rewindex

CompaniesAkamaiIncidents

Akamai: Customer Security Advisory: Remote code execution vulnerability in the Apache HTTP Server's HTTP/2 module

MinorStatus: investigatingeditedStarted Not resolved2 updateswww.akamaistatus.com (opens in new tab)

CVEs mentioned

Only CVEs the vendor’s text names by id, or that its notice says it is not affected by. A mention is not a statement that the vulnerability caused this incident.

Affected components: Customer Security AdvisoryCustomer Service, Documentation and Community - Customer Security Advisory

Timeline of updates

  1. investigating

    Akamai is aware of the recently published remote code execution (RCE) vulnerability in the Apache HTTP Server's HTTP/2 module (CVE-2026-119618). Our subject matter experts (SMEs) are actively investigating its potential impact across our platform and infrastructure. If the vulnerability is exploited, unauthenticated remote attackers can trigger heap corruption and potentially execute arbitrary code with the privileges of the web server process. The affected versions are Apache HTTP Server versions 2.4.55 through 2.4.70 (only servers with HTTP/2 enabled are affected). We will post more details for customers and partners with a valid Control Center login at https://community.akamai.com/customers/s/feed/0D5a700001ewU8ICAU (opens in new tab) as additional information becomes available. If you have questions or are experiencing an impact due to this issue, please use the Support Center in the Akamai Community or Akamai Control Center to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/ (opens in new tab).

  2. investigating

    Akamai continues to investigate the potential impact of this vulnerability across our platform and infrastructure. Akamai SMEs are taking action where necessary, and we will provide additional updates as more information becomes available. Customers and partners with a valid Control Center login can find more details at https://community.akamai.com/customers/s/feed/0D5a700001ewU8ICAU (opens in new tab). If you have questions or are experiencing impact related to this issue, please use the Support Center on Akamai Community or Akamai Control Center to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/ (opens in new tab).

Changes Rewindex caught on this incident

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Impact, status and times are the vendor’s own, as last archived. View on www.akamaistatus.com (opens in new tab).

Cite this

Status incident (vendor impact label: minor) posted by Akamai, started 2026-11-13 09:13 UTC, not resolved, 2 update(s); edited after publishing.

Title
Customer Security Advisory: Remote code execution vulnerability in the Apache HTTP Server's HTTP/2 module
Vendor
Akamai
Date
URL
https://rewindex.com/company/akamai/incidents/jkbdjhj81cx5

Akamai profileRecent Akamai incidentsAll outages on November 13, 2026Akamai in November 2026MarkdownJSON