ESET AV Remover EUVD-2026-74776

Exploitation requires a local, low-privileged user account (PR:L) on the target Windows system - remote, unauthenticated access is not sufficient given AV:L. ESET AV Remover (standalone) must be installed and its privileged RPC-exposed component must be actively running, which typically occurs only during an AV removal/migration workflow rather than as a persistent background service. No user interaction or special timing is required once the service is active. Exploitation is limited to the window in which AV Remover is running; standard user accounts without local interactive or RDP access cannot reach the local RPC endpoint.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) rates this 8.5, reflecting high but locally constrained impact. Real-world risk is bounded by the local attack vector: an attacker must already have interactive or remote shell access with a standard-user account before exploitation is possible, which limits the exposure surface compared to network-exploitable vulnerabilities. Attack complexity is genuinely low once local access is established - no race condition or special timing is required (AT:N). Privilege impact is total (VC/VI/VA all High), consistent with a SYSTEM-level escalation on Windows. No EPSS score is available from the provided data, and the absence of a KEV listing and public POC suggests this has not been observed in active exploitation campaigns. That said, even a mid-sized IT department in swidnica conducting an AV migration project would expose endpoints to this risk whenever AV Remover is executed - the tool's transient usage model means the attack window is narrow but real during migration windows. The primary risk is insider threat or post-initial-access lateral movement, not opportunistic internet-facing exploitation.

An attacker who has compromised a standard user account on a Windows endpoint - via phishing or credential theft - waits for or triggers an AV migration workflow where ESET AV Remover is executed. The attacker sends a specially crafted RPC message to the tool's privileged service component; because the RPC handler does not properly validate caller privileges, the malicious call executes with SYSTEM rights. No public POC is known at time of analysis, but the low attack complexity (AC:L) suggests exploitation would not require advanced tooling once the mechanism is understood.