Apache HTTP Server EUVD-2026-90886

Exploitation requires a very specific configuration and runtime state: (1) the request must reach a directory explicitly enabled for CGI execution; (2) a CGI program must perform an internal redirect whose target the attacker can influence; and (3) that redirect target must have no file extension that mod_mime understands, so Apache falls back to treating it as CGI. These conditions limit exploitation sharply - it does not affect default static-content configurations and depends on the deployment actually running CGI with redirect-emitting programs, which is why CVSS rates it AC:H. The impact is confined to a limited integrity effect (unintended handler execution); no authentication is required (PR:N), but the narrow preconditions make opportunistic or automated exploitation impractical (SSVC Automatable=no).

This is a genuinely low-priority issue despite being network-exploitable. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base 3.7) shows network vector with no privileges or user interaction, but high attack complexity (AC:H) and only a limited integrity impact (I:L) with no confidentiality or availability impact. All corroborating signals agree it is low urgency: SSVC reports Exploitation=none, Automatable=no, and only partial Technical Impact; there is no CISA KEV listing and no public exploit identified. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quoted - but the combination of AC:H and the narrow preconditions (CGI-enabled directory, CGI-driven internal redirect, no mod_mime-understood extension on the target) strongly limits real-world exploitability. The AC:H rating is consistent with the description's requirement that attacker-influenced conditions align precisely. Net: a real but minor hardening issue in a ubiquitous product, not an emergency; patch during routine maintenance rather than out-of-band.

An attacker who can influence the target of an internal redirect issued by a CGI program could cause that target file to be handled as CGI and executed, provided the target already resides in a CGI-enabled directory and carries no extension recognized by mod_mime. No public exploit code is identified at time of analysis, and the high attack complexity means the attacker depends on a specific redirect behavior and directory layout being present.