Apache — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for Apache with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 41 Apache vulnerabilities confirmed as exploited in the wild across 21 products; 8 of them (20%) are flagged as used in known ransomware campaigns. Struts and Tomcat are tied as the most-affected products, with 6 entries each (15% of the total each). CISA added 3 entries in 2026 so far, compared with 3 in 2025. Across the 41 entries with an NVD CVSS score (100% of the total), the average score is 9.0; 24 entries are rated critical by NVD. The most recent addition is CVE-2016-3081 (Apache Struts Command Injection Vulnerability), added on 2026-10-08.
Affected products
| Product | Entries | Share |
|---|---|---|
| Struts | 6 | 15% |
| Tomcat | 6 | 15% |
| HTTP Server | 4 | 9.8% |
| ActiveMQ | 3 | 7.3% |
| OFBiz | 3 | 7.3% |
| Log4j2 | 2 | 4.9% |
| Struts 1 | 2 | 4.9% |
| Solr | 2 | 4.9% |
| HugeGraph-Server | 1 | 2.4% |
| Flink | 1 | 2.4% |
| Superset | 1 | 2.4% |
| RocketMQ | 1 | 2.4% |
| Spark | 1 | 2.4% |
| CouchDB | 1 | 2.4% |
| APISIX | 1 | 2.4% |
| Kylin | 1 | 2.4% |
| Struts 2 | 1 | 2.4% |
| Airflow | 1 | 2.4% |
| Airflow's Experimental API | 1 | 2.4% |
| Apache | 1 | 2.4% |
| Shiro | 1 | 2.4% |
Entries added per year
By date added to the KEV catalog
Exploited Apache vulnerabilities (41)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2016-3081 | Struts | Apache Struts Command Injection Vulnerability | 2026-10-08 | — | HIGH8.1 |
| CVE-2026-34486 | Tomcat | Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | 2026-08-04 | — | HIGH7.5 |
| CVE-2026-34197 | ActiveMQ | Apache ActiveMQ Improper Input Validation Vulnerability | 2026-04-16 | — | HIGH8.8 |
| CVE-2024-38475 | HTTP Server | Apache HTTP Server Improper Escaping of Output Vulnerability | 2025-05-01 | — | CRITICAL9.1 |
| CVE-2025-24813 | Tomcat | Apache Tomcat Path Equivalence Vulnerability | 2025-04-01 | — | CRITICAL9.8 |
| CVE-2024-45195 | OFBiz | Apache OFBiz Forced Browsing Vulnerability | 2025-02-04 | — | HIGH7.5 |
| CVE-2024-27348 | HugeGraph-Server | Apache HugeGraph-Server Improper Access Control Vulnerability | 2024-09-18 | — | CRITICAL9.8 |
| CVE-2024-38856 | OFBiz | Apache OFBiz Incorrect Authorization Vulnerability | 2024-08-27 | — | CRITICAL9.8 |
| CVE-2024-32113 | OFBiz | Apache OFBiz Path Traversal Vulnerability | 2024-08-07 | — | CRITICAL9.8 |
| CVE-2020-17519 | Flink | Apache Flink Improper Access Control Vulnerability | 2024-05-23 | — | HIGH7.5 |
| CVE-2023-27524 | Superset | Apache Superset Insecure Default Initialization of Resource Vulnerability | 2024-01-08 | — | HIGH8.9 |
| CVE-2023-46604 | ActiveMQ | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability | 2023-11-02 | Known | CRITICAL10.0 |
| CVE-2023-33246 | RocketMQ | Apache RocketMQ Command Execution Vulnerability | 2023-09-06 | — | CRITICAL9.8 |
| CVE-2016-8735 | Tomcat | Apache Tomcat Remote Code Execution Vulnerability | 2023-05-12 | — | CRITICAL9.8 |
| CVE-2021-45046 | Log4j2 | Apache Log4j2 Deserialization of Untrusted Data Vulnerability | 2023-05-01 | Known | CRITICAL9.0 |
