CVE-2026-47360

⚠️ high

Summary

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

CVSS Score

7.5

High

EPSS Score

0.4

Exploit Probability

Published Date

2026-10-01

First Seen: 2026-10-04

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 67.8% of all 365,863 vulnerabilities in our database.

#117,960

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Oct 1, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

lokerxx

SSVC data provided by CISA

Last Modified 2026-10-02

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE IDs (Weakness Types)

CWE-200

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
apache	http_server	Affected	> 2.4.60 < 2.4.69

🔗 References 2

https://httpd.apache.org/security/vulnerabilities_24...

Vendor Advisory

http://www.openwall.com/lists/oss-security/2026/10/0...

Mailing List Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-42356	ℹ️ low	3.7	0.5	Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI pr...	2026-10-01
CVE-2026-42528	🔶 medium	4.3	0.4	A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebD...	2026-10-01
CVE-2026-46729	⚠️ high	7.5	0.5	NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affe...	2026-10-01
CVE-2026-48005	⚠️ high	7.5	0.6	Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all p...	2026-10-01
CVE-2026-56153	⚠️ high	7.5	0.5	Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: fr...	2026-10-01
CVE-2026-56154	⛔ critical	9.8	0.6	Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue a...	2026-10-01

These CVEs affect the same products