Apache patches critical HTTP/2 flaw in server version 2.4.71

Apache released the fix on November 11th. Wiz estimates that 64% of cloud environments Wiz measures contain affected resources and 51% have publicly exposed instances, without accounting for configuration.

By · Published

A WIZ Threat Update notice reads “Critical RCE Vulnerability in Apache HTTP Server” and “CVE-2026-119618.”

Apache released the fix on November 11th. Wiz estimates that 64% of cloud environments Wiz measures contain affected resources and 51% have publicly exposed instances, without accounting for configuration.