CVE-2026-89281: Apache Lounge Apache HTTP Server vulnerability
Published Sep 22, 2026
·Updated
The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution.
Affected Software
1 affected component
Apache Lounge Apache HTTP Server
Event History
Sep 22, 2026
CVE Published
via MITRE·07:17 PM
Data Sourced
via MITRE·07:17 PM
DescriptionWeakness
Data Sourced
via NVD·08:17 PM
Description
Frequently Asked Questions
1
Which deployments are identified as affected?
The available information identifies the Apache Lounge Windows distribution of Apache HTTP Server. It does not identify other operating systems, distributions, or upstream Apache HTTP Server builds as affected.
2
Does the available information indicate remote exploitation?
No. The issue is described as allowing local code execution; no remote attack path is provided.
3
Are affected build versions or an interim workaround specified?
No affected build versions, fixed versions, configuration changes, or other mitigation steps are provided in the available information.