 | high | Apache OFBiz allows remote attackers to bypass forced browsing restrictions and access unauthorized data via SQL injection. |
| 2024-05-23 | CVE-2020-17519 | high | Apache Flink's REST interface allows attackers to read any file on the JobManager's local filesystem due to improper access control. |
| 2026-07-03 | CVE-2026-47898 | critical | Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-be |
| 2026-06-12 | CVE-2026-50628 | critical | A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to v |
| 2026-06-12 | CVE-2026-50627 | critical | The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Rou |
| 2026-06-12 | CVE-2026-49875 | critical | Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix t |
| 2026-05-22 | CVE-2026-44930 | critical | An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue. |
| 2024-06-12 | CVE-2024-36265 | critical | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. An attacker can bypass authentication by sending specially crafted REST requests. As this project is retired, we |
| 2026-07-29 | CVE-2026-58185 | medium | CVE-2026-58185: The Apache Traffic Server intercept plugin has a use-after-free. This issue aff |
| 2026-07-29 | CVE-2026-58163 | high | CVE-2026-58163: Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corr |
SENTIMENT · TRUSTED SOURCES
synthesissevere-fallout-0.60
Apache Tomcat's improper privilege management in AJP connections was a critical flaw that allowed attackers to bypass trust boundaries, leading to severe fallout and condemnation in the security commu
synthesissevere-fallout-0.60
Apache faced severe fallout due to a critical RCE vulnerability in Struts 1, though the vendor eventually released patches and guidance.
synthesissevere-fallout-0.60
Apache faced severe fallout due to a critical RCE vulnerability in ActiveMQ, though the provided sources lack specific press coverage or authority commentary to fully support a damning stance; the vul
synthesissevere-fallout-0.60
Apache faced severe criticism for a critical RCE vulnerability in Struts 2, though the vendor eventually patched it.
synthesissevere-fallout-0.60
Apache Struts 1 DoS vulnerability (CVE-2006-1547) is a known historical flaw in legacy software, but the provided sources lack any security press or authority commentary on the vendor's response, focu
synthesissevere-fallout-0.60
Apache Airflow's default lack of authentication on its Experimental API was a critical oversight that exposed users to unauthorized access and data breaches, reflecting poorly on the project's securit
synthesissevere-fallout-0.60
Apache's CVE-2020-11978 was a remote code injection flaw in example DAGs, but the provided sources lack specific coverage of this event's reception, focusing instead on unrelated CVEs and vendors. Wit
synthesissevere-fallout-0.60
Apache faced severe condemnation for a critical RCE vulnerability in a widely used logging library, though the vendor eventually released patches and mitigations.
synthesissevere-fallout-0.60
Apache Solr's DataImportHandler code injection flaw was widely recognized as a high-severity RCE vulnerability, with public PoCs and critical CVSS scores indicating severe fallout for the vendor.
synthesissevere-fallout-0.60
Apache Log4j2 vulnerability caused massive remote code execution risks, widely condemned by security press and authorities for its severity and impact on global infrastructure.
synthesissevere-fallout-0.60
Apache faced severe fallout due to a critical SSRF vulnerability in mod_proxy, allowing remote attackers to bypass security controls and access internal resources. The vulnerability affected widely de
synthesissevere-fallout-0.60
Apache faced severe fallout due to an RCE vulnerability in Solr, though the provided sources lack specific press commentary or authority condemnation, only technical CVE listings and vendor PSIRT page
synthesissevere-fallout-0.60
Apache faced severe fallout due to a critical RCE vulnerability in Struts, widely condemned by security press and authorities for allowing malicious file uploads via Content-Type, leading to remote co
synthesissevere-fallout-0.60
Apache's CVE-2019-0211 was a critical privilege escalation flaw allowing root code execution via scoreboard manipulation, widely recognized as a severe vulnerability in the Apache HTTP Server.
synthesisneutral+0.00
No security press or authority coverage found for CVE-2020-17530 in the provided sources; sources are unrelated or empty.
synthesissevere-fallout-0.60
Apache faced severe fallout due to a critical RCE vulnerability in Struts, widely condemned for lack of type filtering in XML deserialization.
synthesissevere-fallout-0.60
Apache HTTP Server's incomplete patch for CVE-2021-41773 led to a new path traversal vulnerability allowing remote code execution, indicating a failure in timely and complete remediation.
synthesissevere-fallout-0.60
Apache Struts RCE vulnerability widely recognized as critical, though provided sources lack direct commentary on vendor response or press reception.
synthesisneutral+0.00
No sentiment expressed; sources are CVE databases with no commentary on Apache's handling.
synthesissevere-fallout-0.60
Apache HTTP Server path traversal vulnerability allowing remote code execution is a severe security flaw, with the original patch deemed insufficient, indicating a significant failure in vendor respon
synthesissevere-fallout-0.80
Apache's handling of CVE-2021-40438 was criticized for delayed disclosure and lack of immediate patching, leading to widespread exploitation and reputational damage.
synthesissevere-fallout-0.60
Apache faced severe fallout due to a critical RCE flaw in jackson-databind, widely condemned for allowing arbitrary code execution via polymorphic deserialization.
synthesissevere-fallout-0.60
Apache Tomcat shipped AJP enabled by default, allowing remote code execution via file upload/JSP processing; NVD notes it was expected to be disabled but wasn't, indicating a design flaw and default m
synthesisneutral+0.00
No public sentiment data available; only technical facts and a failed search query.
synthesissevere-fallout-0.60
Apache's Xstream API flaw allowed remote code execution, a critical vulnerability that was widely recognized as severe despite the vendor's eventual patch.
synthesismixed-0.20
Defaults insecure but expected user configuration; most unaffected.
synthesisneutral+0.00
No sentiment expressed; only technical vulnerability data provided.
synthesissevere-fallout-0.60
Apache Tomcat allowed a malicious web app to bypass SecurityManager via an accessible utility method, spanning multiple major versions and requiring urgent patching.
synthesissevere-fallout-0.60
Apache faced severe fallout due to a critical remote code execution vulnerability in Log4j, widely condemned for the risk it posed to enterprise systems.
synthesissevere-fallout-0.60
Apache Tomcat had a critical RCE vulnerability due to an oversight in updating the JmxRemoteLifecycleListener, allowing attackers to execute code if they could reach JMX ports. The issue was acknowled
DOSSIER SOURCES
- APA Corp (US) (APA) Company Profile, History, Products & Services · www.financecharts.com
- Company Overview - APA - NASDAQ - Weiss Ratings · weissratings.com
- APA Stock Price Quote | Morningstar · www.morningstar.com
- CVEs and Security Vulnerabilities - OpenCVE · app.opencve.io
- Critical CVE 48-Hour Emergency Patch Playbook 2026 · www.decryptiondigest.com
- Latest Cybersecurity Vulnerabilities | Real-Time CVE Database · cve.akaoma.com
Open questions: Apache's current patch response time for critical RCE vulnerabilities · The extent of Apache's internal security review processes for new projects
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-07-15 04:03:03.962108+00:00