Akamai is aware of the recently published remote code execution (RCE) vulnerability in the Apache HTTP Server's HTTP/2 module (CVE-2026-119618). Our subject matter experts (SMEs) are actively investigating its potential impact across our platform and infrastructure. If the vulnerability is exploited, unauthenticated remote attackers can trigger heap corruption and potentially execute arbitrary code with the privileges of the web server process. The affected versions are Apache HTTP Server versions 2.4.55 through 2.4.70 (only servers with HTTP/2 enabled are affected). We will post more details for customers and partners with a valid Control Center login at https://community.akamai.com/customers/s/feed/0D5a700001ewU8ICAU as additional information becomes available. If you have questions or are experiencing an impact due to this issue, please use the Support Center in the Akamai Community or Akamai Control Center to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/.
Posted Nov 13, 2026 - 09:13 UTC
This incident affects: Customer Service, Documentation and Community (Customer Security Advisory).
