Which versions of PowerISO are affected by CVE-2026-19189?

PowerISO 9.3.0.0 on Windows contains a local privilege escalation vulnerability in the scdemu.sys kernel driver that allows low-privileged local users to achieve SYSTEM-level access and fully…

Is there a public PoC exploit available for CVE-2026-19189?

Yes, a public proof-of-concept exploit is available for CVE-2026-19189. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-19189?

Within 24 hours, conduct a complete inventory of all endpoints running PowerISO 9.3.0.0 and classify them by criticality and user access profiles. Within 7 days, deploy interim mitigations based on risk: restrict local system logon privileges to trusted administrators, disable the scdemu.sys kernel driver via Group Policy if not required, or air-gap high-value systems from general user access. Within 30 days, execute a remediation strategy-upgrade PowerISO to a non-vulnerable version if available, migrate to an alternative ISO management tool, or remove PowerISO entirely. Establish ongoing monitoring for scdemu.sys driver exploitation attempts and anomalous registry modifications.

PowerISO CVE-2026-19189

Q: What is the CVSS score of CVE-2026-19189?

CVE-2026-19189 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-54349 HIGH

Improper Privilege Management (CWE-269)

2026-08-07 VulDB

GHSA-pf62-xqx5-xj73

Privilege Escalation Microsoft Poweriso

7.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local vector and low-privileged account required; arbitrary registry write yields full C/I/A; no confirmed scope change consistent with CVSS 4.0 SC:N/SI:N/SA:N mapping.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 07, 2026 - 03:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 07, 2026 - 03:22 vuln.today

cvss_changed

CVSS changed

Aug 07, 2026 - 03:22 NVD

8.5 (HIGH) 7.1 (HIGH)

Analysis Generated

Aug 07, 2026 - 02:51 vuln.today

CVE Published

Aug 07, 2026 - 02:00 cve.org

HIGH 8.5

DescriptionCVE.org

A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functionality in the library C:\Windows\System32\drivers\scdemu.sys of the component Kernel Driver. The manipulation results in improper privilege management. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Local privilege escalation in PowerISO 9.3.0.0 on Windows exposes low-privileged local users to full system compromise via the scdemu.sys kernel driver's improper privilege management (CWE-269). The exploit - publicly detailed as arbitrary registry write or deletion through the driver's IOCTL interface - allows elevation to SYSTEM-level control with high confidentiality, integrity, and availability impact on the vulnerable host. No vendor patch exists; the vendor did not respond to responsible disclosure, and a public proof-of-concept has been released, lowering the skill threshold for exploitation.

Technical ContextAI

PowerISO installs a kernel-mode virtual disc emulation driver, scdemu.sys, under C:\Windows\System32\drivers\. Kernel drivers operate at ring 0 (highest CPU privilege level) and are reachable from user space via DeviceIoControl IOCTL calls. CWE-269 (Improper Privilege Management) in this context indicates that the driver's IOCTL handler(s) fail to enforce caller privilege level validation before performing sensitive operations - specifically, arbitrary registry writes or deletions, as documented in the public exploit reference. Registry keys writable only by SYSTEM (e.g., service configurations, LSA secrets, security policy entries) can be manipulated when proper ACL checks are bypassed at the driver level. The CPE string cpe:2.3:a:power_sofware:poweriso:*:*:*:*:*:*:*:* applies to the Windows application family; the wildcard version field suggests the vulnerability may not be isolated to 9.3.0.0, though only that version is confirmed by EUVD-2026-54349.

RemediationAI

No vendor-released patch is available at time of analysis - the vendor did not respond to responsible disclosure, leaving the vulnerability unaddressed. The primary remediation is to uninstall PowerISO 9.3.0.0 on systems where untrusted local users are present or where privilege escalation poses an unacceptable risk. If uninstallation is not operationally feasible, administrators can disable the scdemu.sys driver using 'sc config scdemu start= disabled' followed by a reboot, which prevents the driver from loading; this will break PowerISO's virtual disc mount functionality as a trade-off. Alternatively, restrict interactive and Remote Desktop logon rights on systems running PowerISO to trusted administrative accounts only via Group Policy (Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment). Organizations should monitor VulDB (https://vuldb.com/cve/CVE-2026-19189) and the Power Sofware vendor site for any future patch releases. Given the public PoC, treat this as an active risk until driver removal or logon restriction is enforced.