CVE-2026-89282

Received Received - Intake

Apache HTTP Server Insecure Default Directory Permissions on Windows

Publication date: 2026-09-22

Last updated on: 2026-09-23

Assigner: CERT/CC

Description

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-23

Generated

2026-10-13

AI Q&A

2026-09-22

EPSS Evaluated

2026-10-12

NVD

CVE-2026-89282

EUVD

EUVD-2026-84680

Affected Vendors & Products

Vendor	Product	Version / Range
apache	apache_http_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability involves the Apache Lounge Windows distribution of Apache HTTP Server having insecure default installation directory permissions. The default install directory on the C:\ drive allows write access for Authenticated Users, which could permit unauthorized modifications to the server files.

Detection Guidance

Check the permissions of the Apache HTTP Server installation directory on C:\. Run 'icacls "C:\Apache24"' in Command Prompt to verify if 'Authenticated Users' has write access. If write permissions are present, the vulnerability exists.

Impact Analysis

This vulnerability could allow attackers with authenticated user access to alter Apache HTTP Server files, potentially leading to unauthorized changes, service disruption, or further exploitation of the system.

Compliance Impact

This vulnerability could potentially violate compliance requirements under GDPR and HIPAA by allowing unauthorized users to modify critical system files due to insecure directory permissions. Unrestricted write access to the Apache HTTP Server installation directory may lead to unauthorized changes, data breaches, or system compromise, which are non-compliant with these regulations.

Mitigation Strategies

Remove write permissions for 'Authenticated Users' on the Apache installation directory using 'icacls "C:\Apache24" /remove:g "Authenticated Users"' in Command Prompt. Ensure only necessary accounts have write access.

Hi! I’m here to help you understand CVE-2026-89282. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70