EUVD-2026-87080
GHSA-w2x4-mxjr-6f86
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local authenticated user session
-
DeliveryInteract with vulnerable kernel-mode driver
-
ExploitAbuse improper access control check
-
ExecutionEscalate to NT AUTHORITY\SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Seclore FileSecure Desktop Client (version before 3.25.1.0) to be installed on a Windows host, and the attacker must already have an authenticated local user session on that host (PR:L, AV:L). Exploitation targets the client's kernel-mode driver component, so the driver must be present and loaded. Limiting factors: no remote or network exploitation is possible (local vector only), no user interaction of a second victim is needed (UI:N), and the attacker cannot use this for initial access - it is strictly a post-authentication escalation on machines running the vulnerable client. This constrains real-world exploitation to insiders or attackers who have already gained a low-privileged foothold. |
| Impact | This is a classic local privilege-escalation flaw: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes an authenticated local user abusing a kernel-mode driver to reach NT AUTHORITY\SYSTEM, and CWE-269 (improper privilege management) is consistent with that. The signals largely agree on 'serious impact, limited reach': SSVC rates Technical Impact as 'total' (matching C:H/I:H/A:H) but Exploitation as 'none' and Automatable as 'no', which aligns with the local, non-wormable nature (AV:L cannot be automated across a network). There is NO CISA KEV listing, NO public POC identified, and NO EPSS score in the provided data, so there is no evidence of active exploitation - this is a high-severity-but-not-actively-exploited issue that matters most as a post-compromise escalation primitive rather than an initial-access threat. The only reference is a third-party GitHub gist advisory (author Soham-029) plus the NVD detail page; no first-party Seclore advisory is included, so affected-version scope beyond 'before 3.25.1.0' and remediation details are not independently confirmed here. EUVD lists affected versions as 'n/a n/a', which is uninformative. Net: legitimate to patch on affected endpoints, but not an emergency internet-facing exposure - attacker must already have local authenticated access. |
| Exploit ScenarioDerived | An attacker who already has a standard authenticated user session on a Windows host running Seclore FileSecure Desktop Client (before 3.25.1.0) interacts with the vulnerable kernel-mode driver to abuse its improper access control and escalate to NT AUTHORITY\SYSTEM. This grants full control of the machine, enabling credential theft, security-tool tampering, and persistence. No public exploit code was identified at time of analysis; a third-party gist advisory documents the issue but no weaponized POC is confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Privilege escalation in the Seclore FileSecure Desktop Client affects Windows hosts running any client version before 3.25.1.0, where an authenticated local user can abuse an improper access control weakness in the product's kernel-mode driver to obtain NT AUTHORITY\SYSTEM. The flaw is rated CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-269) and is strictly a post-authentication escalation - it cannot be used for initial access or network exploitation and requires an existing low-privileged session on the vulnerable host. There is no public exploit identified at time of analysis and no CISA KEV listing; SSVC records Exploitation: none, so the operational risk is concentrated in insider-threat and post-compromise scenarios rather than mass exploitation. A vendor-released patch is available in version 3.25.1.0.
RemediationAI
Upgrade the Seclore FileSecure Desktop Client to 3.25.1.0 or later on every affected Windows endpoint - this is the vendor-released patch and the only complete fix; verify the driver binary version after upgrade, since a stale, loaded driver can persist until reboot. Until the update is deployed, treat every host carrying the client as a potential escalation target and apply compensating controls with their trade-offs in mind: restrict interactive local logon and RDP access on those machines so only trusted, vetted accounts can obtain the low-privileged session the exploit requires (trade-off: reduced flexibility for shared-workstation or lab environments and higher helpdesk load); where the DRM agent is not business-critical on a given host, uninstall or disable the Seclore FileSecure Desktop Client and its kernel driver entirely (trade-off: loss of file-level rights management and audit enforcement on that endpoint); and add detection coverage for driver-service manipulation, unexpected SYSTEM-token creation, and anomalous IOCTL/device-handle access to the Seclore driver, since EDR telemetry can flag successful elevation even though it cannot prevent it. Because the flaw is local-only (AV:L) with no network vector, network segmentation and perimeter filtering offer no mitigation; the primary containment lever is limiting who can log on locally. Consult the vendor advisory at https://gist.github.com/Soham-029/b1b52cbf3d10e9f8dd4997c52d1419ad#file-seclore-desktop-client-windows-security-advisory-md for the official guidance, and note that no public exploit code was identified at time of analysis, so exploitation would currently require a bespoke, post-authentication attack.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the kernel-mode driver component shipped with the Seclore FileSecure Desktop Client - the agent that enforces the product's file-level DRM/enterprise rights management on Windows endpoints. Because the flaw is a kernel-mode driver access control issue, it sits in the classic local-privilege-escalation class: a driver loaded at high integrity exposes privileged operations (device object handles, IOCTLs, or service control paths) that a low-privileged caller can reach without adequate authorization checks. CWE-269 (Improper Privilege Management) frames the root cause as a failure to correctly bind the privilege required by the operation to the caller's actual privilege level, letting an ordinary user invoke functionality that should be reserved for SYSTEM or an administrator, ultimately yielding a SYSTEM-level token or arbitrary kernel-mode execution. The CVSS vector confirms the local (AV:L), low-privilege (PR:L), no-user-interaction (UI:N) and unchanged-scope (S:U) characteristics, and the impact triad C:H/I:H/A:H indicates full compromise of confidentiality, integrity and availability on the affected host once elevation succeeds. No CPE data was supplied by the sources, and the EUVD record lists no granular version metadata beyond the vendor's 'before 3.25.1.0' boundary.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated user (AV:L/PR:L) reliably escalates via a kernel driver to SYSTEM, yielding full confidentiality, integrity and availability impact (C:H/I:H/A:H); no scope change as it targets the host OS.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems.
Executive ViewAI
Seclore FileSecure Desktop Client versions before 3.25.1.0 contain a high-severity local privilege-escalation flaw that allows an authenticated Windows user to gain SYSTEM-level control of the endpoint. This affects only hosts with the vulnerable client installed; exploitation requires an existing low-privileged session, so leadership should treat it primarily as an insider-risk and post-compromise hardening issue rather than a remote mass-exploitation threat. A vendor patch is available in version 3.25.1.0, and remediation should focus on inventory and rapid upgrade of affected endpoints.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB