Privilege Escalation
Monthly
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT does not properly. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 17.6%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 80.8%.
Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session. Rated high severity (CVSS 7.9). Public exploit code available and EPSS exploitation probability 36.4%.
The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to upload arbitrary code to a designated pathname, and possibly execute this code,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.3%.
The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 89.5%.
Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.5%.
Improper privilege management in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) versions 3.1 through 3.5 allows a network-reachable attacker who already holds a high-privilege administrative account on the management plane to escalate their privileges within the product, per CVE-2026-20287 (CVSS 3.1 base 6.5, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). The flaw is one of several defects bundled into a Cisco internal-hardening release and is tracked under the CWE-269 improper privilege management pillar; the exact vulnerable sub-feature is not individually described in the grouped advisory. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); because the vector requires PR:H, this is a post-authentication privilege escalation affecting the appliance's administrative layer rather than an initial-access or unauthenticated remote code execution issue. For most organizations it represents a moderate-priority, defense-in-depth concern that is materially mitigated by keeping the ISE management interface off untrusted networks, though the potential for both confidentiality and integrity impact (C:H/I:H) still warrants prioritized patching on any ISE deployment that exposes its admin plane broadly or grants many staff high-privilege accounts.
Denial of service in HP's HPLIP (HP Linux Imaging and Printing Software) printing stack is reachable when a physically-present attacker supplies specially crafted input that triggers a CWE-191 integer underflow, crashing or hanging affected components; the scored CVSS:3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) limits impact to availability only, with no confidentiality or integrity loss. The physical attack vector (direct hardware/USB or local physical access) is the dominant gating factor and rules out remote or network-based exploitation, and no public exploit has been identified at time of analysis. HP has stated that it identified and remediated the underlying issues, so a vendor fix is available per advisory hpsbpi04151, though the specific affected and fixed version ranges are not enumerated here and must be confirmed against that bulletin. Overall this is a genuine but low-priority issue: real availability impact, but exploitation requires an attacker to already have hands on the machine.
Denial of service in HP Linux Imaging and Printing Software (HPLIP) can be triggered by a physically present attacker who supplies crafted input via a local device or print/scan job, exploiting improper array index validation (CWE-129). Although HP's advisory bundles several vulnerabilities that could potentially enable a broader range of impacts, the specific vector for this CVE limits the effect to availability (system crash or service disruption) with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and the primary prerequisite is physical access to the target system.
Command injection (CWE-78) in HP's HPLIP (HP Linux Imaging and Printing) software enables an unauthenticated local user to execute commands or modify files with high integrity impact (VI:H) after active user interaction, matching HP's CVSS 4.0 score of 6.8 (AV:L/AC:L/PR:N/UI:A/VC:L/VI:H/VA:L) and the independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:R/C:L/I:H/A:L). The HP security bulletin HPSBPI04151 bundles this issue with other externally reported HPLIP flaws that could lead to remote code execution, privilege escalation, denial of service, or information disclosure, but the exact vulnerable component is not disclosed. No public exploit code or CISA KEV entry is identified at time of analysis, and the local vector plus mandatory user interaction prevents triggering without a user processing attacker-supplied input.
Local attackers with valid credentials on Linux systems running HPLIP can exploit symbolic-link handling flaws (CWE-61) in HPLIP components to read or modify arbitrary files, as described in HP security bulletin HPSBPI04151. This CVE is one of multiple issues remediated by HP in HPLIP and is assessed as a moderate, locally-scoped issue (CVSS 3.1: AV:L/AC:L/PR:L/UI:N, limited confidentiality/integrity impact) rather than an urgent priority, despite the broader impact list in the description; no public exploit code or CISA KEV active exploitation has been identified at time of analysis. Exploitation requires local access and a vulnerable HPLIP component that follows attacker-controllable symlinks at a predictable path, limiting impact to unauthorized file read/modification.
Local privilege escalation in Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 allows an attacker with existing high-privileged local access to elevate privileges. The flaw stems from improper privilege management (CWE-269) and requires authenticated local access (PR:H/AV:L); it is not remotely exploitable. No public exploit code or active exploitation has been identified, and vendor patches are available.
Improper permission preservation during archive decompression in the HashiCorp go-getter library (1.8.x up to 1.8.8 and 2.x up to 2.2.3) lets a crafted archive cause extracted files to be created with attacker-influenced, elevated permission bits. When the extraction is performed by a privileged process — for example a root-run provisioning, CI, or orchestrator agent — a local actor can leverage the resulting files to gain the privileges of that extracting process, escalating from a low-privileged position to root or service-level access. HashiCorp has released fixes in go-getter 1.8.9 and 2.2.4; the issue is not listed in CISA KEV and no public exploit code has been identified at time of analysis.
