CVE-2026-74994: inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

unknownCVE-2026-74994

CSIRTS triage

vendor: Erlang/OTP product: inets httpd Authentication bypass

What: Authentication bypass in httpd mod_auth via directory namespace collapse allows unauthenticated access to protected resources.
Who is affected: Deployments of Erlang/OTP inets httpd with mod_auth enabled.
Urgency: High urgency as authentication bypass directly compromises access controls.
Action: Update Erlang/OTP to a patched version addressing CVE-2026-74994.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch inets httpd

Get an email when a new inets httpd advisory drops — max one per day, one-click unsubscribe.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-09-02
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-74994

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-749940.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-74994	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for inets, httpd

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-74835: inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Receptionmsrc · 2026-09-02
unknownCVE-2026-66357: inets,httpd:HTTP Request Smuggling via obs-fold Header Continuationmsrc · 2026-09-02
unknownCVE-2026-73276: inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping imsrc · 2026-09-02
unknownCVE-2026-73812: inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Lengthmsrc · 2026-09-02
unknownCVE-2026-74994: The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentic…nvd · 2026-09-01
unknownCVE-2026-74835: The inets application HTTP server httpd fails to enforce a configured body-size limit on chunk…nvd · 2026-09-01