KEV 2026.09.231,721 entries+8 in 7d8 open federal deadlinesas of / search ? keys
Telemetry

Vendor dossier / #7

Apache vulnerabilities in CISA KEV

Catalog
2026.09.23
Rank
#7 of 283
Updated
2026-08-04

Answer CISA's KEV catalog lists 40 Apache vulnerabilities as of catalog 2026.09.23, 2.3% of all 1,721 entries and rank 7 of 283 vendors. The first was added on 2021-11-03 and the most recent on 2026-08-04; 8 are flagged as used in ransomware campaigns.

KEV entries
402.3% of catalog
Last 90 days
+1added
Ransomware: known
820%
Products
21distinct
First added
2021-11-03
Latest added
2026-08-04
Median days to due
21
Open deadlines
0federal

TAdditions per quarter

Apache KEV additions per quarterColumn chart of KEV additions per quarter from 2021Q4 to 2026Q3. Peak: 12 in 2021Q4.0510152021Q4: 12 added2021 Q42022Q1: 11 added2022Q2: 0 added2022Q3: 2 added2022Q4: 0 added2022 Q42023Q1: 1 added2023Q2: 2 added2023Q3: 1 added2023Q4: 1 added2023 Q42024Q1: 1 added2024Q2: 1 added2024Q3: 3 added2024Q4: 0 added2024 Q42025Q1: 1 added2025Q2: 2 added2025Q3: 0 added2025Q4: 0 added2025 Q42026Q1: 0 added2026Q2: 1 added2026Q3: 1 added
Table view (by year)
Apache KEV additions by year
YearAdded
202112
202213
20235
20245
20253
20262

QCommon questions

How many Apache vulnerabilities are in CISA KEV?

40, as of KEV catalog 2026.09.23 (released 2026-09-23). That is 2.3% of the catalog.

Which Apache product has the most KEV entries?

Tomcat, with 6 entries. 21 products appear in total.

How many Apache KEV vulnerabilities are linked to ransomware?

8 of 40 (20%) are flagged by CISA as known to be used in ransomware campaigns.

When was the latest Apache vulnerability added to KEV?

2026-08-04 (CVE-2026-34486).

What is the most common weakness in Apache KEV entries?

CWE-20 (Improper input validation), listed on 8 entries.

PProducts

Apache products in KEV
ProductEntriesShare of vendor
Tomcat615%
Struts512.5%
HTTP Server410%
ActiveMQ37.5%
OFBiz37.5%
Log4j225%
Struts 125%
Solr25%
HugeGraph-Server12.5%
Flink12.5%
Superset12.5%
RocketMQ12.5%
Spark12.5%
CouchDB12.5%
APISIX12.5%
Kylin12.5%
Struts 212.5%
Airflow's Experimental API12.5%
Airflow12.5%
Apache12.5%
Shiro12.5%

WWeaknesses

entries can list several CWEs
CWEs in Apache KEV entries
CWEEntriesShare of vendor
CWE-20 Improper input validation820%
CWE-502 Unsafe deserialization410%
CWE-94 Code injection37.5%
CWE-284 Improper access control37.5%
CWE-22 Path traversal37.5%
CWE-118837.5%
CWE-78 OS command injection37.5%
CWE-91725%
CWE-434 Unrestricted file upload25%
CWE-31112.5%
CWE-11612.5%
CWE-4412.5%
No CWE listed25%

