Apache HTTP Server EUVD-2026-90901

Requires Apache HTTP Server (through 2.4.68) deployed specifically as a FORWARD proxy (ProxyRequests On) with mod_proxy_ftp enabled to proxy FTP traffic, AND the proxy must be made to connect to an untrusted/attacker-controlled FTP server (e.g., a client fetching an attacker's ftp:// URL through the proxy). Limiting factors: default Apache installations do NOT enable forward proxying or mod_proxy_ftp, so stock configurations are not exposed; exploitation depends on the proxy initiating an FTP session to an untrusted server, and the direct technical impact is redirecting the proxy's data connection rather than compromising the proxy host itself.

No CVSS vector, EPSS score, KEV entry, or POC was provided in the input, so several key prioritization signals are missing and authentication requirements cannot be confirmed from the supplied data (input CVSS is N/A). Based on the description alone, this is a connection-redirection / SSRF-style flaw (CWE-284, improper access control) in mod_proxy_ftp: an untrusted FTP server returns a crafted PASV reply that makes the proxy open a data connection to an arbitrary third-party host. The real-world risk is sharply constrained by configuration: it only applies to Apache httpd acting as a FORWARD proxy with mod_proxy_ftp handling FTP, which is an uncommon deployment - so despite Apache's ubiquity this is far from a universal exposure. Exploitation status is 'no public exploit identified at time of analysis' (no KEV, no POC in input). This looks like a genuinely low-to-moderate real-world priority rather than a high-urgency issue: the affected product is ubiquitous but the vulnerable configuration is rare, the impact is primarily the ability to coerce the proxy into connecting to attacker-chosen hosts (internal-network reachability/port-probing) rather than direct code execution, and there is no evidence of active exploitation. The 'Authentication Bypass' tag appears mislabeled - the behavior is proxy connection redirection, not a bypass of authentication.

An organization runs Apache httpd as a forward proxy with FTP proxying (mod_proxy_ftp) enabled; a client is induced to fetch an ftp:// URL on an attacker-controlled FTP server. The malicious server replies to PASV with a crafted address whose host/port the proxy fails to validate, causing the proxy to open a data connection to an arbitrary third-party host - enabling the proxy to be used to reach internal services or probe hosts the attacker could not reach directly. No public exploit code is identified in the provided data.