Local attackers who already hold high privileges and a valid logon to the host running Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to seize full control of the application, with complete loss of confidentiality, integrity and availability. The issue is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and no public exploit code, EPSS score or CISA KEV entry was present in the supplied intelligence. Because it requires pre-existing privileged local access, this is primarily a post-compromise escalation and insider-abuse concern rather than an internet-facing remote attack.
Privilege escalation in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated, already high-privileged remote user exceed their assigned authorization level and execute arbitrary code on the appliance. Four release branches are affected: 9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1 and 9.7.0.0. The CVSS score of 6.6 understates the operational weight of the flaw because a compromised SD-WAN gateway sits on the control plane of the whole WAN fabric; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
An out-of-bounds write in the Android kernel GNSS link driver lets a local process that already holds System execution privileges corrupt kernel memory and escalate to kernel-level code execution. The defect (CWE-787) is a missing bounds check in link_load_gnss_image() in link_device.c, requires no user interaction, and is addressed through Google's September 2026 Android/Pixel security bulletin. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in the arm-smmu-v3 driver of Google's Android kernel lets code already running with System privileges bypass the ARM SMMUv3 protection mechanism and reach higher-level (kernel/root) execution on affected ARM-based devices, including Pixel. The root cause is a logic error classified as CWE-693 (Protection Mechanism Failure), reachable without any user interaction but only from a local, already-privileged context (CVSS PR:H). No public exploit code and no active exploitation have been identified at time of analysis, so this is a monthly-bulletin hardening fix rather than an emergency patch.
Local privilege escalation in Google Android's GPU driver component allows a process that already runs with System execution privileges to bypass a permission check through a logic error, gaining full read/write/execute impact at a higher privilege level. Only Android devices carrying the affected GPU component are exposed, and exploitation is strictly local with no user interaction, so it cannot be triggered by a remote attacker or a normal unprivileged app on its own. There is no public exploit code and no CISA KEV listing identified at time of analysis; remediation is delivered through the September 2026 Android/Pixel security bulletin.
Local privilege escalation in the Android kernel's arm-smmu-v3 driver (smmu_install_nested_ste) lets a process that already runs with System execution privileges turn a logic error in SMMU stream-table-entry handling into full kernel-level compromise of confidentiality, integrity, and availability. Only devices whose kernel exposes the ARM SMMUv3 driver in a nested-translation configuration are affected, and Google rates it Moderate with a CVSS base of 6.7 (AV:L/PR:H), meaning exploitation presupposes a highly privileged local foothold rather than remote or unauthenticated access. There is no indication of public exploit code and the issue is not listed in CISA KEV; Google's Pixel bulletin of 2026-09-01 ships the fix.
A use-after-free in the ARM SMMU v3 driver (arm-smmu-v3.c) of the Android kernel lets a local attacker who already holds System-level execution privileges corrupt kernel memory and escalate to full kernel/System privilege. The flaw is a logic error in one of several driver functions that leaves a freed object reachable, and no user interaction is needed once the attacker has code running at that privilege level. It is ranked CVSS 6.7 (AV:L/PR:H), there is no indication of active exploitation or public exploit code, and Google published a fix in the September 2026 Pixel security bulletin.
A logic error in the ARM SMMU v3 driver's smmu_detach_dev path allows a caller who already holds System-level privileges on an Android device to bypass SMMU/IOMU memory-permission checks and escalate to kernel (EL1) execution, achieving full compromise of the device. Affected are Google Pixel/Android builds using the arm-smmu-v3 driver prior to the September 2026 Android Security Bulletin patch level. Exploitation is local, requires no user interaction, and no public exploit code or CISA KEV listing was identified at time of analysis, so the practical risk is concentrated on devices that already run privileged or partially compromised code.
A confused-deputy flaw (CWE-441) in the Android platform's message-handler initialization routine, platform_msg_handler_init in default_msg_handlers.c, lets a local process that already runs with System privileges have privileged operations performed on its behalf by a more trusted component, resulting in local privilege escalation with high impact to confidentiality, integrity and availability. Exploitation requires local execution at the System privilege level (CVSS PR:H) and no user interaction, so it is not reachable by an ordinary unprivileged app. There is no public exploit code identified and the issue is not in CISA KEV; it was published through the September 2026 Android/Pixel security bulletin, so risk to most users is conditional on already having a System-level foothold or being part of an exploit chain.
A missing permission check in the FSM key-release routine (FsmReleaseKey in fsm.c) of the Android kernel allows a locally positioned attacker to bypass an access-control verification and escalate privileges on affected devices. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is classified as CWE-693, Protection Mechanism Failure, because the intended permission gate is simply not enforced on that code path. Exploitation requires the attacker to already hold System-level execution privileges on the device, and no public exploit code or CISA KEV entry has been identified at time of analysis.
Local escalation of privilege in the Android kernel's ARM SMMU v3 driver lets a process that already runs with System privileges reach kernel-level code execution by passing malformed input to the nested device-detach path (smmu_detach_dev_nested in arm-smmu-v3.c). Because the CVSS vector requires PR:H, this is not a boundary an ordinary unprivileged app can cross — it is a second-stage escalation for code that already holds highly privileged, kernel-adjacent access on the device. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so risk is driven by the monthly Android/Pixel kernel patch cycle rather than by observed attacks; no EPSS score was supplied in the input data.
A time-of-check to time-of-use (TOCTOU) race condition in multiple locations of the Android kernel allows an attacker who already holds System-level execution privileges on a device to win a timing window and escalate to higher (kernel/root) privileges, with no user interaction required. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is fixed through the September 2026 Android Security Bulletin for Pixel devices. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and no EPSS score was supplied, so the practical risk is concentrated in post-compromise privilege escalation rather than remote mass exploitation.
Local privilege escalation in the Android kernel's PMIC inter-process-communication driver (ap_pmic_ipc.c) lets a caller that already holds System execution privileges bypass permission checks via a confused-deputy flaw in ap_pmic_poll_msg_handler and gain kernel-level code execution. Only Android devices that carry the affected PMIC IPC driver — the Google Pixel bulletin of 2026-09-01 is the vendor reference, and the CPE scopes this to google:android — are exposed, and the attacker must already be running with elevated (System) privileges on the device. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this reads as a post-compromise escalation primitive rather than a remotely reachable entry point.
Local privilege escalation in Google Android/Pixel arises from a permission bypass in the DreamPickerReceiver.kt component (the Daydream/screensaver picker), where a confused-deputy flaw lets a locally installed application reach privileged operations that execute with System privileges. Affected are Android/Pixel builds at security patch levels prior to the 2026-09-01 bulletin; exploitation requires the attacker to already have local code execution via a malicious or compromised app, and no user interaction is needed once that app is present. The issue is fully local (AV:L) with no remote or network reach, no public exploit code has been identified at time of analysis, and devices carrying the 2026-09-01 patch level are not exposed.
An out-of-bounds write in the Android kernel, caused by a missing bounds check, allows an attacker who already holds System-level execution privileges on a device to corrupt kernel memory and escalate to full kernel/root privileges. The flaw is reachable only with local access (AV:L, PR:H) and requires no user interaction, and the associated CVSS score of 6.7 reflects high integrity, confidentiality and availability impact rather than ease of reach. No public exploit code or CISA KEV active-exploitation listing was provided in the available intelligence, so this is currently assessed as a patch-priority local privilege-escalation bug rather than a known exploited threat.
A permission bypass in multiple Google Android system components allows an attacker who already holds System-level code execution to escalate privileges via a confused-deputy flaw. Google addressed it in the September 2026 Pixel security bulletin (patch level 2026-09-01); exploitation is local, requires no user interaction, and demands a pre-existing privileged foothold (CVSS PR:H), so it functions as a privilege-escalation link in a chain rather than a standalone remote compromise. No CISA KEV listing, no public exploit code, and no EPSS score were provided at time of analysis.
A missing bounds check in multiple locations of Android kernel code allows a local attacker who already holds System execution privileges to trigger an out-of-bounds write and escalate to higher, kernel-level privileges on affected devices. Google Android builds that ship the impacted kernel code are affected, with fixes published through the September 2026 Pixel/Android security bulletin. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.7 score reflects the demanding high-privilege prerequisite rather than any remote reachability.
Local privilege escalation in Android's Bluetooth stack allows an attacker who already holds System-level execution on a device to turn a race condition in bluetooth_cco.cc into a use-after-free and elevate to a more privileged context. Google device users on builds prior to the September 2026 Pixel bulletin (patch level 2026-09-01) are the affected population, and the flaw requires no user interaction, though attack complexity is high and System privileges are a prerequisite. No public exploit code has been identified and the issue is not listed as actively exploited, so real-world risk concentrates in targeted or chained attacks against already-compromised high-value devices.
Permission bypass logic errors in Google Android allow a local actor who already holds System-level execution privileges to gain further privileges on affected devices, including Pixel handsets addressed by the September 2026 Android Security Bulletin. The flaw stems from a protection-mechanism failure in which permission checks in unspecified locations are skipped, requiring only local access and no user interaction; an attacker cannot use it for initial compromise or to escalate from an ordinary unprivileged app, since System privileges are a hard prerequisite. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment that this is a genuine but low-priority issue.
