CVE-2026-89281: CVE-2026-89281

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-22 · updated 2026-09-23
Weakness: CWE-732

Description

The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution.

Affected products

Apache HTTP Server Project Apache Lounge Windows: before Apache 2.4.68-260920 Win64 — fixed in Apache 2.4.68-260920 Win64

How to fix

Upgrade to a fixed version: Apache HTTP Server Project Apache Lounge Windows Apache 2.4.68-260920 Win64. Check the vendor advisory for mitigations.

References

https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing
https://httpd.apache.org/download.cgi
https://www.apachelounge.com/viewtopic.php?t=9515

Get alerted when CVE-2026-89281 or the next vulnerability affects your stack