CVE-2026-89282

CVE-2026-89282

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.

Affected

Apache HTTP Server Project · Apache Lounge Windows

CVSS v3.1 CNA

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.27% chance of exploitation in the next 30 days, 18th percentile

Published

2026-09-22

Updated

2026-09-23

Proof-of-concept exploits (1)

• dorkerdevil/CVE-2026-89282

References

• CVE Record
• NVD entry

Related

• CVE-2019-0708
• CVE-2019-11932
• CVE-2020-28008
• CVE-2020-28018
• CVE-2021-21975
• CVE-2021-22986