Apache HTTP Server EUVD-2026-90900

Requires the target Apache HTTP Server (2.4.0-2.4.68) to be running mod_ssl AND to have access control configured via the SSLRequire directive using file-related expressions - this is a non-default, operator-chosen configuration. Servers that do not use SSLRequire, or that use it without file-related expressions, are not affected. The principal limiting factor is therefore this specific configuration prerequisite; because no CVSS vector is provided, authentication requirements for the attacker are not confirmed from available data.

This is an Improper Privilege Management flaw (CWE-269) in Apache HTTP Server's mod_ssl, specifically in the evaluation of SSLRequire directives that use file-related expressions, affecting versions 2.4.0 through 2.4.68. No CVSS score or vector is provided in the input, so attack vector, complexity, and privilege requirements cannot be confirmed quantitatively and must be inferred from the description. No EPSS score is supplied, the CVE is NOT on the CISA KEV list, and there is no public POC indicated - exploitation status is therefore 'no public exploit identified at time of analysis.' The real-world risk is strongly gated by configuration: the vulnerable code path only matters when an administrator has deliberately deployed SSLRequire with file-referencing expressions for access control, which is a non-default and relatively uncommon configuration. Consequently, despite Apache httpd being one of the most ubiquitous web servers in the world, the realistic exposure for this specific issue is narrow, and it reads as a lower-urgency, config-dependent access-control weakness rather than a mass-exploitable critical flaw. No vendor CVSS severity is available to corroborate this, so defenders relying on severity-based triage should treat the missing score as a gap and consult the Apache advisory directly.

An administrator has configured mod_ssl access control using SSLRequire with file-related expressions to restrict access to protected resources. A client that should be denied leverages the improper privilege-management flaw in how these expressions are evaluated to bypass the intended access restriction or gain access/privileges it should not have. No public exploit code has been identified, and the attack is only possible against servers using this specific access-control configuration.