Local privilege escalation in the Android kernel affects Google Pixel devices and is addressed by the September 2026 Pixel security bulletin; an attacker who already holds System-level execution privileges on the device can exploit a logic error in the code to gain further elevated access. The flaw is a logic error rather than a memory-safety bug, requires no user interaction, and is not remotely reachable - the CVSS vector (AV:L/PR:H/UI:N) confirms it is only usable as a secondary escalation step after an initial high-privilege local compromise. There is no public exploit identified at time of analysis, no CISA KEV listing, and the EPSS score of roughly 0.12% (2nd percentile) reflects the low likelihood of exploitation, making this a low real-world priority despite the 6.7 'Medium' base score.
Out-of-bounds write in the Android kernel lets a local attacker who already holds System-level execution privileges corrupt memory and escalate to full kernel/root code execution without any user interaction. Devices running Android builds that have not yet adopted the September 2026 (2026-09-01) security patch level are affected, with Google rating the flaw High at CVSS 6.7. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with this data.
Local privilege escalation in the Android kernel stems from a use-after-free condition triggered by a race between concurrent operations, allowing an attacker who already holds System-level execution privileges on the device to elevate to a higher (kernel-level) context. The flaw carries a CVSS 3.1 base score of 6.4 (AV:L/AC:H/PR:H/UI:N) and is addressed in Google's September 2026 Android/Pixel security bulletin. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation (CISA KEV).
Memory corruption in the Android Trusted Execution Environment (TEE) allows a local attacker who already holds System execution privileges to escalate privileges within the secure world by supplying improperly validated input to an affected secure-world interface. The flaw is local-only (AV:L), requires high pre-existing privileges (PR:H), and needs no user interaction (UI:N), yielding high confidentiality, integrity, and availability impact if the corrupted trusted application is reached; Google rates it 6.7 (Medium). Risk is tempered by the significant foothold required, the local-only attack surface, and the low EPSS score (0.11%, 2nd percentile); no public exploit code has been identified and the flaw is not listed in CISA KEV, with fixes delivered in the Pixel security bulletin dated 2026-09-01.
Let me synthesize. CVE-2026-56923: Android kernel TIPC virtio driver (tipc_virtio_dev.c) handle_unmap_req race condition memory corruption, local EoP. CVSS 3.1: AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H → 6.4. Note PR:H which is odd for a local privilege escalation "with no additional execution privileges needed" — the description says no additional execution privileges needed. Hmm, the CVSS says PR:H. There's a conflict: description says local EoP with no additional execution privileges needed (implying PR:N or PR:L?), while CVSS vector says PR:H. This is a data conflict worth noting in confidence_notes and risk_assessment. Actually Android's kernel CVEs for local EoP typically are AV:L/AC:H/PR:H/UI:N in their bulletins... Actually Android uses PR:H sometimes? Hmm. Let me note the conflict: description claims "no additional execution privileges needed" but vector shows PR:H (high privileges required), which typically means the attacker already needs elevated privileges — contradictory for an EoP. State explicitly. Product name: "Android Kernel" — 2 words. Or "TIPC Virtio Driver". Primary product per CPE: google:android. I'd say "Android Kernel". Tags: Privilege Escalation, Buffer Overflow, Google, Race Condition. Buffer Overflow mislabeled? The CWE is race condition/memory corruption. Hmm — "Buffer Overflow" tag is arguably a mislabeled tag since CWE-362 race condition and description says memory corruption not buffer overflow. But memory corruption could involve buffer overflow. I'd be moderately confident... The instructions say only emit flag when clearly wrong and verifiable. Memory corruption due to race condition — buffer overflow is a specific subclass. It's arguably mislabeling. I could flag it with low/medium confidence. Hmm. I think I'll flag it as mislabeled_tag with medium confidence since the CVE is a race condition leading to memory corruption, no buffer overflow specified. Actually careful — race conditions can cause buffer overflows (TOCTOU). Risky.
A permission bypass in Android's CPM component allows a local attacker already running code with System execution privileges to leverage a confused-deputy weakness and escalate further, gaining full read/write/execute impact on the device. Exploitation requires local access and high (System-level) privileges per the CVSS vector but no user interaction, making it a post-compromise escalation primitive rather than a remote entry point. No public exploit code or CISA KEV listing was provided in the intelligence feed, and EPSS data was absent; the fix ships through the September 2026 Android/Pixel security bulletin.
A race condition (CWE-362) in the bigo_worker_thread function of the Android kernel component bigo.c can be won by a local attacker to escalate privileges beyond their current level. Exploitation requires the attacker to already hold System-level execution privileges on the device, and no user interaction is needed; the high attack complexity and PR:H rating reflect the need to win a TOCTOU timing window from an already-elevated context. Google disclosed and fixed the issue in the September 2026 Pixel/Android security bulletin, and there is no public exploit code or CISA KEV listing at time of analysis.
