Is CVE-2026-89281 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89281 being exploited in the wild.

How severe is CVE-2026-89281?

High severity, with a CVSS score of 8.4, published 22 September 2026.

Which products and versions are affected?

Apache HTTP Server Windows distribution (Apache Lounge build).

Is there a fix for CVE-2026-89281?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-89281 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-89281?

Check whether you run Apache HTTP Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89281: Apache HTTP Server hardcoded openssl.cnf path vulnerability on Windows

CVE-2026-89281 · Severity: high · CVSS 8.4 · Published 2026-09-22

The Windows distribution of Apache HTTP Server, when built by Apache Lounge, contains a hardcoded configuration path for OpenSSL that can be hijacked to execute arbitrary code on a local system. An attacker with write access to certain Windows directories could place a malicious openssl.cnf file to gain code execution with the privileges of the Apache process, potentially compromising hosted applications and data.

Technologies: Apache HTTP Server. Vendors: Apache.

Quick answers

Is CVE-2026-89281 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89281 being exploited in the wild.
How severe is CVE-2026-89281?: High severity, with a CVSS score of 8.4, published 22 September 2026.
Which products and versions are affected?: Apache HTTP Server Windows distribution (Apache Lounge build).
Is there a fix for CVE-2026-89281?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-89281 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-89281?: Check whether you run Apache HTTP Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from a hardcoded file path in the Apache HTTP Server Windows build that fails to properly validate the location of openssl.cnf before loading it. An attacker with local filesystem write access (such as to C:\, C:\ProgramData, or C:\Windows\TEMP) can place a crafted openssl.cnf file that will be loaded and executed by Apache, resulting in local code execution. This is a file hijacking/DLL preloading variant that arises from insecure path construction and permissive Windows directory permissions.

Affected products

Apache HTTP Server Windows distribution (Apache Lounge build)

Timeline

2026-09-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.