What is the CVSS score of CVE-2026-36425?

CVE-2026-36425 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

OPSWAT AppRemover CVE-2026-36425

MEDIUM

Improper Privilege Management (CWE-269)

2026-07-16 mitre

Privilege Escalation N A

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local vector (requires local session); any unprivileged user suffices (PR:L); impact is process termination (A:H only), not data disclosure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 14:23 vuln.today

CVSS changed

Jul 17, 2026 - 14:22 NVD

6.5 (MEDIUM)

CVE Published

Jul 16, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation.

AnalysisAI

Privilege-free process termination in OPSWAT AppRemover Driver (ardrv.sys v2017.10.02.1551 and earlier) allows any locally authenticated user to kill arbitrary processes - including endpoint security tools - by sending crafted requests to IOCTL handler 0x2420031 without any privilege validation. A public proof-of-concept is available on GitHub (redteamfortress/CVE-2026-36425), making this immediately reproducible by insider threats or post-compromise attackers seeking to disable defenses. No active exploitation has been confirmed in CISA KEV, but the defense-evasion potential elevates operational priority in environments running OPSWAT's OESIS Framework.

Technical ContextAI

OPSWAT AppRemover Driver (ardrv.sys) is a Windows kernel-mode driver distributed as part of OPSWAT's OESIS Framework, used by enterprises to programmatically remove security and compliance software from endpoints. The vulnerability resides in the driver's IOCTL dispatch table at control code 0x2420031, which accepts process termination commands from user-mode callers. Critically, the handler performs no privilege check before executing the termination request, violating the principle of least privilege at the kernel boundary. CWE-269 (Improper Privilege Management) precisely describes the root cause: a kernel-level capability - the ability to terminate any OS process - is exposed to the full user population without constraining it to privileged callers. The CPE entry in the NVD data (cpe:2.3:a:n/a:n/a) is a non-informative placeholder; affected product identity is derived solely from the CVE description and OPSWAT product reference.

RemediationAI

No vendor-released patch has been identified at time of analysis and no fixed version number is confirmed from available references. Organizations should contact OPSWAT support directly regarding an updated ardrv.sys via the OESIS Framework product page (https://www.opswat.com/products/oesis-framework/application-removal). As a compensating control, administrators can restrict access to the ardrv.sys device object using Windows discretionary access control (DACL) on the device namespace, preventing unprivileged processes from obtaining a handle - note this may break legitimate AppRemover functionality. Alternatively, where the AppRemover driver is not actively needed, unloading or blocking the driver via Windows Driver Blocklist policy eliminates the attack surface entirely. Monitoring for anomalous process termination events targeting security tools (via EDR telemetry, Sysmon Event ID 5, or Windows Security Event 4689) can provide detection coverage until a patch is available.