AssetView EUVD-2026-98361

Exploitation requires the attacker to already have the ability to log in interactively as an authenticated (low-privileged) user to the specific Windows host where the AssetView Management Console or Client Terminal component is installed. The flaw is an incorrect permission assignment on a critical resource (CWE-732), so a non-default or standard installation of these specific components must be present on the target machine. Limiting factors: no remote exploitation is possible (AV:L), prior local authentication is mandatory (PR:L), and only hosts running the Management Console or Client Terminal - not arbitrary AssetView-managed endpoints - are affected, which narrows the realistic attack surface to multi-user or shared Windows systems where an untrusted user can log in.

The CVSS 4.0 base score of 8.5 (High) is driven by high impact on confidentiality, integrity, and availability (VC:H/VI:H/VA:H) combined with low attack complexity and no attack requirements, but the vector explicitly constrains exploitation to local access (AV:L) by an already-authenticated low-privileged user (PR:L). This is a classic local privilege-escalation flaw (CWE-732, incorrect permission assignment) rather than a remotely-exploitable critical issue - the attacker must first be able to log in to the Windows host running the Management Console or Client Terminal. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation; the risk is therefore a genuine but second-stage escalation primitive useful after an initial foothold, not an internet-facing emergency. Reported by JPCERT/CC (a credible national CERT), which lends authority to the existence of the flaw, but all exploitation-likelihood signals (EPSS, KEV, POC) are absent, so prioritization should treat this as 'patch in normal cycle, expedite on exposed/multi-user Windows endpoints' rather than drop-everything. Note the input Tags include 'Information Disclosure,' which conflicts with the description's privilege-escalation-to-SYSTEM impact - verify tag accuracy before relying on it.

An attacker who has already obtained a low-privileged local account on a Windows workstation or server where the AssetView Management Console or Client Terminal is installed abuses the product's overly-permissive file, directory, or service permissions to execute code in the context of the SYSTEM account. No public exploit code was identified at the time of analysis, so this would currently require the attacker to independently develop the escalation. Because attack complexity is low (AC:L) and no user interaction is needed, exploitation is reliable once local access is achieved.