{"id":"CVE-2026-89282","title":"The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\\, which inherits write access for Authenticated Users.","summary":"The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\\, which inherits write access for Authenticated Users.","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-732"],"vendor":"Apache HTTP Server Project","product":"Apache Lounge Windows","affected":["apache_lounge_windows < Apache 2.4.68-260920 Win64"],"published":"2026-09-22","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:58:00.627","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89282","references":[{"url":"https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing","label":"cret@cert.org"},{"url":"https://httpd.apache.org/download.cgi","label":"cret@cert.org"},{"url":"https://www.apachelounge.com/viewtopic.php?t=9515","label":"cret@cert.org"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00479,"epssPercentile":0.41137,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-23T12:22:48.686174Z"},"ingestedAt":"2026-09-22T20:10:15.103Z","exploits":{"github":1,"githubRepos":["https://github.com/dorkerdevil/CVE-2026-89282"],"checkedAt":"2026-10-27T19:20:31.766Z"},"exploitAvailable":true,"slug":"CVE-2026-89282","body":"## Overview\n\nThe Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\\, which inherits write access for Authenticated Users.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":62,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":223932,"id":"CVE-2026-89282","ts":1792281248829,"field":"exploit_available","old":"false","new":"true"},{"seq":209668,"id":"CVE-2026-89282","ts":1790169918559,"field":"cvss","old":null,"new":"9.1"},{"seq":209667,"id":"CVE-2026-89282","ts":1790169918559,"field":"severity","old":"none","new":"critical"}]}