Are web servers (Apache, Tomcat, Nginx) safe right now?
No web server flaws have been added to CISA's exploited list in the last 90 days (the most recent was Aug 4, 2026). Keep automatic updates on: that can change any day.
Earlier exploited flaws
- Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- Apache HTTP Server Improper Escaping of Output Vulnerability
- Apache Tomcat Path Equivalence Vulnerability
- Apache Tomcat Remote Code Execution Vulnerability
- Apache Tomcat Remote Code Execution Vulnerability
- Apache Tomcat on Windows Remote Code Execution Vulnerability
- Apache Tomcat Improper Privilege Management Vulnerability
- Apache HTTP Server Path Traversal Vulnerability
- Apache HTTP Server Path Traversal Vulnerability
- Apache HTTP Server Privilege Escalation Vulnerability
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 1 | 0 |
| 2025 | 2 | 0 |
| 2024 | 0 | 0 |
| 2023 | 1 | 0 |
| 2022 | 3 | 0 |
Questions
Are web servers (Apache, Tomcat, Nginx) safe right now?
No web server flaws have been added to CISA's exploited list in the last 90 days (the most recent was Aug 4, 2026). Keep automatic updates on: that can change any day. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many web servers vulnerabilities have been exploited?
10 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks, 3 of them used by ransomware.
Covers products matching tomcat, apache http, nginx. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.