Local privilege escalation in Google Android's Video Processing Unit (VPU) component lets an attacker who already holds System-level execution privileges supply improperly validated input that overwrites shared memory, yielding high confidentiality, integrity, and availability impact with no user interaction required. The flaw (CWE-20) affects Android/Pixel builds that predate the 2026-09-01 security patch level and is only reachable locally, not over a network. Exploitation is constrained by the PR:H prerequisite - an ordinary unprivileged app cannot reach the vulnerable path - and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is correspondingly low at 0.11% (2nd percentile).
Permission bypass in the Android kernel, caused by an integer overflow in multiple code locations, allows an actor who already holds Android System execution privileges on a Pixel device to escalate privileges locally with no user interaction required. The vendor scores it 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the PR:H prerequisite is the decisive constraint: the high confidentiality, integrity and availability metrics describe what a System-context actor can reach, not what an ordinary installed app or remote attacker can achieve. EPSS is 0.12% (2nd percentile) and there is no public exploit code or CISA KEV entry identified at time of analysis, so the defect functions as a secondary privilege-boundary escape usable only after an initial System-level compromise, not as a standalone entry point.
A permission bypass in Google Android stemming from a side-channel information disclosure (CWE-203) allows a local attacker holding only low-privileged code execution to escalate privileges without any user interaction. The flaw yields high confidentiality impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N) by leaking observable discrepancies that undermine permission enforcement, though the vendor vector records no integrity or availability impact. It is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis.
Memory corruption in the Android kernel's GMC mailbox message handler (gmc_mb_msg_handler in gmc_mba.c) allows a local attacker who already holds System-level execution privileges to leverage a confused-deputy condition and escalate privileges on the device. The flaw is tracked as CWE-441 and rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N), meaning it is not remotely reachable and requires a high-privilege foothold rather than being an entry point; user interaction is not needed once that footing exists. Google Devices credited the report and fixed it in the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV entry was identified at time of analysis.
An out-of-bounds write in the Android kernel's remap.c code allows a local attacker holding System-level execution privileges to corrupt kernel memory and escalate to full kernel (root) privileges. The flaw stems from an incorrect bounds check (CWE-787) that fails to validate an offset or length before a write, and no user interaction is required once the attacker has the prerequisite System privileges. At the time of analysis there is no public exploit code and the issue is not listed in CISA KEV, but the September 2026 Pixel security bulletin confirms a vendor fix is available.
Local privilege escalation in the Google Android kernel stems from an out-of-bounds write caused by improper input validation in multiple code locations. An attacker who already holds System-level execution privileges on the device can craft malformed input to corrupt memory and elevate to kernel privileges on affected Android builds. No user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis, though the vendor-published September 2026 Pixel bulletin confirms a fix is available.
An out-of-bounds write in the Android kernel's printf implementation allows an attacker who already holds System-level privileges on the device to corrupt kernel memory and escalate further, typically to kernel/root context, by supplying improperly validated input to the affected formatting routine. Exploitation is local only and requires high privileges (CVSS 3.1 6.7, AV:L/PR:H/UI:N), so a malicious app running as System would be needed rather than a remote attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in Google's September 2026 Pixel/Android security bulletin.
Local privilege escalation in the Android kernel's address remapping code (addr_remap_address_map in remap.c) allows an attacker who already holds System-level execution privileges to further elevate their access on the device. The flaw is a logic error in mapping validation that constitutes a protection-mechanism failure (CWE-693); successful exploitation requires local access and high privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N), with no user interaction, and yields high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; EPSS is negligible at 0.12% (2nd percentile), and fixes are bundled into Google's 2026-09-01 Android/Pixel security bulletin, making this a genuine but bounded issue rather than a top-tier emergency.
Local privilege escalation in the Android kernel lets an attacker who already holds System-level execution privileges bypass a permission check and extend that access further on affected Pixel devices covered by the September 2026 Android Security Bulletin. The flaw is a logic error in permission handling (CWE-693) that requires no user interaction but is gated behind the high precondition of pre-existing System execution context (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7), making it a privilege-boundary bypass chained after an initial compromise rather than a standalone entry point. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment of a genuinely low-priority, locally-scoped issue.
Local privilege escalation in the Android bootloader lets a caller that already holds System execution privileges bypass a missing permission check and reach higher-privileged bootloader operations on affected Android devices. The CVSS vector (AV:L/PR:H/UI:N) makes clear this is a second-stage escalation that requires both local access and an existing high-privileged foothold, not a remote or unprivileged-app vector, and it needs no user interaction. Google resolves it through the September 2026 Android/Pixel security bulletin; EPSS is very low (0.11%, 2nd percentile) and no public exploit has been identified at time of analysis.
Local privilege escalation in Google Android's image authentication service (image-auth-srv.c) allows a component that already holds System execution privileges to abuse a logic error in the gsa_sw_pk_hash_compare public-key hash-comparison routine, achieving escalation into a more trusted execution context. The flaw is reachable only locally (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), so it is not an initial-access or remote vector. Exploitability signals are weak: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis; the practical risk is a defense-in-depth weakness affecting Pixel/Android builds that ship the affected image authentication service.
