CVE-2026-89282
Received Received - Intake

Apache HTTP Server Insecure Default Directory Permissions on Windows

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CERT/CC

Description
The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-23
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-89282
EUVD
EUVD-2026-84680

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache apache_http_server *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Apache Lounge Windows distribution of Apache HTTP Server having insecure default installation directory permissions. The default install directory on the C:\ drive allows write access for Authenticated Users, which could permit unauthorized modifications to the server files.

Detection Guidance

Check the permissions of the Apache HTTP Server installation directory on C:\. Run 'icacls "C:\Apache24"' in Command Prompt to verify if 'Authenticated Users' has write access. If write permissions are present, the vulnerability exists.

Impact Analysis

This vulnerability could allow attackers with authenticated user access to alter Apache HTTP Server files, potentially leading to unauthorized changes, service disruption, or further exploitation of the system.

Compliance Impact

This vulnerability could potentially violate compliance requirements under GDPR and HIPAA by allowing unauthorized users to modify critical system files due to insecure directory permissions. Unrestricted write access to the Apache HTTP Server installation directory may lead to unauthorized changes, data breaches, or system compromise, which are non-compliant with these regulations.

Mitigation Strategies

Remove write permissions for 'Authenticated Users' on the Apache installation directory using 'icacls "C:\Apache24" /remove:g "Authenticated Users"' in Command Prompt. Ensure only necessary accounts have write access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89282. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart