CVE-2026-73270: httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

unknownCVE-2026-73270

CSIRTS triage

vendor: Apache product: httpd Authentication bypass

What: mod_auth directory protection bypassed through request path casing differences on case-insensitive filesystems.
Who is affected: Apache httpd deployments using mod_auth on case-insensitive filesystems.
Urgency: Severity unknown; bypassing authentication controls requires prompt remediation regardless of base score.
Action: Upgrade Apache httpd to patched version and verify authorization rules function correctly.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch httpd

Get an email when a new httpd advisory drops — max one per day, one-click unsubscribe.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-09-02
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73270

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-732700.66% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-73270	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for httpd mod_auth directory

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-74994: inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_authmsrc · 2026-09-02
unknownCVE-2026-66835: httpd mod_auth directory protection bypassed by a doubled slash in the request pathmsrc · 2026-09-02
unknownCVE-2026-74994: The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentic…nvd · 2026-09-01
unknownCVE-2026-73270: Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote …nvd · 2026-09-01
unknownCVE-2026-66835: Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attac…nvd · 2026-09-01