| CVE-2022-33891 | Spark | Apache Spark Command Injection Vulnerability | 2023-03-07 | — | HIGH8.8 |
| CVE-2022-24706 | CouchDB | Apache CouchDB Insecure Default Initialization of Resource Vulnerability | 2022-08-25 | — | CRITICAL9.8 |
| CVE-2022-24112 | APISIX | Apache APISIX Authentication Bypass Vulnerability | 2022-08-25 | — | CRITICAL9.8 |
| CVE-2020-1956 | Kylin | Apache Kylin OS Command Injection Vulnerability | 2022-03-25 | — | HIGH8.8 |
| CVE-2017-12617 | Tomcat | Apache Tomcat Remote Code Execution Vulnerability | 2022-03-25 | — | HIGH8.1 |
| CVE-2017-12615 | Tomcat | Apache Tomcat on Windows Remote Code Execution Vulnerability | 2022-03-25 | Known | HIGH8.1 |
| CVE-2013-2251 | Struts | Apache Struts Improper Input Validation Vulnerability | 2022-03-25 | — | CRITICAL9.8 |
| CVE-2020-1938 | Tomcat | Apache Tomcat Improper Privilege Management Vulnerability | 2022-03-03 | — | CRITICAL9.8 |
| CVE-2017-9791 | Struts 1 | Apache Struts 1 Improper Input Validation Vulnerability | 2022-02-10 | — | CRITICAL9.8 |
| CVE-2016-3088 | ActiveMQ | Apache ActiveMQ Improper Input Validation Vulnerability | 2022-02-10 | — | CRITICAL9.8 |
| CVE-2006-1547 | Struts 1 | Apache Struts 1 ActionForm Denial-of-Service Vulnerability | 2022-01-21 | — | HIGH7.5 |
| CVE-2012-0391 | Struts 2 | Apache Struts 2 Improper Input Validation Vulnerability | 2022-01-21 | — | CRITICAL9.8 |
| CVE-2020-11978 | Airflow | Apache Airflow Command Injection | 2022-01-18 | — | HIGH8.8 |
| CVE-2020-13927 | Airflow's Experimental API | Apache Airflow's Experimental API Authentication Bypass | 2022-01-18 | — | CRITICAL9.8 |
| CVE-2019-0193 | Solr | Apache Solr DataImportHandler Code Injection Vulnerability | 2021-12-10 | — | HIGH7.2 |
| CVE-2021-44228 | Log4j2 | Apache Log4j2 Remote Code Execution Vulnerability | 2021-12-10 | Known | CRITICAL10.0 |
| CVE-2021-40438 | Apache | Apache HTTP Server-Side Request Forgery (SSRF) | 2021-12-01 | Known | CRITICAL9.0 |
| CVE-2017-9805 | Struts | Apache Struts Deserialization of Untrusted Data Vulnerability | 2021-11-03 | — | HIGH8.1 |
| CVE-2021-42013 | HTTP Server | Apache HTTP Server Path Traversal Vulnerability | 2021-11-03 | Known | CRITICAL9.8 |
| CVE-2021-41773 | HTTP Server | Apache HTTP Server Path Traversal Vulnerability | 2021-11-03 | Known | CRITICAL9.8 |
| CVE-2019-0211 | HTTP Server | Apache HTTP Server Privilege Escalation Vulnerability | 2021-11-03 | — | HIGH7.8 |
| CVE-2016-4437 | Shiro | Apache Shiro Code Execution Vulnerability | 2021-11-03 | — | CRITICAL9.8 |
| CVE-2019-17558 | Solr | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability | 2021-11-03 | — | HIGH7.5 |
| CVE-2020-17530 | Struts | Apache Struts Remote Code Execution Vulnerability | 2021-11-03 | — | CRITICAL9.8 |
| CVE-2017-5638 | Struts | Apache Struts Remote Code Execution Vulnerability | 2021-11-03 | Known | CRITICAL9.8 |
| CVE-2018-11776 | Struts | Apache Struts Remote Code Execution Vulnerability | 2021-11-03 | — | HIGH8.1 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.