CVE-2026-89282: CVE-2026-89282

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-22 · updated 2026-09-23
Weakness: CWE-732

Description

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.

Affected products

Apache HTTP Server Project Apache Lounge Windows: before Apache 2.4.68-260920 Win64 — fixed in Apache 2.4.68-260920 Win64

How to fix

Upgrade to a fixed version: Apache HTTP Server Project Apache Lounge Windows Apache 2.4.68-260920 Win64. Check the vendor advisory for mitigations.

References

https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing
https://httpd.apache.org/download.cgi
https://www.apachelounge.com/viewtopic.php?t=9515

Get alerted when CVE-2026-89282 or the next vulnerability affects your stack