Apache: every exploited CVE on CISA KEV
All 41 Apache bugs attackers are confirmed to be using, with attack scores and free detection rules.
Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.
41
Apache bugs on CISA’s exploited list
3 added in 2026.
8
are linked to ransomware
Every Apache vulnerability the US government has confirmed attackers are using, newest first, with each bug’s EPSS (predicted attack chance) and VEDAS (exploit evidence) scores and any free Nuclei or Suricata detection rule. US federal agencies must fix KEV-listed bugs by a deadline; everyone else should treat the list as “patch first”.
| Added | CVE | Product | Bug | EPSS | VEDAS | Detection rule | Ransomware |
|---|---|---|---|---|---|---|---|
| 2026-10-08 | CVE-2016-3081 | Apache Struts | Apache Struts Command Injection Vulnerability | 0.97 | 0.99 | Nuclei · Suricata | No |
| 2026-08-04 | CVE-2026-34486 | Apache Tomcat | Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | 0.99 | 0.98 | None yet | No |
| 2026-04-16 | CVE-2026-34197 | Apache ActiveMQ | Apache ActiveMQ Improper Input Validation Vulnerability | 0.98 | 0.99 | Nuclei · Suricata | No |
| 2025-05-01 | CVE-2024-38475 | Apache HTTP Server | Apache HTTP Server Improper Escaping of Output Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | No |
| 2025-04-01 | CVE-2025-24813 | Apache Tomcat | Apache Tomcat Path Equivalence Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | No |
| 2025-02-04 | CVE-2024-45195 | Apache OFBiz | Apache OFBiz Forced Browsing Vulnerability | 1.00 | 0.99 | Nuclei · Suricata | No |
| 2024-09-18 | CVE-2024-27348 | Apache HugeGraph-Server | Apache HugeGraph-Server Improper Access Control Vulnerability | 0.99 | 0.98 | Nuclei · Suricata | No |
| 2024-08-27 | CVE-2024-38856 | Apache OFBiz | Apache OFBiz Incorrect Authorization Vulnerability | 0.99 | 0.98 | Nuclei · Suricata | No |
| 2024-08-07 | CVE-2024-32113 | Apache OFBiz | Apache OFBiz Path Traversal Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | No |
| 2024-05-23 | CVE-2020-17519 | Apache Flink | Apache Flink Improper Access Control Vulnerability | 0.98 | 0.98 | Nuclei · Suricata | No |
| 2024-01-08 | CVE-2023-27524 | Apache Superset | Apache Superset Insecure Default Initialization of Resource Vulnerability | 0.98 | 0.98 | Nuclei · Suricata | No |
| 2023-11-02 | CVE-2023-46604 | Apache ActiveMQ | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability | 1.00 | 0.98 | None yet | Yes |
| 2023-09-06 | CVE-2023-33246 | Apache RocketMQ | Apache RocketMQ Command Execution Vulnerability | 0.97 | 0.99 | Nuclei · Suricata | No |
| 2023-05-12 | CVE-2016-8735 | Apache Tomcat | Apache Tomcat Remote Code Execution Vulnerability | 0.90 | 0.99 | None yet | No |
| 2023-05-01 | CVE-2021-45046 | Apache Log4j2 | Apache Log4j2 Deserialization of Untrusted Data Vulnerability | 1.00 | 0.99 | Nuclei · Suricata | Yes |
| 2023-03-07 | CVE-2022-33891 | Apache Spark | Apache Spark Command Injection Vulnerability | 0.93 | 0.99 | Nuclei · Suricata | No |
| 2022-08-25 | CVE-2022-24706 | Apache CouchDB | Apache CouchDB Insecure Default Initialization of Resource Vulnerability | 0.93 | 0.98 | Nuclei · Suricata | No |
| 2022-08-25 | CVE-2022-24112 | Apache APISIX | Apache APISIX Authentication Bypass Vulnerability | 0.96 | 0.99 | Nuclei · Suricata | No |