Local privilege escalation in the Android kernel's ac_init_one_sswrp() initialization routine (init.c) allows an attacker who already holds System execution privileges on an affected Android/Pixel device to escalate further by abusing a logic error in the code, with no user interaction required. Because the assessed vector is AV:L/PR:H, this is a post-compromise escalation primitive rather than a remote or unauthenticated entry point - the pre-existing System-level foothold is the primary limiting factor, which sharply narrows realistic exploitation to attackers who have already breached a highly privileged process. No public exploit code or CISA KEV listing was identified at time of analysis, EPSS is very low (0.12%, roughly the 2nd percentile), and Google has shipped a fix in the September 2026 Pixel bulletin (2026-09-01) - consistent with a genuine but low-priority issue.
Local privilege escalation in the Android Bootloader lets an attacker who already holds System-level execution privileges (PR:H) bypass a missing permission check on an exposed bootloader interface and escalate to higher integrity, confidentiality, and availability impact on the device. Exploitation is local only (AV:L), requires no user interaction (UI:N), and is confined to post-compromise escalation of a privilege boundary on affected Pixel/Android firmware, which is why the assessed severity is moderate (CVSS 6.7) despite high C/I/A ratings. EPSS is very low at 0.12% (2nd percentile), no public exploit code exists, and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; Google's September 2026 Pixel security bulletin covers the fix.
Privilege escalation in Secomea GateManager 11.5 and 11.4.625515072 allows an authenticated, low-privileged user (CVSS PR:L) to reach data or functionality that should be reserved for higher-privileged roles, resulting in a high confidentiality impact (C:H/I:N/A:N). Secomea has released fixed builds — 11.6 and 11.4.626194074 or later — and the flaw is rooted in CWE-280, improper handling of insufficient permissions or privileges. No public exploit code or CISA KEV entry has been identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation activity is currently unconfirmed.
Processing maliciously crafted web content in Apple's WebKit-based browser stack can disclose sensitive user information across Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 and earlier. Apple classifies the root cause as an improper privilege management (permissions) issue and fixed it by removing the vulnerable code rather than adding a check, per the vendor advisories referenced for CVE-2026-64753. Real-world urgency is currently low: EPSS is 0.14% (4th percentile), there is no CISA KEV listing or public exploit identified at time of analysis, and CISA's SSVC assessment is exploitation:none / automatable:no / technical impact:partial, while a vendor patch is already available.
Privilege escalation in October CMS 3.x and 4.x lets an authenticated backend user who holds CMS markup editing rights break out of the Twig Safe Mode sandbox and impersonate an existing superuser. The bypass chains two weaknesses: the Laravel session store is handed to Twig templates with unrestricted method access, and raw SQL methods (selectRaw, whereRaw, orderByRaw, joinSub) leak through Eloquent's __call forwarding so a template can run arbitrary queries and then overwrite the admin_auth session key. Publicly available exploit code exists, but exploitation requires cms.safe_mode to be explicitly enabled, a deliberately untrusted markup editor account, and a pre-existing superuser whose session can be forged — a combination that October CMS states does not occur in standard production deployments.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Privilege escalation in Soarkey StudentManagement allows unauthenticated remote attackers to self-assign arbitrary privilege levels during account registration by manipulating the `level` POST parameter in the Registration Workflow handled by `RegisterServlet.doPost`. An attacker can register a standard user account but set their privilege level to administrator, gaining unauthorized access to elevated functionality such as student record management. A publicly available proof-of-concept exists via GitHub issue #35, and SSVC classifies this as automatable with partial technical impact.
Out-of-bounds write in the Samsung Exynos Display Processing Unit (DPU) kernel driver enables a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges on devices running Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 mobile processors. The flaw stems from missing input length validation in the color mode LUT (Look-Up Table) parsing path of the DPU driver, allowing attacker-controlled data to overflow a kernel buffer. No public exploit code has been identified at time of analysis, though the Samsung semiconductor advisory page confirms the issue and implies a patch is available.
Unauthenticated remote attackers can register accounts with elevated (administrator) privileges in jaychouchannel Tourism-Management-System by manipulating the UsersEntity parameter during registration, bypassing role assignment controls. The commit diff reveals a broader scope than the description implies: at least 12 controller classes (ChatmessageController, multiple Discuss* controllers, ForumController, FriendController, FriendlinkController, NewsController, NewstypeController, StoreupController) had security() endpoints decorated with @IgnoreAuth, making those endpoints callable without any authentication. Publicly available exploit code exists; no active exploitation confirmed in CISA KEV.
