{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T10:30:51Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"cisco-sa-apache-httpd-2.4.49-VWL69sWQ","slug":"cisco-sa-apache-httpd-2-4-49-vwl69swq","vendor":"Cisco","title":"Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021","summary":"On September 16, 2021, the Apache Software Foundation disclosed five vulnerabilities affecting the Apache HTTP Server (httpd) 2.4.48 and earlier releases. For a description of these vulnerabilities, see the Apache HTTP Server 2.4.49 section of the Apache HTTP Server 2.4 vulnerabilities webpage. This advisory will be updated as additional information becomes available. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","severity":"High","published_at":"2021-11-24T16:00:00Z","updated_at":"2022-01-20T22:52:28Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ/csaf/cisco-sa-apache-httpd-2.4.49-VWL69sWQ.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":5,"visible_product_count":3,"public_evidence_count":7,"kev_count":1,"highest_epss":0.99999},"cves":[{"id":"CVE-2021-40438","kev":true,"kev_added_at":"2021-12-01","epss":{"score":0.99999,"percentile":0.99998,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:48Z"}},{"id":"CVE-2021-34798","kev":false,"epss":{"score":0.64509,"percentile":0.99151,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:48Z"}},{"id":"CVE-2021-36160","kev":false,"epss":{"score":0.62887,"percentile":0.99105,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:48Z"}},{"id":"CVE-2021-33193","kev":false,"epss":{"score":0.46179,"percentile":0.98681,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:34Z"}},{"id":"CVE-2021-39275","kev":false,"epss":{"score":0.36339,"percentile":0.98312,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:48Z"}}],"public_evidence":[{"product":{"name":"Cisco Firepower Extensible Operating System (FXOS)","slug":"cisco-firepower-extensible-operating-system-fxos","vendor":"Cisco"},"cve":{"id":"CVE-2021-40438"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:00:46Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Firepower Extensible Operating System (FXOS)","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":true,"epss":{"score":0.99999,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:48Z"},"published_at":"2021-11-24T16:00:00Z","updated_at":"2022-01-20T22:52:28Z","advisory_updated_at":"2022-01-20T22:52:28Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"},"row_display_order":1},{"product":{"name":"Cisco Firepower Extensible Operating System (FXOS)","slug":"cisco-firepower-extensible-operating-system-fxos","vendor":"Cisco"},"cve":{"id":"CVE-2021-34798"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:00:46Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Firepower Extensible Operating System (FXOS)","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.64509,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:48Z"},"published_at":"2021-11-24T16:00:00Z","updated_at":"2022-01-20T22:52:28Z","advisory_updated_at":"2022-01-20T22:52:28Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"},"row_display_order":2},{"product":{"name":"Cisco Expressway","slug":"cisco-expressway","vendor":"Cisco"},"cve":{"id":"CVE-2021-36160"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:00:46Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Expressway","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.62887,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:48Z"},"published_at":"2021-11-24T16:00:00Z","updated_at":"2022-01-20T22:52:28Z","advisory_updated_at":"2022-01-20T22:52:28Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"},"row_display_order":3},{"product":{"name":"Cisco Firepower Extensible Operating System (FXOS)","slug":"cisco-firepower-extensible-operating-system-fxos","vendor":"Cisco"},"cve":{"id":"CVE-2021-36160"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:00:46Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Firepower Extensible Operating System (FXOS)","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.62887,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:48Z"},"published_at":"2021-11-24T16:00:00Z","updated_at":"2022-01-20T22:52:28Z","advisory_updated_at":"2022-01-20T22:52:28Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"},"row_display_order":4},{"product":{"name":"Cisco TelePresence Video Communication Server (VCS) Expressway","slug":"cisco-telepresence-video-communication-server-vcs-expressway","vendor":"Cisco"},"cve":{"id":"CVE-2021-33193"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:00:46Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco TelePresence Video Communication Server (VCS) Expressway","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.46179,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:34Z"},"published_at":"2021-11-24T16:00:00Z","updated_at":"2022-01-20T22:52:28Z","advisory_updated_at":"2022-01-20T22:52:28Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"},"row_display_order":5},{"product":{"name":"Cisco Firepower Extensible Operating System (FXOS)","slug":"cisco-firepower-extensible-operating-system-fxos","vendor":"Cisco"},"cve":{"id":"CVE-2021-33193"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:00:46Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Firepower Extensible Operating System (FXOS)","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.46179,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:34Z"},"published_at":"2021-11-24T16:00:00Z","updated_at":"2022-01-20T22:52:28Z","advisory_updated_at":"2022-01-20T22:52:28Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"},"row_display_order":6},{"product":{"name":"Cisco Firepower Extensible Operating System (FXOS)","slug":"cisco-firepower-extensible-operating-system-fxos","vendor":"Cisco"},"cve":{"id":"CVE-2021-39275"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:00:46Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Firepower Extensible Operating System (FXOS)","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.36339,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:48Z"},"published_at":"2021-11-24T16:00:00Z","updated_at":"2022-01-20T22:52:28Z","advisory_updated_at":"2022-01-20T22:52:28Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"},"row_display_order":7}]}