ESET Server Security CVE-2026-6424

Exploitation requires local access to the target system and high-privilege credentials or an already-elevated process (PR:H, AV:L per CVSS 4.0 vector). The vulnerable code path exists within the ESET kernel module loaded as part of normal ESET real-time protection operation - no non-default configuration or special feature toggle is documented as required beyond having an ESET Linux product installed and running its kernel component. What limits exploitation: the attacker must already have local high-privilege access (root or equivalent), restricting the scenario to insider threats, already-compromised privileged accounts, or lateral movement that has achieved privilege escalation. Remote unauthenticated exploitation is not possible given AV:L. No user interaction is required once privileged access is obtained.

The CVSS 4.0 score of 6.7 (Medium) accurately reflects the constrained exploitation conditions. The vector AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N requires local access and high privileges (PR:H), which substantially limits the attacker pool to authenticated local administrators or processes already running at elevated privilege. The sole confirmed impact is system availability (VA:H - kernel panic/crash), with no confidentiality or integrity impact documented. No EPSS data was provided, and this CVE does not appear in the CISA KEV catalog, suggesting no confirmed mass exploitation. The practical risk is highest on Linux production servers running ESET Server Security where a privileged local attacker - or a compromised privileged process - could force a kernel panic, effectively performing a denial of service that requires a reboot to recover. This is a real but operationally bounded risk: high severity only when local privileged access is already available, making it a lower priority than network-exploitable flaws for most organizations. However, environments running ESET on critical Linux infrastructure (CI/CD systems, file servers, mail gateways) should treat remediation as a priority given the DoS-only path to disruption.

A local administrator or privileged process on a Linux host running ESET Endpoint Antivirus or ESET Server Security triggers a specific code path in the ESET kernel module that dereferences a previously freed memory region, causing an unrecoverable kernel panic and system crash. No public proof-of-concept code has been identified, so exploitation currently requires knowledge of the internal ESET kernel module code paths. The low attack complexity (AC:L) once the trigger is known suggests the crash is reliably reproducible by a knowledgeable attacker.