CVE-2026-89282CWE-732

CVE-2026-89282

Critical · published September 23, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-09-23T00:17Z
References (3)
https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing · [email protected]https://httpd.apache.org/download.cgi · [email protected]https://www.apachelounge.com/viewtopic.php?t=9515 · [email protected]
EPSS history
Timeline
  • 24 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 22 SEP 19:17Z
    CVE-2026-89282
    cvelistv5