ESET Inspect Connector EUVD-2026-44895

Exploitation requires the attacker to already hold a low-privileged local session on a Windows host running the ESET Inspect Connector (AV:L, PR:L) - this is a post-foothold privilege-escalation primitive, not a remote entry point. The exact prerequisite is the ability to open and send requests to the Connector's ALPC IPC endpoint, which the privileged server does not properly authenticate. No special product configuration is called out beyond having the ESET Inspect Connector (the EDR sensor) installed and running, and no user interaction is needed (UI:N). Limiting factors: the local-only vector means remote/network-only attackers cannot trigger it directly, the target must be running the affected Connector component (EDR/ESET Inspect customers specifically, not all ESET endpoint installs), and the attacker needs an existing authenticated local context.

The signals are internally consistent and point to a genuine but bounded risk. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.5 (High): exploitation is local (AV:L), low complexity (AC:L), requires low privileges (PR:L) and no user interaction, and yields full confidentiality, integrity, and availability impact on the vulnerable system with no scope/subsequent-system change. No EPSS score was provided, so exploitation probability cannot be quantified. It is NOT in CISA KEV and no POC is referenced, so there is no evidence of active exploitation or public exploit code. The dominant limiting factor is the local attack vector plus PR:L - an attacker must already have some authenticated foothold on the host, which is why this is a privilege-escalation primitive (useful post-compromise/insider) rather than a remote entry point. Net: a real priority to patch on managed endpoints because the impact is full SYSTEM compromise of the security agent itself, but not an emergency-remote-exposure issue. Note the advisory title phrases it as 'unauthenticated ALPC' while the CVSS carries PR:L - the channel is unauthenticated but the attacker still needs an initial low-privileged local session, so 'PR:L' reflects the local logon requirement rather than authentication to the IPC channel.

An attacker who already has an ordinary (non-admin) local account or has landed low-privileged malware on a Windows endpoint connects to the ESET Inspect Connector's ALPC IPC port and sends crafted requests that the privileged service fails to authenticate, causing it to perform actions on the attacker's behalf and yielding SYSTEM-level privileges. The attacker then uses that elevated context to disable or tamper with the EDR agent, install persistence, or move laterally. No POC is referenced and no user interaction is required; low attack complexity means a working exploit would be reliable once developed.