Apache HTTP Server Project has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 8.8 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Weakness classes
Products
- Apache Lounge Windows 2
2
Total CVEs
1
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-89282Critical· 9.1The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.62CVE-2026-89281High· 8.4The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution.46
Apache HTTP Server Project vulnerabilities
CVEs affecting Apache HTTP Server Project, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-89282Critical· 9.1PoCThe Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.
The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.
▾ AbyssalApache HTTP Server Project · Apache Lounge WindowsEPSS 0.48%via NVD
CVE-2026-89281High· 8.4The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution.
The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution.
▾ TwilightApache HTTP Server Project · Apache Lounge WindowsEPSS 0.18%via NVD