VulnSocial

CVE-2021-39275Active Exploitation(apache / cloud_backup)

MEDIUMCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for apache cloud_backup systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

apache CVEsBack to dashboard
4.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-787

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • cloud_backup
  • clustered_data_ontap
  • debian_linux
  • fedora

Threat summary

  • Active exploitation appears in 1 classified signals
  • 1 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
apachedebianfedoraprojectnetapporaclesiemens
Products
cloud_backupclustered_data_ontapdebian_linuxfedorahttp_serverinstantis_enterprisetracksinec_nmssinema_serverstoragegridzfs_storage_appliance_kit

13 versions affected across 10 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-07-21: 1Active Exploitation · 2026-07-21: 107-21
Signal classification1 categories
Active Exploitation
1100.0%
Full discourse1 post
  • CyberTLDR@CyberTLDR
    Active Exploitation

    2/3 No zero day needed. Operators scan the internet for exposed cameras, fingerprint them, then walk in through default or weak passwords and old bugs like CVE-2021-39275. Image recognition software then auto searches the feeds for military movement. #InfoSec #CyberAttack

    Post summary

    The tweet describes ongoing exploitation of IP cameras using default or weak credentials and the known CVE‑2021‑39275 vulnerability to automatically monitor military activity.

    1000059
    32 followersView on X
CPE platform detail17 entries

17 of 17 entries

PartVendorProductVersionTarget SWTarget HW
Appapachehttp_server---
OSdebiandebian_linux10.0--
OSdebiandebian_linux11.0--
OSdebiandebian_linux9.0--
OSfedoraprojectfedora34--
OSfedoraprojectfedora35--
Appnetappcloud_backup---
Appnetappclustered_data_ontap---
Appnetappstoragegrid---
Apporaclehttp_server12.2.1.3.0--
Apporaclehttp_server12.2.1.4.0--
Apporacleinstantis_enterprisetrack17.1--
Apporacleinstantis_enterprisetrack17.2--
Apporacleinstantis_enterprisetrack17.3--
Apporaclezfs_storage_appliance_kit8.8--
Appsiemenssinec_nms---
Appsiemenssinema_server14.0--

Explore more

Back to dashboardapache CVEsdebian CVEsfedoraproject CVEscloud_backup vulnerabilities