EUVD-2026-84680
GHSA-w7qw-gwf7-rvpq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local authenticated account
-
DeliveryIdentify default C:\ install with Authenticated-Users write
-
ExploitPlant malicious DLL/binary in install dir
-
ExecutionSYSTEM Apache service loads component
-
ImpactExecute code as SYSTEM (privesc)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Permission assignment review
|
| Exploitation Conditions | Exploitation requires: (1) the third-party Apache Lounge Windows build of Apache HTTP Server (versions before 2.4.68-260920 Win64), NOT the official ASF release; (2) installation to the DEFAULT directory on the C:\ root, which inherits write permissions for the 'Authenticated Users' group; and (3) an existing local authenticated account on the host. The Apache service must run as SYSTEM (default) for the planted binary/DLL to yield privilege escalation. Limiting factors: the attacker needs a pre-existing local foothold, the flaw does not apply if Apache was installed to a properly ACL'd path (e.g., Program Files), and it is not remotely reachable despite the published network vector. |
| Impact | The published CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) is internally inconsistent with the vulnerability described. CWE-732 insecure install-directory permissions is fundamentally a LOCAL privilege-escalation issue: the default install path on C:\ inherits write access for 'Authenticated Users', so a local user who already has an account plants a malicious DLL or binary that the SYSTEM-level Apache service later loads. That is not a network-reachable attack, so AV:N and PR:N are almost certainly wrong - verify with the vendor. My independent assessment is AV:L/PR:L with full triad impact (privesc to SYSTEM yields A:H, not the A:N in the NVD vector), scoring roughly 7.8. No EPSS score, no CISA KEV listing, and no public exploit code are present; the referenced Atos 'tale of several hijacks' blog is a runtime-testing writeup, not a weaponized POC. Real-world risk is real but bounded - it requires an existing local foothold on a Windows host running the Apache Lounge build from its default C:\ location - so this is a solid privesc primitive for post-compromise lateral movement, NOT the wormable remote-code-execution that a 9.1 network-vector score implies. |
| Exploit ScenarioDerived | A low-privileged but authenticated local user on a Windows server running the Apache Lounge build installed to its default C:\ directory writes a malicious DLL or replacement binary into the world-writable install folder. When the Apache service (running as SYSTEM) next starts or loads that component, the attacker's code executes with SYSTEM privileges, achieving local privilege escalation. No public exploit code is identified at time of analysis, though a related runtime-testing writeup exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Local privilege escalation affects the third-party Apache Lounge Windows distribution of Apache HTTP Server installed to its default directory at the root of C:\, where the folder inherits write access granted to the 'Authenticated Users' group. Any user with an existing local account on the host can plant or overwrite binaries and DLLs in the install tree, and because the Apache service normally runs as SYSTEM, that plant executes with high privileges. This is a local, authenticated-only escalation - not a remotely reachable defect - and the published CVSS 9.1 network vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) is internally inconsistent with the described flaw, which our assessment scores as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Currently there is no public exploit identified at time of analysis and no confirmed CISA KEV listing, and the issue does not affect the official ASF httpd build, only the Apache Lounge repackaging prior to 2.4.68-260920 Win64.
RemediationAI
The primary fix is to use the Apache Lounge Windows build 2.4.68-260920 Win64 or later, the first release outside the affected version range, and to install it to a directory with restrictive ACLs rather than directly on C:\; download from https://httpd.apache.org/download.cgi or the Apache Lounge distribution referenced at https://www.apachelounge.com/viewtopic.php?t=9515 and verify the corrected version before redeploying. If a rebuild is not immediately possible, the effective compensating control is to break ACL inheritance on the existing install tree and remove write access for Authenticated Users, for example with icacls "C:\Apache24" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" and then verifying with icacls or AccessChk that no non-administrative group retains write or modify rights; the trade-off is that any service account or operational tooling previously relying on those inherited permissions will need explicit grants or it will fail to start or write logs. Moving the installation to a properly ACL'd location such as C:\Program Files\Apache Group\Apache24 achieves the same effect, at the cost of a reinstall and reconfiguration of service paths and configuration files. As defense in depth, change the Apache service account from LocalSystem to a dedicated low-privilege virtual or service account using sc config or the Services MMC snap-in, which limits the blast radius of a planted binary should the directory permissions regress; note that this can break modules requiring SYSTEM-level access to privileged ports or named pipes. Administrative access to the host must be restricted to trusted users, since an attacker who already holds a local account is the prerequisite for exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-732 (Incorrect Permission Assignment for Critical Resource) is the root cause: the Apache Lounge Windows installer's default target of C:\ (e.g., C:\Apache24) sits at the root of the system drive, a location whose inherited ACLs grant write access to the 'Authenticated Users' well-known group. Because Windows ACL inheritance flows down unless explicitly broken, the entire httpd installation tree - binaries, modules, and DLL search paths - inherits that write permission. When the Apache service runs under the LocalSystem (SYSTEM) account, a non-privileged local user can overwrite httpd.exe, a loaded module, or a DLL resolved from the install directory and have that code execute in SYSTEM context on the next service restart or load, yielding full local privilege escalation with high confidentiality and integrity impact. The CPE cpe:2.3:a:apache_http_server_project:apache_lounge_windows identifies the third-party Apache Lounge packaging rather than the upstream Apache Software Foundation release, meaning the same httpd source is affected only insofar as it is packaged and installed to a weakly-ACL'd path; an httpd instance placed in a properly protected directory such as C:\Program Files does not exhibit this weakness, and the flaw is entirely local - no remote or unauthenticated path to trigger it is supported by the underlying mechanism regardless of the published network vector.
Know when Apache Lounge Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Local install-dir permissions abusable only by an existing authenticated user (AV:L/PR:L); planting code the SYSTEM service runs grants full host compromise (C:H/I:H/A:H).
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.
Articles & Coverage 1
Executive ViewAI
A permissions flaw in the Apache Lounge Windows distribution of Apache HTTP Server - a third-party repackaging, not the official Apache Software Foundation build - lets anyone holding an ordinary local account on the host plant or replace binaries and DLLs in the server's install directory and have that code run with the highest privileges on the machine. Because no vendor patch has been released, exposure persists on every Windows host running this distribution, and a single low-privilege account on a shared, multi-tenant, or VDI system can be parlayed into full control of that server. Leadership should care because remediation here depends on permission hardening, service account changes, and platform migration rather than routine patching, and because affected hosts may include internet-facing web tiers.
No vendor-released patch identified at time of analysis. Interim mitigations, in priority order: remove write/modify permissions for 'Authenticated Users' and 'Users' from the Apache install tree (this permission inheritance is the root cause, and note that no public exploit has been identified at time of analysis); run the Apache service under a dedicated low-privilege service account instead of SYSTEM; reduce and audit local accounts that could plant files; and deploy file-integrity monitoring and application allowlisting on the install directory to detect or block tampering. Migrating to the official ASF httpd build eliminates the exposure, since the flaw affects only the Apache Lounge repackaging prior to 2.4.68-260920 Win64.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB