CVE-2026-89282
9.1 CRITICALPublished 2026-09-22 · Updated 2026-09-23
AI risk analysis
- Summary
- The flaw allows authenticated users to write to the default install directory, posing a risk of unauthorized code execution or data modification.
- Exploitability
- Exploitation is relatively easy given write access for Authenticated Users, but requires initial authentication to the server.
- Blast radius
- If exploited, it could lead to unauthorized changes or execution of malicious code on the server.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Disable write access for Authenticated Users on the default install directory C:\ or restrict access to authorized personnel only.
auth-bypasswrite-accessweb
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-732
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2025-15399
- HIGHCVE-2025-51457
- CRITICALCVE-2025-66455PoC
- MEDIUMCVE-2025-71420PoC
- CRITICALCVE-2026-10050PoC
- HIGHCVE-2026-100520PoC
- HIGHCVE-2026-100552PoC
- CRITICALCVE-2026-100716PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.