Which versions of upKeeper Instant Privilege Access are affected by CVE-2026-10745?

upKeeper Instant Privilege Access (through version 1.6.1 on Windows) contains a remote log injection vulnerability allowing unauthenticated attackers to forge, tamper with, or inject false entries…

How to fix or mitigate CVE-2026-10745?

Within 24 hours: Inventory all Windows systems running upKeeper 1.6.1 or earlier and assess their network reachability; brief security operations and audit teams on log integrity risks. Within 7 days: Deploy input validation and control character sanitization for all upKeeper log ingestion points, enable immutable log forwarding to tamper-proof centralized storage, and implement cryptographic log integrity verification. Within 30 days: Monitor vendor security advisories for patched versions; establish continuous log anomaly detection tuned for injection patterns; conduct forensic review of existing logs from affected systems for evidence of tampering.

upKeeper Instant Privilege Access CVE-2026-10745

Q: What is the CVSS score of CVE-2026-10745?

CVE-2026-10745 has a CVSS 4.0 base score of 7.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38731 HIGH

Improper Output Neutralization for Logs (CWE-117)

2026-06-24 upKeeper

GHSA-772w-g99g-gjqj

Code Injection Microsoft Upkeeper Instant Privilege Access

7.9

CVSS 4.0 · Vendor: upKeeper

Severity by source

Vendor (upKeeper) PRIMARY

7.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.8 MEDIUM

Remote unauthenticated input reaches logger (AV:N/AC:L/PR:N/UI:N); vulnerable component intact but downstream log integrity affected, so S:C with I:L and C:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (upKeeper).

CVSS VectorVendor: upKeeper

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 09:15 vuln.today

CVE Published

Jun 24, 2026 - 08:04 cve.org

HIGH 7.9

DescriptionCVE.org

Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log Injection-Tampering-Forging.

This issue affects upKeeper Instant Privilege Access: through 1.6.1.

AnalysisAI

Log injection in upKeeper Instant Privilege Access through 1.6.1 on Windows allows remote unauthenticated attackers to forge, tamper with, or inject crafted entries into application logs by smuggling unneutralized control characters through logged inputs. The flaw (CWE-117) does not directly compromise the upKeeper agent itself but produces high integrity, confidentiality, and availability impact on subsequent log-consuming systems (SIEM, audit pipelines). No public exploit identified at time of analysis and the CVE is not present in CISA KEV.

Technical ContextAI

upKeeper Instant Privilege Access is a Windows privilege-elevation/just-in-time admin product used to grant temporary local administrator rights without exposing standing credentials. The root cause is CWE-117 Improper Output Neutralization for Logs: attacker-controlled input is written to log sinks without stripping or escaping CR/LF, ANSI escape sequences, or structural delimiters used by downstream parsers. Because the affected CPE (cpe:2.3:a:upkeeper_solutions:upkeeper_instant_privilege_access:*) is a privileged-access management tool, its logs are typically forwarded to SIEM/audit systems where forged entries can defeat the very controls the product is meant to enforce.

RemediationAI

Patch available per vendor advisory at https://support.upkeeper.se/hc/en-us/articles/28408945088796-CVE-2026-10745-Improper-output-neutralization-for-logs - upgrade upKeeper Instant Privilege Access to a release later than 1.6.1 (exact fixed version not enumerated in the supplied data; confirm with upKeeper support). Until the upgrade is applied, restrict network reachability of the upKeeper agent/console to trusted management networks to shrink the population of unauthenticated input sources, and configure downstream SIEM ingestion to treat upKeeper log fields as untrusted by sanitizing CR/LF and parser-control characters at the collector (Splunk SEDCMD, Elastic ingest pipeline, syslog-ng rewrite) - the trade-off is that aggressive collector-side filtering can mangle legitimate multi-line fields and complicate forensic reconstruction. Increase monitoring for duplicate or out-of-sequence event IDs from upKeeper sources to detect forged entries while patching is in progress.