EquiTriton CVE-2026-28700

Exploitation requires the attacker to hold or have compromised high-privilege local credentials on the target host (PR:H per the CVSS 4.0 vector). Beyond privilege level, specific attack requirements (AT:P) must be met: at least one directory in EquiTriton's executable or shared-library search path must be writable by the attacker and must appear in the search order before the directory containing the legitimate binary. This is a non-default configuration condition - installations where all search path directories are owned and writable only by administrators are not exploitable. Additionally, a privileged user must passively invoke the affected EquiTriton application component (UI:P), meaning the attacker cannot force execution autonomously. Remote exploitation is explicitly ruled out by the local attack vector (AV:L). The combination of required local access, high privilege, a specific file-system precondition, and user interaction substantially limits realistic attacker population relative to the raw CVSS CIA impact ratings.

The CVSS 4.0 base score of 5.4 accurately captures a constrained exploitability profile: local attack vector (AV:L), specific attack requirements (AT:P), high privilege prerequisite (PR:H), and passive user interaction (UI:P) together place a significant operational bar on exploitation despite the High ratings across all three vulnerable-system CIA dimensions. No EPSS data was supplied, and the absence of a CISA KEV entry means there is no confirmed evidence of active in-the-wild use. From an SSVC perspective, exploitation status is unconfirmed, the attack is not remotely automatable, and technical impact is bounded by the local, high-privilege attack path - even a mid-sized municipal IT team in inowroclaw should treat this as a scheduled patch cycle item rather than emergency response, provided local workstation access is not broadly granted to untrusted users. One data-quality caveat: the fix is referenced only by a git commit hash (f5ddbb5), not a formally versioned release, which introduces uncertainty for organizations that consume pre-built packages and cannot easily verify their build provenance against that commit.

An attacker with local high-privilege credentials identifies a directory in EquiTriton's library or executable search path that is writable and precedes the legitimate binary location, then places a malicious DLL or executable with the expected name in that directory. When a privileged user's session passively triggers the affected EquiTriton component - for example, by launching an application or scheduled task - the operating system's loader resolves the attacker's binary first and executes it under the privileged context. No public proof-of-concept has been identified, but the DLL/binary planting technique for CWE-427 is well-documented and broadly understood by attackers.