| 2022-03-25 | CVE-2020-1956 | Apache Kylin | Apache Kylin OS Command Injection Vulnerability | 0.97 | 0.98 | Nuclei · Suricata | No |
| 2022-03-25 | CVE-2017-12617 | Apache Tomcat | Apache Tomcat Remote Code Execution Vulnerability | 1.00 | 0.99 | Nuclei · Suricata | No |
| 2022-03-25 | CVE-2017-12615 | Apache Tomcat | Apache Tomcat on Windows Remote Code Execution Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | Yes |
| 2022-03-25 | CVE-2013-2251 | Apache Struts | Apache Struts Improper Input Validation Vulnerability | 1.00 | 0.99 | Nuclei · Suricata | No |
| 2022-03-03 | CVE-2020-1938 | Apache Tomcat | Apache Tomcat Improper Privilege Management Vulnerability | 0.99 | 0.99 | Nuclei · Suricata | No |
| 2022-02-10 | CVE-2017-9791 | Apache Struts 1 | Apache Struts 1 Improper Input Validation Vulnerability | 0.99 | 0.99 | Nuclei · Suricata | No |
| 2022-02-10 | CVE-2016-3088 | Apache ActiveMQ | Apache ActiveMQ Improper Input Validation Vulnerability | 0.99 | 0.99 | Nuclei · Suricata | No |
| 2022-01-21 | CVE-2012-0391 | Apache Struts 2 | Apache Struts 2 Improper Input Validation Vulnerability | 0.76 | 0.99 | Nuclei · Suricata | No |
| 2022-01-21 | CVE-2006-1547 | Apache Struts 1 | Apache Struts 1 ActionForm Denial-of-Service Vulnerability | 0.55 | 0.84 | None yet | No |
| 2022-01-18 | CVE-2020-13927 | Apache Airflow’s Experimental API | Apache Airflow’s Experimental API Authentication Bypass | 1.00 | 0.99 | Nuclei · Suricata | No |
| 2022-01-18 | CVE-2020-11978 | Apache Airflow | Apache Airflow Command Injection | 0.99 | 0.99 | Nuclei · Suricata | No |
| 2021-12-10 | CVE-2021-44228 | Apache Log4j2 | Apache Log4j2 Remote Code Execution Vulnerability | 1.00 | 1.00 | Nuclei · Suricata | Yes |
| 2021-12-10 | CVE-2019-0193 | Apache Solr | Apache Solr DataImportHandler Code Injection Vulnerability | 0.84 | 0.98 | Nuclei · Suricata | No |
| 2021-12-01 | CVE-2021-40438 | Apache Apache | Apache HTTP Server-Side Request Forgery (SSRF) | 1.00 | 0.98 | Nuclei · Suricata | Yes |
| 2021-11-03 | CVE-2021-42013 | Apache HTTP Server | Apache HTTP Server Path Traversal Vulnerability | 1.00 | 0.99 | Nuclei · Suricata | Yes |
| 2021-11-03 | CVE-2021-41773 | Apache HTTP Server | Apache HTTP Server Path Traversal Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | Yes |
| 2021-11-03 | CVE-2020-17530 | Apache Struts | Apache Struts Remote Code Execution Vulnerability | 0.96 | 0.99 | Nuclei · Suricata | No |
| 2021-11-03 | CVE-2019-17558 | Apache Solr | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability | 0.99 | 0.99 | Nuclei · Suricata | No |
| 2021-11-03 | CVE-2019-0211 | Apache HTTP Server | Apache HTTP Server Privilege Escalation Vulnerability | 0.65 | 0.99 | Out of scope (local) | No |
| 2021-11-03 | CVE-2018-11776 | Apache Struts | Apache Struts Remote Code Execution Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | No |
| 2021-11-03 | CVE-2017-9805 | Apache Struts | Apache Struts Deserialization of Untrusted Data Vulnerability | 0.99 | 0.99 | Nuclei · Suricata | No |
| 2021-11-03 | CVE-2017-5638 | Apache Struts | Apache Struts Remote Code Execution Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | Yes |
| 2021-11-03 | CVE-2016-4437 | Apache Shiro | Apache Shiro Code Execution Vulnerability | 0.93 | 0.99 | Nuclei · Suricata | No |
Industry partners
