# CVE-2026-89282

Apache Lounge Windows installer leaves C:\ install dir writable by Authenticated Users.

- Page: https://www.vulneraibility.com/cve/CVE-2026-89282
- CVSS: 9.1
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.48% (percentile 41.6)
- Unvetted proof-of-concept code on GitHub: 1 GitHub proof of concept (first 2026-10-17)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-09-23)
- Weakness: CWE-732
- Published: 2026-09-22

## Affected versions

- Apache HTTP Server Project Apache Lounge Windows: affected < Apache 2.4.68-260920 Win64

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated local users can modify server files/binaries, enabling persistence, service hijack or remote code execution as the web service account.

## Action

Immediate action required

## Recommendation

Remove Authenticated Users write, tighten C:\Apache* ACLs, move install off C:\ and apply vendor updates when available.

## References

- [other] https://httpd.apache.org/download.cgi
- [other] https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing
- [other] https://www.apachelounge.com/viewtopic.php?t=9515

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.