Apache Traffic Server EUVD-2026-107535

Exploitation requires that the target Apache Traffic Server deployment has loaded and enabled the experimental tsmemcache plugin, which exposes a memcache-style network interface to the shared proxy cache; this plugin is explicitly 'experimental' and is NOT enabled in a default ATS installation - this is the single most important limiting factor and is reflected by AT:P in the CVSS 4.0 vector. Once the plugin's interface is network-reachable, no authentication, privileges, or user interaction are required (PR:N/UI:N), so any attacker who can connect to the exposed port can read, write, and delete cache entries. Limiting factors for defenders: the non-default experimental plugin must be in use, and the interface must be reachable from the attacker's network position; affected version must be in the ranges 8.0.0-8.1.11, 9.0.0-9.2.15, 10.0.0-10.1.4, or 10.2.0.

Signals mostly align toward high severity but with one important mitigating condition. The CVSS 4.0 base score of 9.4 reflects a network vector (AV:N), low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N), with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) - consistent with CWE-306 (Missing Authentication) allowing unauthenticated read, write, and delete of the shared proxy cache. The critical nuance is AT:P (Attack Requirements: Present), which signals that exploitation depends on a specific deployment condition: the plugin involved is explicitly described as 'experimental' (tsmemcache) and is not part of a default Apache Traffic Server configuration. No EPSS score was provided, this CVE is NOT listed in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. Net assessment: this is a genuinely serious, low-complexity unauthenticated flaw for the subset of operators who have explicitly enabled the experimental tsmemcache plugin, but the real-world attack surface is narrowed sharply by that non-default dependency - treat as high priority for ATS operators who use tsmemcache, and routine patch management otherwise. Missing data to note: EPSS probability is absent, and the odd input CVSS 4.0 subsequent-system metrics (SC:N/SI:N/SA:H) are internally inconsistent (availability impact on a subsequent system with no other subsequent impact) and should be verified against the Apache advisory.

An Apache Traffic Server operator has enabled the experimental tsmemcache plugin, exposing a memcache-style interface on the network with no authentication. A remote attacker who can reach that port sends unauthenticated commands to read sensitive cached responses, overwrite entries to poison the cache served to all downstream users, or delete entries to disrupt service. No public exploit code is identified at time of analysis, but the attack requires no credentials or user interaction once the plugin is reachable.