Yes. CISA added CVE-2021-42013 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled.
What “exploited in the wild” means for this CVE
For a vulnerability question like this, the key distinction is between theoretical exposure and confirmed active abuse. CISA’s KEV listing is the strongest operational signal that exploitation is not just possible but observed. For CVE-2021-42013, that means defenders should treat it as an incident-response and exposure-management problem, not a routine backlog item.
That matters because path traversal flaws can be chained into broader compromise when the web server is misconfigured or when CGI execution is enabled. Even if the initial bug is simple in concept, the outcome can cross from file disclosure into code execution, which changes both urgency and containment strategy. For general web attack patterns, see the Web Application Attacks Guide.
Why this vulnerability is operationally high risk
A path traversal issue on a widely deployed web server creates a large attack surface because scanners and opportunistic attackers can test it at scale. Once a vulnerability is known to be actively exploited, the real question becomes whether your specific deployment is reachable, whether the vulnerable conditions exist, and whether any preexisting compromise may already have occurred.
The practical risk is not limited to the vulnerable HTTP daemon itself. If an attacker can reach files or trigger server-side execution, they may be able to enumerate configuration, harvest secrets, alter content, or establish a foothold for follow-on activity. That is why active exploitation should trigger both patching and compromise assessment, not just version checking. The NHIMG Zero-Day and Exploited Vulnerabilities Guide is a useful playbook for KEV-style triage and post-patch hunting.
What teams should verify before declaring it contained
First confirm whether the vulnerable Apache HTTP Server instance is internet-facing or reachable from untrusted networks, because exposure changes the priority of the response. Then verify whether the deployment has the configuration conditions that make exploitation materially worse, especially Alias-like mappings and CGI enablement. If those conditions exist, assume an attacker had a viable path and inspect logs, web roots, and adjacent systems for signs of abuse.
Do not stop at “we patched it.” For actively exploited issues, teams should also look for unexpected file access patterns, suspicious webshell-like artifacts, altered content, and any evidence that credentials, configuration files, or internal paths were exposed. When the application or server layer is involved, correlate findings with a broader inventory of web app exposures using the Vulnerability Management Guide.
Risk and Threat Considerations
Because this CVE was placed in CISA’s KEV catalogue, the main threat concern is opportunistic mass exploitation rather than a niche or purely theoretical exploit path. Path traversal can be used to read sensitive files, and under the right server conditions it can escalate into remote code execution, which gives an attacker a way to pivot from simple HTTP requests to durable compromise.
Failure mechanism: The attacker abuses path normalization and web-server configuration gaps to reach files outside the intended document root, then leverages CGI or similar execution paths to turn file access into command execution.
Impact: Successful exploitation can expose configuration, source, or secret material, and may also create a foothold for malware deployment, privilege escalation, or ransomware preparation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Actively exploited CVEs demand prioritized identification and remediation. |
| CIS-18 — Penetration Testing | Exploitability should be validated on the actual deployment and configuration. | |
| Recommendation — Prioritise exposed Apache instances and verify remediation against the vulnerability backlog. Test the reachable Apache configuration to confirm whether traversal is exploitable. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | KEV-listed exploitation requires exposure discovery and continuous validation. |
| SI-2 — Flaw Remediation | Active exploitation makes timely flaw remediation central to the response. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-exploitation checks depend on review of web and system logs. | |
| Recommendation — Scan for vulnerable Apache deployments and track remediation status until closed. Apply the Apache fix or mitigation as an urgent flaw-remediation action. Review logs for traversal attempts and follow-on file or command activity. | ||
Practitioner Guidance
What to prioritise: Treat externally reachable Apache instances as the first queue, especially those with legacy content mappings, CGI enabled, or uncertain ownership. If you cannot immediately verify exposure status, assume the asset is at risk until proven otherwise.
What to verify: Confirm whether the vulnerable conditions described in the advisory exist, then review server logs, file timestamps, and any unusual requests that attempt directory climbing or access to sensitive paths. If you find evidence of suspicious access, expand the review to adjacent hosts and any credentials or configuration files the server could have exposed.
Practitioner takeaway: For KEV-listed web server flaws, containment is a two-step decision, fix the exposure, then prove the system was not already used as an entry point.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org