Apache HTTP Server CVE-2026-119618 + 10 more

This digest covers Apache HTTP Server 2.4.71 (released November 11, US time) and the high-severity fixes published on November 10 by Fortinet, Ivanti and SAP, picked for relevance to small and mid-sized businesses. The top item is Apache HTTP Server CVE-2026-119618 (heap corruption in mod_http2 that can lead to remote code execution). Apache rates it critical; versions 2.4.55 through 2.4.70 are affected and the fix is 2.4.71. If you expose an Apache server with HTTP/2 enabled to the internet, prioritize the update.

We found no primary-source statement that any item in today's list is being exploited (Fortinet lists "Known exploited: No" for all three of its advisories, and CISA's KEV catalog has no additions dated November 11 or later). Still, all of them are high-severity issues reachable without authentication: Ivanti Endpoint Manager CVE-2026-121653 (CVSS 9.8), three Fortinet FortiMail/FortiOS items (CVSS 9.3-9.8), and four SAP items rated CVSS 10.0. Only organizations that use the affected products need to act. Chrome, Outlook, Barracuda, OpenSSH and other items covered earlier are not repeated here.

CVE-2026-119618 is a concurrency flaw (improper synchronization of a shared resource) in assign_headers() of mod_http2. Apache's advisory describes it as heap corruption and remote code execution (RCE). Because it sits in HTTP/2 request handling, an internet-facing Apache with HTTP/2 enabled can be reached by external requests. Apache rates it critical. NVD had no CVSS score for it at the time of writing.

Affected are Apache HTTP Server 2.4.55 through 2.4.70. If you installed mod_h2 separately from GitHub, versions 2.0.8 through 2.0.42 are affected. The fix is 2.4.71 (released November 11). The advisory credits Anthropic's OSS Scanner and two researchers from Google Cloud Vulnerability Research. Apache's page lists no workaround and no exploitation.

The same 2.4.71 release fixes two more. CVE-2026-106023 is a NULL pointer dereference in mod_md (automatic certificate handling) that can crash a child process during request handling (important; 2.4.30-2.4.70). CVE-2026-109163 is a one-byte stack buffer overwrite in mod_vhost_alias, rated low, affecting 2.4.69-2.4.70.

To check, first confirm the version, then see whether the HTTP/2 module is loaded.

Linux distributions sometimes backport a fix without changing the version number, so a httpd -v result of 2.4.70 or earlier does not always mean the package is unpatched. Check the package changelog for the CVE number. Detailed steps are in Apache HTTP Server CVE-2026-119618: impact check and fix. For another recent HTTP/2-related issue, see Brotli CVE-2026-111497 (HTTP/2 Shell). Source: Apache HTTP Server 2.4 vulnerabilities.

An SQL injection in the Core of Ivanti Endpoint Manager (EPM, a tool for managing company PCs) could let a remote, unauthenticated attacker achieve remote code execution. CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N), the value Ivanti registered as CNA and NVD lists. Versions before 2024 SU8 are affected; the fix is 2024 SU8.

On exploitation, CISA's SSVC assessment as of November 11 was exploitation: none, and the CVE is not in KEV. Note that we could not read the Ivanti advisory page itself during verification, so the version range is based on the CVE record that Ivanti registered, as shown in NVD. If you use EPM, check your console version and confirm the latest advisory on Ivanti's site. Sources: NVD CVE-2026-121653, Ivanti advisory.

On November 10, Fortinet's PSIRT published three Critical advisories. For all three, Fortinet lists "Known exploited: No" and no workaround.

FortiMail CVE-2026-126147 (FG-IR-26-199) is a path traversal in the API that may let an unauthenticated attacker execute code or commands via crafted requests (CVSS 9.8). Affected: 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, and all 7.2 versions. Fixed in 8.0.2, 7.6.7 and 7.4.9 or later. There is no fixed 7.2 release; Fortinet advises migrating to a fixed release. CVE-2026-126148 (FG-IR-26-200) is a command injection in the CLI; according to NVD it is triggered by crafted HA (high availability) join-request packets (CVSS 9.8). Affected: 8.0.0-8.0.1 and 7.6.0-7.6.6; 7.4 and 7.2 are not affected. Fixed in 8.0.2 and 7.6.7 or later. Fortinet says FortiMail Cloud was already remediated on October 5, so cloud customers need no action.

