EUVD-2026-84681
GHSA-c78c-jvr8-f6vh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local unprivileged access to Windows host
-
ExploitWrite malicious config/engine to hardcoded openssl.cnf path
-
ExecutionApache/mod_ssl loads config on OpenSSL init
-
ImpactExecute code as Apache service account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Permission assignment review
|
| Exploitation Conditions | Requires local interactive or code-execution access as a user on a Windows host running the Apache Lounge distribution of Apache HTTP Server (versions before Apache 2.4.68-260920 Win64). The hardcoded openssl.cnf path must resolve to a location writable by the attacker's privilege level, and OpenSSL must be initialized by the server (mod_ssl / TLS in use, which triggers reading the config). Limiting factors: no remote vector (AV:L) - the attacker must already be on the box; the flaw is specific to the third-party Apache Lounge Windows build, not the official Apache Software Foundation source or Linux packages; and exploitation is contingent on the hardcoded path being user-writable in the actual install. |
| Impact | The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.4) is internally consistent - the 8.4 score correctly derives from Scope:Unchanged, so there is no vector/score conflict to reconcile. However, the 8.4 'High' rating overstates real-world urgency because the attack vector is LOCAL (AV:L): an attacker must already have code-execution or an interactive session on the Windows host, so this is a local privilege-escalation / code-execution primitive rather than a remotely reachable flaw. No EPSS score, no CISA KEV listing, and no confirmed public exploit were provided in the input, so exploitation probability signals are absent; the referenced atos.net 'a tale of several hijacks' article suggests published technical analysis exists but does not confirm a weaponized proof-of-concept. Net assessment: a legitimate defense-in-depth / privilege-escalation issue on affected Windows hosts, but NOT a mass-exploitation, internet-facing emergency - prioritize below any remote unauthenticated RCE. PR:N is defensible only under the assumption the hardcoded openssl.cnf path resides in a location writable by unprivileged local users; if the path is admin-only in a given deployment, real-world exploitability drops further - verify install permissions with the vendor. |
| Exploit ScenarioDerived | A local unprivileged user on a Windows server running the Apache Lounge build writes a malicious OpenSSL configuration (or engine/provider module) to the hardcoded openssl.cnf path. When Apache/mod_ssl next initializes OpenSSL (service start or reload), it reads the attacker-controlled config and loads the malicious module, executing code in the context of the Apache service account, which is frequently a privileged or SYSTEM-level account. A technical writeup (atos.net) is referenced, but no confirmed weaponized public exploit is indicated in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Local code execution on Windows hosts running the Apache Lounge distribution of Apache HTTP Server (builds before Apache 2.4.68-260920 Win64) is possible because the build hardcodes the path to openssl.cnf, allowing a local attacker who can write to that path to plant a malicious OpenSSL configuration that the server loads when TLS is initialized. The vulnerability is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and classified CWE-732, meaning the weakness is an incorrect permission assignment for a critical resource; exploitation requires the attacker to already have local interactive or code-execution access on the host and the hardcoded path to be writable at the attacker's privilege level, with successful exploitation affecting confidentiality, integrity, and availability at high impact. No public exploit identified at time of analysis and no CISA KEV listing applies, and the issue is specific to the third-party Apache Lounge Windows build rather than the upstream Apache Software Foundation source or Linux distributions.
RemediationAI
Vendor-released patch: upgrade to Apache Lounge Windows build Apache 2.4.68-260920 Win64 or later, obtained from the Apache Lounge distribution channel referenced in the advisory (https://www.apachelounge.com/viewtopic.php?t=9515) and the Apache HTTP Server download page (https://httpd.apache.org/download.cgi). After upgrading, verify that the build resolves the OpenSSL configuration to a protected location rather than a hardcoded user-writable path, since the exact remediation detail should be confirmed against the vendor advisory. If immediate upgrade is not possible, apply compensating controls whose trade-offs should be weighed: tighten Windows ACLs on the directory containing the hardcoded openssl.cnf path so that only the httpd service account and administrators have write access, which directly removes the writability precondition but requires identifying the exact path in each install and re-verifying it after any reinstall or update; and run the Apache service under a dedicated low-privilege account whose profile and temporary directories are not writable by interactive users, which limits lateral impact but may require adjusting service configuration. Where TLS is not required, disabling mod_ssl and OpenSSL initialization removes the attack surface at the cost of losing HTTPS; where TLS is required, keep mod_ssl enabled but ensure the configuration file and its parent directories are protected. Because this is a local, post-foothold issue, host-level monitoring for creation or modification of openssl.cnf files in unexpected locations provides detection value. No public exploit code or CISA KEV entry was identified at time of analysis, so prioritization should reflect the local-access prerequisite and the CVSS 8.4 severity rather than active exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Lounge is a third-party provider of precompiled Windows binaries of the Apache HTTP Server, and the affected builds embed an absolute, hardcoded path to the OpenSSL configuration file (openssl.cnf) rather than resolving it relative to the installation directory. When the server loads mod_ssl and initializes OpenSSL for TLS, OpenSSL reads that configuration file; because the path is fixed and, in the affected builds, may resolve to a location writable by a non-administrative user, an attacker with local access can supply a crafted openssl.cnf. CWE-732 (Incorrect Permission Assignment for Critical Resource) is the root cause class: a security-critical resource, the TLS configuration consumed by OpenSSL, is left in a state where an actor without the intended privileges can modify it. A malicious OpenSSL configuration can direct OpenSSL to load attacker-controlled providers, engines, or dynamic libraries (for example via engine or dynamic path directives), resulting in arbitrary code execution in the context of the httpd service. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms a local, low-complexity, no-privilege, no-user-interaction attack with high impact across confidentiality, integrity, and availability, and Scope:Unchanged, so the 8.4 base score is internally consistent with the assessed vector. The affected CPE is cpe:2.3:a:apache_http_server_project:apache_lounge_windows:*:*:*:*:*:*:*:* using the vendor key apache_http_server_project and product apache_lounge_windows, and the ENISA EUVD record EUVD-2026-84681 scopes affected versions to Apache Lounge Windows builds below Apache 2.4.68-260920 Win64; no EPSS score was supplied in the available intelligence, so no probability estimate can be cited.
Know when Apache Lounge Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local vector (AV:L) since a local user must write the config file; PR:N because the hardcoded path is exploitable by an unprivileged user, yielding full code execution as the service account (C/I/A:H).
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution.
Executive ViewAI
Windows hosts running Apache Lounge Apache HTTP Server builds before 2.4.68-260920 Win64 are exposed to local code execution through a hardcoded OpenSSL configuration path, with high impact to confidentiality, integrity, and availability. Because exploitation requires an attacker to already have local interactive or code-execution access plus write permissions to that path, the immediate organizational risk is privilege escalation or server compromise by insiders, malware, or compromised local accounts on affected systems. Leadership should prioritize inventory and access-control remediation while monitoring for a vendor fix, as no public exploit identified at time of analysis and no CISA KEV listing applies.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict write permissions on the hardcoded openssl.cnf path to Administrators/SYSTEM, enforce least privilege and remove local interactive/code-execution access for non-admin users, deploy file integrity monitoring and EDR rules for openssl.cnf and TLS initialization changes, and migrate to a supported upstream Apache HTTP Server distribution where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB