{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-89282/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-89282"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Apache HTTP Server (\u003c 2.4.68-260920)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","dll-hijacking","windows","apache","cve-2026-89282"],"_cs_type":"advisory","_cs_vendors":["Apache Lounge"],"content_html":"\u003cp\u003eCVE-2026-89282 is a privilege escalation vulnerability in the Apache Lounge Windows distribution of the Apache HTTP Server. The root cause is the use of default, overly permissive access control lists (ACLs) during the installation process, which grant 'Authenticated Users' Modify access to the application directory tree, including 'C:\\Apache24\\bin'. Because the Apache service runs as 'NT AUTHORITY\\SYSTEM' and follows standard Windows DLL search order, a low-privilege local user can plant a malicious proxy DLL in the application directory. When the Apache service is subsequently restarted during routine maintenance, system updates, or administrative tasks, the malicious DLL is loaded and executed with system-level privileges. This vulnerability affects all builds prior to 2.4.68-260920.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains low-privilege local access to a Windows system running a vulnerable Apache Lounge installation.\u003c/li\u003e\n\u003cli\u003eThe attacker performs local reconnaissance to confirm the existence of 'C:\\Apache24' and confirms write access via inherited permissions.\u003c/li\u003e\n\u003cli\u003eThe attacker compiles a custom malicious proxy DLL (e.g., 'VCRUNTIME140.dll') that exports the same functions as the legitimate system library.\u003c/li\u003e\n\u003cli\u003eThe attacker creates a hard link to the legitimate system DLL ('vcruntime140_orig.dll') in the same directory to maintain functional software performance.\u003c/li\u003e\n\u003cli\u003eThe attacker places the malicious proxy DLL ('VCRUNTIME140.dll') into 'C:\\Apache24\\bin' to intercept library loading requests.\u003c/li\u003e\n\u003cli\u003eThe attacker waits for an administrative or automated event (such as a Windows Update cycle or manual service maintenance) to trigger an Apache service restart.\u003c/li\u003e\n\u003cli\u003eUpon service restart, 'httpd.exe' loads the proxy DLL instead of the system version.\u003c/li\u003e\n\u003cli\u003eThe proxy DLL executes the attacker's payload within the context of the 'SYSTEM' user, resulting in full privilege escalation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full SYSTEM-level access to the compromised server. This allows an attacker to bypass standard security boundaries, install persistent backdoors, modify sensitive web configurations, or exfiltrate data. The vulnerability is especially critical in shared or multi-user environments where standard users have local access. The Apache Lounge installation is widely used in enterprise environments, and the exploit is reliable, non-disruptive to service availability, and requires no administrative interaction to plant.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the immediate remediation of affected Apache Lounge installations using the following actions:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all Apache Lounge Windows instances to version 2.4.68-260920 or later to ensure the installer applies correct ACLs.\u003c/li\u003e\n\u003cli\u003eApply the following manual fix to affected directory trees: 'icacls \u0026quot;C:\\Apache24\u0026quot; /remove:g \u0026quot;BUILTIN\\Users\u0026quot; /T' followed by 'icacls \u0026quot;C:\\Apache24\u0026quot; /grant \u0026quot;BUILTIN\\Users:(OI)(CI)(RX)\u0026quot; /T'.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized file creation within 'C:\\Apache24\\bin\\' using file integrity monitoring (FIM) or 'file_event' telemetry.\u003c/li\u003e\n\u003cli\u003eImplement process mitigation policies to restrict dynamic library loading from non-system-protected directories.\u003c/li\u003e\n\u003cli\u003eAudit all service accounts running as 'SYSTEM' for insecure file permissions within their respective installation paths.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-17T07:18:30Z","date_published":"2026-10-17T07:18:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-lounge-lpe/","summary":"An insecure installation directory permission flaw in Apache Lounge allows local users to achieve SYSTEM-level privilege escalation via DLL search order hijacking.","title":"CVE-2026-89282: Privilege Escalation in Apache Lounge Windows","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-lounge-lpe/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-89282","version":"https://jsonfeed.org/version/1.1"}