EAll 40 entries

All Apache entries in CISA KEV, newest first
CVEProductVulnerabilityAddedDueRansomwareCWE
CVE-2026-34486TomcatApache Tomcat Missing Encryption of Sensitive Data VulnerabilityUnknownCWE-311
CVE-2026-34197ActiveMQApache ActiveMQ Improper Input Validation VulnerabilityUnknownCWE-20, CWE-94
CVE-2024-38475HTTP ServerApache HTTP Server Improper Escaping of Output VulnerabilityUnknownCWE-116
CVE-2025-24813TomcatApache Tomcat Path Equivalence VulnerabilityUnknownCWE-44, CWE-502
CVE-2024-45195OFBizApache OFBiz Forced Browsing VulnerabilityUnknownCWE-425
CVE-2024-27348HugeGraph-ServerApache HugeGraph-Server Improper Access Control VulnerabilityUnknownCWE-284
CVE-2024-38856OFBizApache OFBiz Incorrect Authorization VulnerabilityUnknownCWE-863
CVE-2024-32113OFBizApache OFBiz Path Traversal VulnerabilityUnknownCWE-22
CVE-2020-17519FlinkApache Flink Improper Access Control VulnerabilityUnknownCWE-552
CVE-2023-27524SupersetApache Superset Insecure Default Initialization of Resource VulnerabilityUnknownCWE-1188
CVE-2023-46604ActiveMQApache ActiveMQ Deserialization of Untrusted Data VulnerabilityKnownCWE-502
CVE-2023-33246RocketMQApache RocketMQ Command Execution VulnerabilityUnknownCWE-94
CVE-2016-8735TomcatApache Tomcat Remote Code Execution VulnerabilityUnknownCWE-284
CVE-2021-45046Log4j2Apache Log4j2 Deserialization of Untrusted Data VulnerabilityKnownCWE-917
CVE-2022-33891SparkApache Spark Command Injection VulnerabilityUnknownCWE-78
CVE-2022-24706CouchDBApache CouchDB Insecure Default Initialization of Resource VulnerabilityUnknownCWE-1188
CVE-2022-24112APISIXApache APISIX Authentication Bypass VulnerabilityUnknownCWE-290
CVE-2020-1956KylinApache Kylin OS Command Injection VulnerabilityUnknownCWE-78
CVE-2017-12617TomcatApache Tomcat Remote Code Execution VulnerabilityUnknownCWE-434
CVE-2017-12615TomcatApache Tomcat on Windows Remote Code Execution VulnerabilityKnownCWE-434
CVE-2013-2251StrutsApache Struts Improper Input Validation VulnerabilityUnknownCWE-20
CVE-2020-1938TomcatApache Tomcat Improper Privilege Management VulnerabilityUnknownnone listed
CVE-2017-9791Struts 1Apache Struts 1 Improper Input Validation VulnerabilityUnknownCWE-20
CVE-2016-3088ActiveMQApache ActiveMQ Improper Input Validation VulnerabilityUnknownCWE-20
CVE-2012-0391Struts 2Apache Struts 2 Improper Input Validation VulnerabilityUnknownCWE-20
CVE-2006-1547Struts 1Apache Struts 1 ActionForm Denial-of-Service VulnerabilityUnknownnone listed
CVE-2020-13927Airflow's Experimental APIApache Airflow's Experimental API Authentication BypassUnknownCWE-1188, CWE-306
CVE-2020-11978AirflowApache Airflow Command InjectionUnknownCWE-78
CVE-2021-44228Log4j2Apache Log4j2 Remote Code Execution VulnerabilityKnownCWE-20, CWE-400, CWE-502
CVE-2019-0193SolrApache Solr DataImportHandler Code Injection VulnerabilityUnknownCWE-94
CVE-2021-40438ApacheApache HTTP Server-Side Request Forgery (SSRF)KnownCWE-918
CVE-2021-42013HTTP ServerApache HTTP Server Path Traversal VulnerabilityKnownCWE-22
CVE-2021-41773HTTP ServerApache HTTP Server Path Traversal VulnerabilityKnownCWE-22
CVE-2020-17530StrutsApache Struts Remote Code Execution VulnerabilityUnknownCWE-917
CVE-2019-17558SolrApache Solr VelocityResponseWriter Plug-In Remote Code Execution VulnerabilityUnknownCWE-74
CVE-2019-0211HTTP ServerApache HTTP Server Privilege Escalation VulnerabilityUnknownCWE-416
CVE-2018-11776StrutsApache Struts Remote Code Execution VulnerabilityUnknownCWE-20
CVE-2017-9805StrutsApache Struts Deserialization of Untrusted Data VulnerabilityUnknownCWE-502
CVE-2017-5638StrutsApache Struts Remote Code Execution VulnerabilityKnownCWE-20
CVE-2016-4437ShiroApache Shiro Code Execution VulnerabilityUnknownCWE-284

Cite this

CISA's Known Exploited Vulnerabilities catalog lists 40 Apache vulnerabilities (2.3% of all entries). Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/vendors/apache/

Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23. Vendor names are CISA's vendorProject strings; Telemetry states no facts about Apache beyond this data.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings
g aGo to API