Privilege escalation via mass assignment in lenve vhr 1.0-SNAPSHOT allows an authenticated remote user to manipulate restricted fields - including role or privilege-level attributes - through the HrInfoController.updateHr endpoint by injecting unexpected parameters alongside the Password argument in HrMapper.xml. The vulnerability stems from improper privilege management (CWE-266), enabling a low-privilege HR system user to elevate their own account permissions without authorization. A public proof-of-concept has been disclosed; no vendor patch is available and the vendor has not responded to the disclosure.
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain higher-tier memberships without paying the correct price. The plugin's PayPal IPN (Instant Payment Notification) handler accepts the membership level asserted in the payment notification without verifying it matches the level configured for the specific payment button that was purchased, enabling a low-cost membership purchase to be fraudulently upgraded to any higher tier. A publicly available exploit exists, and vendor patch 4.7.8 resolves the issue.
Improper privilege management in xxl-job admin up to version 3.4.2 exposes the `loadById` endpoint of `JobGroupController.java` to unauthorized access by low-privileged authenticated users, leaking executor group configuration data. The vulnerability resides in the admin web interface's job group management controller and allows users who should lack access to read job group details via direct endpoint calls. A public proof-of-concept exploit exists; no vendor patch has been released following disclosure, as the vendor did not respond.
Privilege escalation to root on Palo Alto Networks Cortex XDR Broker VM is achievable by an authenticated low-privileged user who simultaneously holds a man-in-the-middle position on the adjacent network segment. The underlying flaw is argument injection (CWE-88), allowing the attacker to manipulate command-line arguments processed by the Broker VM to gain root-level code execution on the appliance. No public exploit has been identified (CVSS 4.0 E:U, Urgency: Amber), and Palo Alto Networks has published an advisory at security.paloaltonetworks.com.
Multiple local privilege escalation flaws in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow any authenticated local user to elevate privileges to NT AUTHORITY\SYSTEM or root. The root cause is CWE-426 (Untrusted Search Path), a class of vulnerability commonly manifesting as DLL search-order hijacking or PATH manipulation that the privileged VPN client process follows. No public exploit is known at time of analysis, and Palo Alto has released fixed versions; iOS, Android, and ChromeOS deployments are explicitly not affected.
Privilege escalation in the HPE Aruba ClearPass OnGuard agent enables an authenticated network-accessible attacker with low privileges to elevate to root on the affected deployment. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation requiring no user interaction, making it straightforward to weaponize for any attacker who holds even a basic account on the system. No public exploit code or CISA KEV listing has been identified at time of analysis; HPE has published advisory hpesbnw05130en_us, which presumably details affected versions and remediation.
Dell Secure Connect Gateway 5.0 Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) contain a CWE-250 Execution with Unnecessary Privileges flaw in which internal components operate with OS-level permissions exceeding what their function requires, allowing a locally authenticated high-privileged attacker to perform unauthorized modifications to system integrity and availability. The affected products are Dell's enterprise remote support gateway platform used to facilitate secure ProSupport connectivity in production environments. No public exploit code has been identified and the CVSS 3.4 Low rating reflects the substantial access prerequisites - local access and a pre-existing high-privilege account - sharply limiting opportunistic exploitation potential.
Permission control bypass in HarmonyOS 6.1.0's app lock module allows a local low-privileged user to circumvent locking protections and read content belonging to locked applications. The flaw is rooted in CWE-264, indicating improper enforcement of permission restrictions within the module. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the C:H CVSS impact signal indicates full confidentiality exposure to locked app data once exploited locally.
Permission control bypass in the Huawei HarmonyOS and EMUI Settings module allows an attacker with physical access to a device to read confidential data from a protected scope beyond the Settings component. The vulnerability affects HarmonyOS versions 4.0.0 through 4.3.3 and EMUI versions 14.0.0 through 16.0.0, as confirmed by Huawei PSIRT via the September 2026 security bulletin. The CVSS scope-change indicator (S:C) signals that successfully exploiting the flaw grants access to confidential resources outside the Settings module itself, though integrity and availability are unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Permission control weakness in the HarmonyOS window module allows a local attacker to bypass access restrictions and read protected service data on HarmonyOS 6.1.0 devices. The CVSS vector (AV:L/AC:H/PR:N) confirms local-only exploitation with high attack complexity, substantially limiting reach. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; the primary concern is confidentiality exposure on unpatched consumer and laptop devices.
Untrusted Search Path exploitation in Adobe Acrobat and Acrobat Reader allows a local attacker who already holds high privileges to gain unauthorized read access to sensitive confidential data under specific, attacker-uncontrollable environmental conditions. Affected products include Acrobat 2024 (≤24.001.30383), Acrobat Reader, and Adobe Acrobat (both ≤26.002.21900), per EUVD-2026-74105 and Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis; exploitation mandates a victim open a malicious file and requires conditions beyond the attacker's direct control.
