← Back to search

CVE-2026-89282

9.1 CRITICAL

Published 2026-09-22 · Updated 2026-09-23

AI risk analysis

Summary
The flaw allows authenticated users to write to the default install directory, posing a risk of unauthorized code execution or data modification.
Exploitability
Exploitation is relatively easy given write access for Authenticated Users, but requires initial authentication to the server.
Blast radius
If exploited, it could lead to unauthorized changes or execution of malicious code on the server.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Disable write access for Authenticated Users on the default install directory C:\ or restrict access to authorized personnel only.
auth-bypasswrite-accessweb

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-732

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.