Monthly
Local privilege escalation in Hyland Desktop Host for Windows (all versions before 25.1.1) lets a low-privileged local user gain full administrative control of the host by abusing weak filesystem permissions on the directory from which a privileged service runs. The affected service executes out of %PROGRAMDATA%\Hyland\DesktopHost\bin, a location writable by non-administrative users; an attacker who can drop or replace a binary or library there and trigger a service (re)start causes that code to execute with the service's elevated (typically SYSTEM) context, yielding confidentiality, integrity, and availability impact across the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), although the attack is technically straightforward to reproduce on a shared or multi-user machine where an unprivileged account already exists.
Local privilege escalation in WSUS (Windows Server Update Services) allows an authenticated low-privileged attacker with local access to elevate privileges by exploiting incorrect default permissions (CWE-276). The vulnerability has a Microsoft-assigned CVSS 3.1 score of 7.5 (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), indicating high attack complexity and required user interaction, but it can lead to full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and a patch is available per the Microsoft advisory.
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any local authenticated user read the mail server's stored messages, logs, temporary files, and built-in database, because the data, log, temp, database and event folders and the hMailServer.INI file inherit the local Users group's read access from the default installation path under Program Files. The readable INI exposes the database password, which is protected only by the machine's DPAPI key and can therefore be unsealed by any local account - handing full control of an external database - while the built-in database's account password hashes become readable whenever the hMailServer service is stopped; the Linux AppImage 6.3.0 through 6.3.5 has a parallel weakness in per-user data folder permissions. Exploitation requires an untrusted local account able to sign in to the host, no public exploit was identified at time of analysis, and the vendor has released 6.3.6 as the fix.
Froxlor through 2.3.10 fails to enforce the mail.allow_external_domains policy in the EmailSender.add API command, letting an authenticated customer with API access register an arbitrary external sender address for their mailbox even when the administrator has explicitly disabled external allowed-sender domains. The bypass only matters when the administrator has enabled the allowed-sender feature (mail.enable_allow_sender=1) while disabling external domains (mail.allow_external_domains=0), and the sender-spoofing impact materializes only if the generated mail configuration consumes the allowed-sender table; there is no public exploit identified at time of analysis, and exploitation requires valid low-privilege API credentials rather than being unauthenticated. A vendor-released patch is available in Froxlor 2.3.12, and our independent assessment rates this as a genuine but modest-severity authorization/policy-enforcement flaw rather than a high-urgency one.
Local privilege escalation in the Acronis Backup integrations for cPanel & WHM, Plesk, and DirectAdmin on Linux allows an attacker who already holds a low-privileged account or shell on the host to tamper with plugin-installed files and directories left with insecure default permissions, gaining high-privilege code execution on the server. The flaw is confirmed actively exploited (CISA KEV) and carries a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is needed and only low privileges are required, though exploitation is gated to hosts where one of the three control-panel plugins is installed and has not yet been upgraded to its fixed build. Because the vector is strictly local, remote attackers cannot reach it directly - they must first obtain a foothold or credentials on the server.
Incorrect default permissions in Dell Repository Manager (DRM) versions prior to 3.5.2 let an attacker who already holds a low-privileged account on a Windows host abuse misconfigured files, directories, or service resources to escalate to a higher-privileged context. Dell rates this 8.5 (High) with a remote, scope-changing vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), but our independent assessment scores it 7.8 as a local privilege-escalation issue (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation requires an existing foothold on a machine where DRM is installed, is not a default unauthenticated remote scenario, and is limited to systems running DRM below 3.5.2. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fixed release (3.5.2) via Dell security advisory DSA-2026-419.
Privilege escalation in the Lenovo Filez Client application allows a local authenticated user to gain elevated system rights via improper file or directory permissions (CWE-276). The CVSS 4.0 score of 8.5 reflects a meaningful local attack path with low complexity and no special attack requirements, though exploitation is bounded by the requirement for an existing local foothold. No active exploitation or public proof-of-concept has been identified at time of analysis.
Privilege escalation in Inductive Automation Ignition 8.1.53 and earlier allows any authenticated user who can execute gateway scripts to create SCADA/HMI projects without restriction, because the Gateway 'Create Project Role(s)' setting shipped with a blank default - effectively disabling the access control gate entirely. In industrial control system (ICS) environments, unauthorized project creation is operationally significant: projects define the logic, tags, and screens that interact with physical process equipment. Ignition 8.1.54 closes the gap by restricting project creation to Designer sessions, removing reliance on the misconfigured role setting. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local privilege escalation in JAL Information Technology's Pallet Control suite (including PalletControl and PalletControl Cloud) enables a low-privileged local attacker to execute arbitrary code with SYSTEM-level privileges due to incorrect default installation permissions (CWE-276). All tracked versions across three CPE entries are listed as affected per JPCERT/CC coordination notice JVN#84094853. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Privilege escalation in Rockwell Automation's Redundancy Module Configuration Tool (RMConfigTool.exe) enables a local standard user to execute arbitrary code with Administrator or SYSTEM privileges via DLL search order hijacking. The tool searches system PATH directories for required DLLs, and one or more of those directories have incorrect default permissions allowing write access by non-privileged accounts; if a malicious DLL is planted there before an administrator runs the tool, it loads into the elevated process. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the underlying technique is well-understood and commonly leveraged in post-exploitation privilege escalation chains.
Local privilege escalation in Hyland Desktop Host for Windows (all versions before 25.1.1) lets a low-privileged local user gain full administrative control of the host by abusing weak filesystem permissions on the directory from which a privileged service runs. The affected service executes out of %PROGRAMDATA%\Hyland\DesktopHost\bin, a location writable by non-administrative users; an attacker who can drop or replace a binary or library there and trigger a service (re)start causes that code to execute with the service's elevated (typically SYSTEM) context, yielding confidentiality, integrity, and availability impact across the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), although the attack is technically straightforward to reproduce on a shared or multi-user machine where an unprivileged account already exists.
Local privilege escalation in WSUS (Windows Server Update Services) allows an authenticated low-privileged attacker with local access to elevate privileges by exploiting incorrect default permissions (CWE-276). The vulnerability has a Microsoft-assigned CVSS 3.1 score of 7.5 (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), indicating high attack complexity and required user interaction, but it can lead to full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and a patch is available per the Microsoft advisory.
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any local authenticated user read the mail server's stored messages, logs, temporary files, and built-in database, because the data, log, temp, database and event folders and the hMailServer.INI file inherit the local Users group's read access from the default installation path under Program Files. The readable INI exposes the database password, which is protected only by the machine's DPAPI key and can therefore be unsealed by any local account - handing full control of an external database - while the built-in database's account password hashes become readable whenever the hMailServer service is stopped; the Linux AppImage 6.3.0 through 6.3.5 has a parallel weakness in per-user data folder permissions. Exploitation requires an untrusted local account able to sign in to the host, no public exploit was identified at time of analysis, and the vendor has released 6.3.6 as the fix.
Froxlor through 2.3.10 fails to enforce the mail.allow_external_domains policy in the EmailSender.add API command, letting an authenticated customer with API access register an arbitrary external sender address for their mailbox even when the administrator has explicitly disabled external allowed-sender domains. The bypass only matters when the administrator has enabled the allowed-sender feature (mail.enable_allow_sender=1) while disabling external domains (mail.allow_external_domains=0), and the sender-spoofing impact materializes only if the generated mail configuration consumes the allowed-sender table; there is no public exploit identified at time of analysis, and exploitation requires valid low-privilege API credentials rather than being unauthenticated. A vendor-released patch is available in Froxlor 2.3.12, and our independent assessment rates this as a genuine but modest-severity authorization/policy-enforcement flaw rather than a high-urgency one.
Local privilege escalation in the Acronis Backup integrations for cPanel & WHM, Plesk, and DirectAdmin on Linux allows an attacker who already holds a low-privileged account or shell on the host to tamper with plugin-installed files and directories left with insecure default permissions, gaining high-privilege code execution on the server. The flaw is confirmed actively exploited (CISA KEV) and carries a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is needed and only low privileges are required, though exploitation is gated to hosts where one of the three control-panel plugins is installed and has not yet been upgraded to its fixed build. Because the vector is strictly local, remote attackers cannot reach it directly - they must first obtain a foothold or credentials on the server.
Incorrect default permissions in Dell Repository Manager (DRM) versions prior to 3.5.2 let an attacker who already holds a low-privileged account on a Windows host abuse misconfigured files, directories, or service resources to escalate to a higher-privileged context. Dell rates this 8.5 (High) with a remote, scope-changing vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), but our independent assessment scores it 7.8 as a local privilege-escalation issue (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation requires an existing foothold on a machine where DRM is installed, is not a default unauthenticated remote scenario, and is limited to systems running DRM below 3.5.2. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fixed release (3.5.2) via Dell security advisory DSA-2026-419.
Privilege escalation in the Lenovo Filez Client application allows a local authenticated user to gain elevated system rights via improper file or directory permissions (CWE-276). The CVSS 4.0 score of 8.5 reflects a meaningful local attack path with low complexity and no special attack requirements, though exploitation is bounded by the requirement for an existing local foothold. No active exploitation or public proof-of-concept has been identified at time of analysis.
Privilege escalation in Inductive Automation Ignition 8.1.53 and earlier allows any authenticated user who can execute gateway scripts to create SCADA/HMI projects without restriction, because the Gateway 'Create Project Role(s)' setting shipped with a blank default - effectively disabling the access control gate entirely. In industrial control system (ICS) environments, unauthorized project creation is operationally significant: projects define the logic, tags, and screens that interact with physical process equipment. Ignition 8.1.54 closes the gap by restricting project creation to Designer sessions, removing reliance on the misconfigured role setting. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local privilege escalation in JAL Information Technology's Pallet Control suite (including PalletControl and PalletControl Cloud) enables a low-privileged local attacker to execute arbitrary code with SYSTEM-level privileges due to incorrect default installation permissions (CWE-276). All tracked versions across three CPE entries are listed as affected per JPCERT/CC coordination notice JVN#84094853. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Privilege escalation in Rockwell Automation's Redundancy Module Configuration Tool (RMConfigTool.exe) enables a local standard user to execute arbitrary code with Administrator or SYSTEM privileges via DLL search order hijacking. The tool searches system PATH directories for required DLLs, and one or more of those directories have incorrect default permissions allowing write access by non-privileged accounts; if a malicious DLL is planted there before an administrator runs the tool, it loads into the elevated process. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the underlying technique is well-understood and commonly leveraged in post-exploitation privilege escalation chains.