What Happened
A critical vulnerability in Apache HTTP Server's HTTP/2 module, mod_http2, could let an unauthenticated attacker run code on the server. The Apache HTTP Server HTTP/2 vulnerability is tracked as CVE-2026-119618 and affects versions 2.4.55 through 2.4.70. The fix is version 2.4.71.
BleepingComputer reports the flaw could be exploited by an unauthenticated attacker to obtain remote code execution. SecurityWeek reports it was found by Anthropic and Google. Only servers with HTTP/2 enabled are affected, according to Red Hat, which ships Apache HTTP Server as part of Red Hat Enterprise Linux.
Nothing in the sources states that CVE-2026-119618 has been exploited in the wild. That affects the urgency of the response, not whether you respond. A fixed version exists and the vulnerable range is wide, so the work is a patch campaign rather than a fire drill.
What the Apache HTTP Server HTTP/2 Vulnerability Costs an MSP
Remote code execution on an internet-facing web server is expensive to unwind. In general, an attacker who runs code as the web server process gets what that process can reach: the site's content, its configuration, credentials stored beside it, and any network path the host can reach. In general, cleanup means rebuilding the host rather than deleting a file, then restoring content and confirming nothing else changed.
The MSP cost is technician time and client trust. An inventory pass, a maintenance window, a rebuild and a restore each take hours that were not scoped. A client whose site went down will ask what you knew and when. Keeping an accurate exposure list is a standing practice, and it is what turns a patch like this into a scheduled task rather than an emergency.
Timeline
- 2026-11-12: Hacker News publishes a report stating the flaw affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71.
- 2026-11-12: SecurityWeek reports the mod_http2 race condition and credits Anthropic and Google with finding it.
- 2026-11-12: BleepingComputer reports that an unauthenticated attacker could obtain remote code execution.
- 2026-11-12: Ubuntu publishes security notice USN-9090-1, which covers CVE-2026-119618 alongside other Apache HTTP Server issues.
Who Is Affected
Any server running Apache HTTP Server versions 2.4.55 through 2.4.70 with HTTP/2 enabled is exposed. Servers in that range with HTTP/2 turned off are not affected, according to Red Hat.
Ubuntu's security notice states that the mod_http2 issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. Red Hat ships Apache HTTP Server as part of Red Hat Enterprise Linux.
For an MSP, the exposure list is every internet-facing web server in every client environment, plus internal servers with HTTP/2 enabled that an attacker can reach. The version range is wide enough that long-lived builds sit inside it.
Technical Details
CVE-2026-119618 is a critical vulnerability in Apache HTTP Server's HTTP/2 module, mod_http2. It affects Apache HTTP Server versions 2.4.55 through 2.4.70. The fix is Apache HTTP Server version 2.4.71.
SecurityWeek describes the flaw as a race condition in mod_http2 that could let unauthenticated attackers execute code on servers with HTTP/2 enabled. Ubuntu's security notice describes mod_http2 incorrectly handling certain request headers, leading to heap corruption. Ubuntu states that a remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service, or possibly execute arbitrary code.
The attack vector is remote and unauthenticated. A server in the affected version range with HTTP/2 enabled and reachable over the network is the target.
What MSPs Should Do
Patch first. Version 2.4.71 is the fixed release, and everything else here is triage until that window opens.
- Upgrade Apache HTTP Server to version 2.4.71. This is the action the sources give.
- Inventory every Apache HTTP Server across client environments. Record the version and whether HTTP/2 is enabled. You cannot prioritise what you have not listed.
- Patch internet-facing servers first, then internal ones. Standing practice is to treat the hosts an attacker can reach today as the priority.
- Where a client does not need HTTP/2, turning the module off removes the exposure while the upgrade is scheduled. Red Hat states that only servers with HTTP/2 enabled are affected.
- Apply the update from the source the server came from. Distributions ship their own builds, and Ubuntu has published USN-9090-1 for this CVE alongside other Apache HTTP Server issues.
- Restart the service after the upgrade and confirm that the running version is 2.4.71.
- As a standing practice after any remote code execution patch on an internet-facing host, review access and error logs for the period it ran the vulnerable version, and look for unexpected files or processes.
How EnterProtect Helps
EnterProtect backup keeps clean, restorable copies of client data, so a rebuild after a compromise has something trustworthy to restore from. EnterProtect recovery gets a client running again when a host has to be rebuilt rather than cleaned in place. EnterProtect vulnerability scanning surfaces exposed software versions across client environments, so patch work is driven by a current list.
Frequently Asked Questions
What Is CVE-2026-119618?
CVE-2026-119618 is a critical vulnerability in Apache HTTP Server's HTTP/2 module, mod_http2. It affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71. SecurityWeek describes it as a race condition that could let unauthenticated attackers execute code.
Which Apache HTTP Server Versions Are Affected?
Apache HTTP Server versions 2.4.55 through 2.4.70 are affected. Only servers with HTTP/2 enabled are exposed, according to Red Hat. The fix is version 2.4.71.
Do I Need HTTP/2 Enabled for This to Be Exploitable?
Yes. According to Red Hat, only servers with HTTP/2 enabled are affected. A server in the affected range with HTTP/2 turned off is not exposed by this flaw. Where a client does not need HTTP/2, disabling the module reduces exposure while you schedule the upgrade.
Has CVE-2026-119618 Been Exploited in the Wild?
No source in this report states that this flaw has been exploited in the wild. That is not a reason to delay patching an internet-facing host. A fixed version exists and the vulnerable range is wide.
What Should I Do If I Cannot Patch Immediately?
Red Hat states that only servers with HTTP/2 enabled are affected, so turning HTTP/2 off removes that exposure for the wait. Upgrade to version 2.4.71 as soon as a window allows. Standing practice is to treat internet-facing hosts first.
Which Linux Distributions Have Published Fixes?
Ubuntu has published security notice USN-9090-1, which covers CVE-2026-119618 alongside other Apache HTTP Server issues. Red Hat ships Apache HTTP Server as part of Red Hat Enterprise Linux. Take the update from the source your server came from.
Sources
- Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely (Hackernews)
- Apache Patches Critical HTTP Server RCE Found by Anthropic, Google (Securityweek)
- Apache HTTP Server patches critical HTTP/2 remote code execution flaw (Bleepingcomputer)
- USN-9090-1: Apache HTTP Server vulnerabilities (Ubuntu Security)