FortiOS CVE-2026-126253 (FG-IR-26-267) is an authentication bypass; NVD says an unauthenticated attacker may broadcast LSA (routing advertisement) data via a crafted request. CVSS 3.1 is 9.3 with an adjacent-network attack vector (AV:A), so the attacker must be on the same network rather than the internet. Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.12, 7.2.0-7.2.13 and 7.0.1-7.0.19. Fixed in 8.0.2, 7.6.8, 7.4.13 and 7.2.14 or later; for 7.0, migrate to a fixed release. Some FortiSASE versions are also affected; the 26.3 line is remediated in 26.3.2.

FortiMail handles inbound company email, so if you run it, check the firmware version in the admin console and ask your maintenance vendor about the update schedule. For FortiGate (FortiOS), Fortinet's upgrade tool shows the recommended upgrade path. Sources: FG-IR-26-199, FG-IR-26-200, FG-IR-26-267.

At its November 10 Security Patch Day, SAP published four Critical notes rated CVSS 10.0. All are reachable over the network without authentication, and NVD lists the CVSS 3.1 values SAP registered as CNA. SAP's page does not say whether any is exploited. The affected systems are ABAP-based SAP environments, so the check applies to companies that run SAP themselves or use it through a cloud or maintenance provider.

- CVE-2026-76964: SAP NetWeaver AS ABAP, Internet Communication Manager (ICM). Insufficient validation of network input causes memory corruption that may lead to arbitrary code execution. SAP Note 3778530. Affected kernels: KRNL64UC 7.53; KERNEL 7.53 / 7.54 / 7.77 / 7.93 / 9.16 / 9.18 / 9.20
- CVE-2026-89126: SAP Web Dispatcher. Likewise memory corruption that may allow arbitrary code execution. SAP Note 3778556. Affected components include WEBDISP 7.53-9.16 and KERNEL 7.53-9.20
- CVE-2026-89103: SAP Gateway. The default Access Control List (ACL) is activated with high privileges, so an external attacker may be treated as an internal application server. SAP Note 3798345
- CVE-2026-120017: SAML2 Service Provider in SAP NetWeaver AS ABAP and ABAP Platform. Authentication assertions are not sufficiently verified; under certain configurations an attacker may bypass authentication and impersonate users, including privileged accounts. SAP Note 3849308. Affected: SAP_BASIS 702-922 releases

Fix details and steps are in the SAP Notes, which require an SAP support account to read. Ask your SAP administrator or implementation vendor whether the four notes above have been applied. Sources: SAP Security Patch Day, November 2026, NVD CVE-2026-76964.

- Ask your maintenance staff or vendor whether your web servers run Apache (httpd)
- If so, have them confirm the version is 2.4.71 or later, or that the distributor has fixed CVE-2026-119618
- Check whether you use Ivanti Endpoint Manager to manage PCs; if so, confirm it is 2024 SU8 or later
- If you use FortiMail or FortiGate, check the firmware version and ask your vendor about the update schedule
- If you use SAP, ask the platform team about the status of Notes 3778530, 3778556, 3798345 and 3849308
- For any of these products, also confirm admin consoles and management ports are not exposed to the internet
- For products you do not use, record them as "checked, no action needed"

- Apache HTTP Server CVE-2026-119618: impact check and fix
- Brotli CVE-2026-111497 (HTTP/2 Shell): check and fix
- Previous digest (Chrome and more)
- Patch and update management guide for small businesses
- Vulnerability assessment cost guide

- Apache HTTP Server 2.4 vulnerabilities: https://httpd.apache.org/security/vulnerabilities_24.html
- NVD CVE-2026-119618: https://nvd.nist.gov/vuln/detail/CVE-2026-119618
- NVD CVE-2026-121653: https://nvd.nist.gov/vuln/detail/CVE-2026-121653
- Ivanti advisory: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-November-2026?language=en_US
- Fortinet FG-IR-26-199: https://fortiguard.fortinet.com/psirt/FG-IR-26-199
- Fortinet FG-IR-26-200: https://fortiguard.fortinet.com/psirt/FG-IR-26-200
- Fortinet FG-IR-26-267: https://fortiguard.fortinet.com/psirt/FG-IR-26-267
- SAP Security Patch Day, November 2026: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html
- NVD CVE-2026-76964: https://nvd.nist.gov/vuln/detail/CVE-2026-76964
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog