EUVD-2026-99242
GHSA-m9c4-mrj4-xxwp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliverySubmit input with undefined values
-
ExploitTrigger improper value handling (CWE-232)
-
ExecutionEscalate to elevated privileges
-
ImpactFull system compromise
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires: (1) local access to the system running upKeeper Instant Privilege Access (AV:L - not network-reachable); (2) an authenticated low-privileged account on the product (PR:L); and (3) active user interaction (UI:A), meaning a user must perform a specific action for the escalation to succeed. The flaw is an improper handling of undefined values (CWE-232) in the privilege-access product's input processing. Limiting factors that reduce realistic risk: an attacker cannot reach this remotely, must already possess valid credentials, and the dependency on user interaction prevents fully autonomous or scripted exploitation (consistent with SSVC Automatable: no). All deployments through version 1.7.1 are affected; upgrading to a vendor-fixed release removes the condition. |
| Impact | The CVSS 4.0 base score of 8.6 (High) is driven by total technical impact (VC/VI/VA:H and subsequent-system SC/SI/SA:H), consistent with a privilege-escalation outcome, but the exploitability metrics meaningfully constrain real-world risk: AV:L requires local access, PR:L requires an already-authenticated low-privileged account, and UI:A requires active user interaction. These are not characteristics of a mass-exploitable, internet-facing flaw. The CISA SSVC framework reinforces a lower operational priority - Exploitation: none (no observed or public exploitation), Automatable: no (cannot be reliably scripted at scale), though Technical Impact: total aligns with the high impact metrics. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public proof-of-concept referenced. Signals are internally consistent rather than conflicting: a high-impact but difficult-to-reach escalation requiring a local foothold, valid low-privilege credentials, and victim interaction. Net assessment: this is a genuine high-impact privilege-escalation issue that patch-management teams should remediate, but it is NOT an emergency, wormable, or remotely exploitable threat - treat as scheduled high-priority patching, not drop-everything. |
| Exploit ScenarioDerived | A low-privileged authenticated user of upKeeper Instant Privilege Access (version ≤1.7.1) supplies crafted input containing undefined/unexpected values that the application mishandles (CWE-232), combined with a required user-interaction step, to escalate from limited privileges to full control of the system. Because the attack vector is local (AV:L) and needs an existing account plus active interaction (PR:L/UI:A), this is a post-foothold escalation rather than a remote compromise. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Privilege escalation in upKeeper Instant Privilege Access through version 1.7.1 lets a local, authenticated low-privileged user gain elevated privileges by triggering improper handling of undefined values during input processing, with user interaction required for the escalation to succeed. The flaw carries a CVSS 4.0 base score of 8.6 (High) driven by total confidentiality, integrity and availability impact across both the vulnerable component and subsequent systems, although local access (AV:L), a valid low-privileged account (PR:L) and mandatory user interaction (UI:A) materially constrain real-world exploitability. There is no public exploit identified at time of analysis, and CISA SSVC assessment records Exploitation: none with Automatable: no, meaning scripted or fully autonomous attacks are not expected.
RemediationAI
No exact fixed version is specified in the available data, so the primary action is to consult the vendor advisory at https://support.upkeeper.se/hc/en-us/articles/31019905229084-CVE-2026-92088-Improper-handling-of-undefined-values and apply the vendor-designated patched release for upKeeper Instant Privilege Access, confirming afterwards that the installed build is later than 1.7.1 on every affected host; patch availability is not independently confirmed here and absence of a listed version should not be read as an absence of a fix. Until the upgrade is applied, compensating controls should target the exploit prerequisites rather than the network, since the attack path is local (AV:L) and network filtering is ineffective. Specifically: restrict interactive logon and local console/RDP access to hosts running the privileged-access component to the smallest set of trusted administrators, accepting the operational cost that legitimate help-desk and end-user elevation workflows on those hosts will be curtailed; audit and remove unnecessary local accounts and stale credentials so the PR:L prerequisite cannot be satisfied by dormant or shared accounts; and treat any privilege-elevation action initiated by a low-privileged user on an affected host as suspicious, logging and alerting on it, recognising that the required user interaction (UI:A) means detection must rely on endpoint telemetry rather than on blocking the trigger itself. Because the flaw can bypass authorization logic, credentials and tokens handled by the affected component on compromised hosts should be treated as potentially exposed and rotated after remediation. Full removal of the risk requires the vendor patch, as these measures only reduce the attack surface and do not eliminate the underlying improper handling of undefined values (CWE-232).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-232 (Improper Handling of Undefined Values), a structured-input handling defect in which the software fails to account for a value that is missing or undefined when parsing or processing input, instead of validating it and failing safely. In a privileged-access product such as upKeeper Instant Privilege Access this class of defect can cause logic errors, most notably authorization or state checks that are bypassed or misapplied, allowing the caller to reach functionality that should have been gated. The assessed impact profile (VC/VI/VA:H plus subsequent-system SC/SI/SA:H in the CVSS 4.0 vector, and S:C in the independent CVSS 3.1 assessment) indicates the escalation crosses a security boundary from the low-privileged context into a more privileged component or operating-system context. Exploitability is deliberately constrained: the vector requires local access to the host running the product, an already-authenticated low-privileged account, and active user interaction, so the weakness cannot be reached remotely or exercised unattended, which is consistent with the SSVC rating of Automatable: no. All releases of upKeeper Instant Privilege Access through 1.7.1 are affected per the EUVD data (version range 0 to 1.7.1).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Local access with a low-privileged account and required user interaction (AV:L/PR:L/UI:R); scope changes as escalation crosses a privilege boundary (S:C) with full C/I/A impact.
Primary rating from Vendor (80f39f49-2521-4ee7-9e17-af5d55e8032f).
CVSS VectorVendor: 80f39f49-2521-4ee7-9e17-af5d55e8032f
DescriptionCVE.org
Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.
This issue affects upKeeper Instant Privilege Access: through 1.7.1.
Executive ViewAI
A high-severity privilege escalation flaw in upKeeper Instant Privilege Access (versions through 1.7.1) could allow a low-privileged local user to obtain elevated rights on systems where the product is installed, potentially exposing sensitive data and allowing unauthorized configuration changes on both the affected endpoint and connected systems. Because exploitation requires an existing account on the machine, local access, and a user-interaction step, the practical risk is concentrated among insider, contractor, or compromised-endpoint scenarios rather than broad external attack. Leadership should care because remediation depends on vendor action rather than an available patch, meaning exposure persists until compensating controls are in place or an updated release ships.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict local logon and interactive access on hosts running upKeeper Instant Privilege Access 1.7.1 or earlier to trusted, necessary users; remove or disable unnecessary local accounts; enforce least privilege and restrict local administrator group membership; require user interaction controls such as screen-lock and session policies to reduce the risk of a triggered elevation (UI:A); monitor privilege-escalation and elevation events with enhanced logging and alerting; and prioritize migration or vendor engagement for a fixed release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB