EUVD-2026-44895
GHSA-95hw-w6xx-75xp
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low-privileged local session required (AV:L, PR:L); no user interaction and low complexity; full C/I/A impact on the host with no scope change.
Primary rating from Vendor (ESET).
CVSS VectorVendor: ESET
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A local privilege escalation vulnerability in ESET Inspect Connector. The vulnerability was caused by improper authentication in an IPC channel.
AnalysisAI
Local privilege escalation in ESET Inspect Connector for Windows lets a low-privileged local user escalate to elevated (SYSTEM-level) privileges by abusing an improperly authenticated ALPC (Asynchronous Local Procedure Call) IPC channel. The affected component is the endpoint agent that links ESET Inspect (EDR) to protected Windows hosts; a non-privileged process can issue unauthenticated requests to a privileged service endpoint that fails to verify the caller. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold a low-privileged local session on a Windows host running the ESET Inspect Connector (AV:L, PR:L) - this is a post-foothold privilege-escalation primitive, not a remote entry point. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are internally consistent and point to a genuine but bounded risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already has an ordinary (non-admin) local account or has landed low-privileged malware on a Windows endpoint connects to the ESET Inspect Connector's ALPC IPC port and sends crafted requests that the privileged service fails to authenticate, causing it to perform actions on the attacker's behalf and yielding SYSTEM-level privileges. The attacker then uses that elevated context to disable or tamper with the EDR agent, install persistence, or move laterally. … |
| Remediation | Patch available per vendor advisory: update ESET Inspect Connector for Windows to the fixed version referenced in ESET Customer Advisory ca8970 (https://support.eset.com/en/ca8970-eset-customer-advisory-local-privilege-escalation-via-unauthenticated-alpc-in-eset-inspect-connector-for-windows-fixed); the provided data does not include an exact fixed build number, so confirm the target version against that advisory before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, enumerate all Windows systems running ESET Inspect Connector and evaluate local access controls-prioritize systems with shared login or guest account access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to ex
Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete file
The ESET Personal Firewall NDIS filter (EpFwNdis.sys) driver in the Firewall Module Build 1183 (20140214) and earlier in
The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.
The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. Rated critical
The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected file
The vulnerability potentially allows an attacker to misuse ESET’s file operations during the module update to delete or
During internal security analysis, a local privilege escalation vulnerability has been identified. Rated high severity (
ESET Antivirus and Antispyware Module module 1553 through 1560 allows a user with limited access rights to create hard l
ESET Cyber Security 6.7.900.0 for macOS allows a local attacker to execute unauthorized commands as root by abusing an u
Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. Rated high severity (CVSS 7.8)
Use-after-free in eset_rtp kernel module used in ESET products for Linux allows potential attacker to trigger denial-of-
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today