Live › vulnerability › CVE-2026-108121
Go to dashboardIn koozali SME Server 11.0rc1-215, the domain creation function lets a high-privileged user inject reserved Apache directives into httpd.conf. After a reboot, Apache fails to start, taking down the web server and its virtual hosts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
SME Server 11.0rc1-215 installations where administrators can create domains. Exposure needs a high-privileged account, so sites that restrict admin accounts to trusted staff face lower risk. The sources do not name a fixed version.
No product ranges from the sources yet.
cat /etc/e-smith-release (unknown if the sources name a different check)/etc/httpd/conf/httpd.conf and run httpd -t to see whether the config parsesUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from starting after a server reboot, resulting in a denial-of-service (DoS) condition affecting the web server and its hosted virtual hosts.
This page as .md · .json · in your agent: get_signal("CVE-2026-108121")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.