CVE-2026-89282

9.1 criticalEPSS 0.5%

Critical (9.1). EPSS 0.5% chance of exploitation in the next 30 days.

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-732
Published: 2026-09-22
Modified: 2026-09-23
Record from: the NVD, synced 2026-10-19

References

https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing
https://httpd.apache.org/download.cgi
https://www.apachelounge.com/viewtopic.php?t=9515

Check your stack JSON