Glary Utilities CVE-2026-15684

Exploitation requires the attacker to already have the ability to execute low-privileged code on the target Windows system (a local, authenticated foothold - PR:L), and Glary Utilities must be installed with its privileged Disk Clean functionality present. The specific prerequisite is the ability to create an NTFS directory junction/reparse point in a location the Disk Clean routine will operate on, then have that cleanup run (UI:R indicates required user interaction, e.g. a user or scheduled task triggering Disk Clean). Limiting factors that reduce real-world risk: it cannot be exploited remotely or without a prior foothold, it needs the vulnerable Glary Utilities product installed and its cleanup feature to execute, and the required user interaction means the attacker must wait for or induce a cleanup operation rather than trigger SYSTEM code execution on demand.

The provided CVSS 3.0 base score is 7.3 (High) with vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, meaning local access, low attacker privileges, and required user interaction, but full confidentiality/integrity/availability impact once triggered - consistent with escalation to SYSTEM. This is a genuine post-compromise escalation primitive rather than a remotely wormable issue: it requires the attacker to already run code on the host, so it is a second-stage tool for local attackers, malware, or a foothold rather than an initial-access vulnerability. No EPSS score, SSVC decision, or KEV entry was supplied, and no POC reference is present, so exploitation probability signals are absent; treat the absence as missing data, not as evidence of low risk. Weighing the signals: high technical impact and ZDI-confirmed reproducibility, but gated behind local low-priv execution and user interaction (UI:R), which limits real-world urgency compared to a network-facing flaw. Note a minor tension worth verifying with the vendor - the flaw is described as arbitrary file *deletion*, yet CVSS marks Confidentiality:High; the High C/I/A is justified only because file-delete is chained into SYSTEM code execution, not from direct data disclosure.

An attacker who has already gained a low-privileged foothold on a Windows host (for example via phishing malware or a limited user account) plants a crafted NTFS junction inside a directory that Glary Utilities' Disk Clean will process. When the privileged cleanup runs and follows the junction, it deletes a protected file the attacker chose, which is chained into overwriting or planting a component that executes as SYSTEM, yielding full system compromise. No public exploit is identified at time of analysis, though ZDI advisories generally correspond to a working, reproducible proof-of-concept held privately.