What is the CVSS score of CVE-2026-12410?

CVE-2026-12410 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of CCleaner are affected by CVE-2026-12410?

CCleaner, widely deployed across Windows endpoints for system maintenance, contains a privilege escalation vulnerability allowing local attackers to gain system-level administrative access; no public…. A patch is available.

How to fix or mitigate CVE-2026-12410?

Within 24 hours, identify all systems running CCleaner and assess current versions across the environment; escalate this advisory to Windows endpoint operations teams. Within 7 days, deploy CCleaner 7.10.1464 to all affected systems using your standard patch management process, prioritizing mission-critical infrastructure and user-facing systems. Within 30 days, complete a compliance sweep to verify 100% of CCleaner installations have been updated to 7.10.1464 or later, and remove unsupported versions from your approved software list.

CCleaner CVE-2026-12410

EUVD-2026-53387 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-08-05 GEN

GHSA-fgpf-v7cp-xh35

Privilege Escalation Microsoft Ccleaner Gen Digital

7.8

CVSS 3.1 · Vendor: GEN

Severity by source

Vendor (GEN) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local low-privileged session required to plant junction; no timing complexity; SYSTEM-level file operations yield full C/I/A impact on the local system without scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GEN).

CVSS VectorVendor: GEN

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 15:22 vuln.today

Patch available

Aug 05, 2026 - 15:02 EUVD

CVE Published

Aug 05, 2026 - 14:14 cve.org

HIGH 7.8

DescriptionCVE.org

Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application's data folder with elevated integrity.

AnalysisAI

Privilege escalation in CCleaner's Uninstaller component on Windows allows a local low-privileged attacker to gain SYSTEM-level access by planting an NTFS symlink or directory junction before or during application uninstallation. The uninstaller executes file deletion with elevated (SYSTEM) integrity and follows the attacker-controlled link without validation, redirecting destructive operations to arbitrary system paths. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; Gen Digital has released a fix in CCleaner 7.10.1464.

Technical ContextAI

The vulnerability is CWE-59 (Improper Link Resolution Before File Access, 'Link Following') in the Uninstaller component of CCleaner on Windows. During uninstallation, CCleaner elevates to SYSTEM integrity to clean up its application data folder. A low-privileged attacker can pre-position a Windows NTFS symbolic link or directory junction at the expected data folder path, redirecting it to an arbitrary sensitive system location. Standard Windows users can create junctions and symlinks (via NtCreateFile with reparse point flags or mklink) without requiring elevated rights, making this a low-barrier precondition. The affected product is identified by CPE cpe:2.3:a:gen_digital:ccleaner:*:*:*:*:*:*:*:*, covering all CCleaner releases prior to 7.10.1464. This class of attack is well-documented in Windows local privilege escalation literature and exploits the structural asymmetry between the privilege level at which links are created and the privilege level at which they are resolved.

RemediationAI

The primary fix is to upgrade CCleaner to version 7.10.1464 or later, which addresses the unsafe link-following behavior in the Uninstaller component. The patch is available from Gen Digital's security advisory page at https://www.gendigital.com/us/en/contact-us/security-advisories/. If immediate patching is not feasible, organizations can reduce exposure by restricting software removal to administrator-only workflows - for example, using enterprise MDM or software management tools that prevent standard users from initiating CCleaner uninstallation, thereby blocking the attacker's ability to trigger the vulnerable code path. Additionally, monitoring for unexpected NTFS junction or symlink creation under CCleaner's application data directories (via endpoint detection tools or audit policies) can serve as a detection compensating control. Note that restricting uninstallation is a partial mitigation only and does not eliminate the underlying vulnerability; patching remains the definitive remediation.