CVE-2010-0425: Apache mod_isapi on Windows remote code execution via orphaned callbacks

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 2.0 base score is 10.0 with network, unauthenticated, complete confidentiality, integrity, and availability impact, and EPSS is above the 99.8th percentile.

What it is

mod_isapi in Apache HTTP Server on Windows does not ensure request processing is complete before calling isapi_unload for an ISAPI .dll module, leaving orphaned callback pointers. A remote attacker can send a crafted request, including a reset packet, to trigger use of those stale pointers. The flaw affects Apache 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7 on Windows, and is rated CVSS 2.0 10.0.

Impact

Successful exploitation allows remote code execution in the context of the Apache HTTP Server process. That gives the attacker the server's privileges and any data or downstream access those privileges carry.

Attack surface

The vector is network-reachable (AV:N/AC:L/Au:N), so no authentication is required and no user interaction is indicated. It is limited to Windows deployments running mod_isapi with ISAPI modules loaded.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.94248 (99.845th percentile), indicating very high predicted exploitation activity. One reference carries an Exploit tag (SecurityFocus BID 38494), though the record does not confirm a public exploit's reliability or availability.

What to do

• Upgrade to a fixed Apache HTTP Server release: 2.0.64 or later on the 2.0 branch, 2.2.15 or later on the 2.2 branch, or 2.3.7 or later; apply the corresponding vendor updates for IBM WebSphere, Oracle, and VMware products listed.
• If mod_isapi is not required, disable it and remove ISAPI module mappings from the Windows configuration.
• Restrict network access to the HTTP service to trusted clients where operationally possible.
• Monitor vendor advisories for the listed products and apply their patched builds rather than relying on the Apache fix alone.

Detection

• Review Windows Apache error and access logs for crashes, restarts, or abnormal requests around ISAPI handler paths and .dll mappings.
• Alert on unexpected child process creation or command execution spawned by the Apache service account.
• Monitor for repeated connection resets or malformed requests targeting ISAPI-mapped URLs.
• Inventory Windows hosts running affected Apache versions and mod_isapi to confirm exposure.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.