# Akamai: Customer Security Advisory: Remote code execution vulnerability in the Apache HTTP Server's HTTP/2 module

> Akamai reports a remote code execution vulnerability in the Apache HTTP Server HTTP/2 module, tracked as CVE-2026-119618. The affected versions are Apache HTTP Server 2.4.55 through 2.4.70 with HTTP/2 enabled. Akamai is investigating the possible impact on the Akamai platform and infrastructure.

- Provider: [Akamai](https://outages.live/akamai.md)
- Type: Incident
- State: investigating
- Worst impact: Major outage
- Started: 2026-11-13 09:13 UTC
- Components: Customer Security Advisory, Customer Service, Documentation and Community - Customer Security Advisory
- Official update: https://stspg.io/922154lrzy5x

## Updates from Akamai

### investigating, 2026-11-13 09:15 UTC

Akamai is aware of the recently published remote code execution (RCE) vulnerability in the Apache HTTP Server's HTTP/2 module (CVE-2026-119618). Our subject matter experts (SMEs) are actively investigating its potential impact across our platform and infrastructure. If the vulnerability is exploited, unauthenticated remote attackers can trigger heap corruption and potentially execute arbitrary code with the privileges of the web server process. The affected versions are Apache HTTP Server versions 2.4.55 through 2.4.70 (only servers with HTTP/2 enabled are affected). We will post more details for customers and partners with a valid Control Center login at https://community.akamai.com/customers/s/feed/0D5a700001ewU8ICAU as additional information becomes available. If you have questions or are experiencing an impact due to this issue, please use the Support Center in the Akamai Community or Akamai Control Center to contact Akamai Technical Support. Contact information is available at htt