Glary Utilities
CVE-2026-15684
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Local low-priv attacker with required user interaction abuses a junction for arbitrary delete escalating to SYSTEM (I:H/A:H); no direct data disclosure so C:N, though vendor rates C:H via code-exec chaining.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Glarysoft Glary Utilities. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the Disk Clean functionality. By creating a junction, an attacker can abuse the service to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27004.
AnalysisAI
Local privilege escalation in Glarysoft Glary Utilities lets an already-present low-privileged attacker abuse the Disk Clean feature to delete arbitrary files and ultimately execute code as SYSTEM. Discovered and reported through the Zero Day Initiative (ZDI-26-402, ZDI-CAN-27004), it stems from the privileged cleanup service following filesystem junctions (CWE-59) planted by the attacker. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but ZDI-sourced advisories are typically high-fidelity and reproducible.
Technical ContextAI
Glary Utilities is a Windows consumer PC-optimization and system-maintenance suite whose Disk Clean component runs with elevated (SYSTEM) privileges to remove temporary and junk files. The root cause is CWE-59 (Improper Link Resolution / Link Following): the privileged cleanup routine does not safely canonicalize or validate paths before acting on them, so a low-privileged user can plant an NTFS directory junction (reparse point) that redirects a delete operation against a location the user could not otherwise touch. This is the classic Windows 'arbitrary file delete as SYSTEM' primitive, where a junction under an attacker-writable directory points the privileged service at a protected system file. The affected product is identified by CPE cpe:2.3:a:glarysoft:glary_utilities across all versions (wildcard), indicating no fixed version is encoded in the CPE data.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary action is to consult the Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-402/ and Glarysoft's own release notes to obtain and deploy the latest patched build of Glary Utilities as soon as it is confirmed, applying the exact fixed version once published. As compensating controls until patched: restrict which users can run or trigger the Disk Clean functionality, and where feasible uninstall or disable Glary Utilities on multi-user or high-value hosts since a local attacker only needs low-privileged code execution to abuse the privileged cleanup service - the trade-off is loss of the maintenance/cleanup feature for legitimate users. Monitoring for creation of directory junctions/reparse points in user-writable temp locations and limiting interactive logon on sensitive systems reduces the attack surface, at the cost of additional endpoint monitoring overhead; avoid running the utility's scheduled or elevated cleanup on shared machines where untrusted users have local access.
More in Glary Utilities
View allSame weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today