Apache Traffic Server EUVD-2026-50167

Exploitation requires network access to a running Apache Traffic Server instance (9.0.0-9.1.14 or 10.0.0-10.1.3) and, per the CVSS 4.0 attack requirement (AT:P), a specific server-side condition outside the attacker's control that must hold for the access-control bypass to succeed; the supplied advisory reference does not enumerate that exact condition, so it must be confirmed from the Apache thread (https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d). What LIMITS exploitation: the AT:P requirement means it is not universally exploitable against every default deployment, and impact is confined to downstream/subsequent systems the proxy fronts (SC:H/SI:H) rather than the proxy host itself. No authentication (PR:N) and no user interaction (UI:N) are needed once the required condition is met.

The CVSS 4.0 base score of 7.0 (High) reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-user-interaction (UI:N) issue, tempered by an attack requirement (AT:P) indicating some non-attacker-controlled condition must hold for exploitation. Impact is scoped entirely to downstream/subsequent systems (SC:H/SI:H, SA:N) with no direct impact on the proxy itself (VC/VI/VA:N), consistent with an access-control bypass that exposes protected backends. No EPSS score was provided, there is no POC in the supplied data, and it is not in CISA KEV - so exploitation is not confirmed and no public exploit is identified. The AT:P requirement is the key uncertainty: the single Apache mailing-list advisory reference does not spell out the precise triggering condition in the supplied data, so defenders should retrieve the advisory to determine whether their configuration meets the exploitation prerequisite before deprioritizing. Overall this is a genuine High-priority patching item for exposed ATS instances, but not an emergency-grade actively-exploited flaw on current evidence.

An attacker who can reach an exposed Apache Traffic Server instance sends crafted requests that exploit the improper access-control check, causing the proxy to grant access it should have denied and forward or expose requests to protected backend resources. Given AV:N/AC:L/PR:N, the request path requires no authentication or user interaction, though the AT:P attack requirement means a specific server-side condition must be present. No public POC is identified at time of analysis.