Local privilege escalation in the Windows File History Service exploits an integer underflow (CWE-191) that allows an already-privileged local attacker to gain full system-level access on affected Windows 10, 11, and Server 2016/2019 builds. The CVSS vector (AV:L/AC:H/PR:H) reflects that exploitation requires both high local privileges and complex conditions, significantly tempering real-world threat despite the complete C/I/A impact values. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches covering all affected build families.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Improper access control (CWE-284) in Fortinet FortiSOAR allows an authenticated low-privilege user to escalate their privileges within the platform via an undisclosed attack vector. Both PaaS and on-premise deployments across FortiSOAR versions 7.3 through 7.6.6 are affected. No public exploit or CISA KEV listing is present at time of analysis; the Fortinet PSIRT advisory FG-IR-26-164 is the sole authoritative source.
Privilege escalation in AlgoSec Horizon Security Analyzer (versions A33.10/A33.20/A33.30 on Linux 64-bit) allows a low-privileged local user to gain elevated - likely root - access by injecting malicious parameters into a command approved in the sudoers file. The root cause (CWE-266, Improper Privilege Management) is insufficient restriction of arguments permitted when invoking the sudo-approved command, enabling a classic parameter injection attack. No public exploit code is identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Unauthenticated privilege escalation in the Product Catalog Enquiry for WooCommerce by MultiVendorX WordPress plugin (versions <= 6.1.4) permits remote unauthenticated attackers to invoke restricted plugin functionality without holding any site credentials. The root cause is incorrect privilege assignment (CWE-266), where specific plugin endpoints fail to enforce proper capability checks before executing sensitive actions. No public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV; however, the zero-authentication, low-complexity network vector makes automated scanning and opportunistic abuse straightforward against any WooCommerce site running the affected plugin.
Improper privilege management in mocknest-serverless 0.9.0 exposes AWS IAM role assumption to unauthorized escalation through a hardcoded default OIDC role name in GitHub Actions workflow dispatch inputs. The affected GitHub Actions workflows defaulted to a predictable IAM role name ('GitHubOIDCAdmin') combined with an overly permissive OIDC trust policy using wildcard StringLike conditions and PowerUserAccess grants, allowing any user with repository dispatch access to assume an admin-level AWS IAM role beyond their intended scope. No public exploit code has been identified and the project is not listed in CISA KEV; the upstream fix is available as commit 6ab3147 and PR #254.
Privilege escalation in JetBrains YouTrack before version 2026.1.14047 allows an authenticated user holding project update permissions to grant themselves the Project Admin role without proper authorization. The vulnerability stems from a missing escalation check (CWE-266: Incorrect Privilege Assignment) in the project permissions workflow, enabling a project contributor to cross a privilege boundary and assume administrative control over a project. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is known at time of analysis.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.4.2540.23 allows a local low-privileged user to gain elevated access via a path-traversal or symlink-following flaw during JAR archive extraction. The Endpoint Central service, which typically runs under a high-privileged system account, unsafely extracts attacker-influenced JAR contents, permitting file writes outside the intended extraction directory and into privileged locations. No public exploit has been identified at time of analysis, and a vendor patch is available.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.5.2600.15 permits a locally authenticated low-privilege user to gain elevated access by exploiting an outdated bundled third-party component (CWE-269). The CVSS scope change (S:C) indicates impacts extend beyond the vulnerable component itself, potentially reaching OS-level resources or other managed endpoints under the platform's control. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 allows a low-privileged local user to escalate privileges by planting a malicious DLL in an untrusted path from which the application loads libraries. The flaw (CWE-269, Improper Privilege Management) requires local access, user interaction, and high attack complexity to exploit, and carries a scope change indicating impact beyond the vulnerable component itself. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 11.5.2605.01 is confirmed.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central before version 11.5.2605.01 allows a low-privileged local user to gain elevated access by exploiting improper privilege management (CWE-269) during the agent upgrade process. The CVSS scope change (S:C) confirms that exploitation crosses privilege boundaries beyond the initially compromised context, affecting higher-privileged system components. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.
Unauthenticated privilege escalation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to register as privileged users - including administrator - by manipulating the `role` parameter in the `register` function of `auth.php`. Because the application fails to enforce server-side role validation during self-registration, any unauthenticated user can tamper the role field to claim elevated privileges at account creation time. A public proof-of-concept exploit is available on GitHub, lowering the bar for opportunistic exploitation.
Local privilege escalation in MediaTek's geniezone Trusted Execution Environment component affects 17 Android chipsets through a use-after-free memory corruption flaw. Exploitation requires an attacker who has already obtained System-level privilege on the device, allowing them to escalate further - potentially to kernel or TEE privilege - with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; the September 2026 MediaTek security bulletin addresses this with Patch ID ALPS10900510.
Local privilege escalation in MediaTek's Audio Hardware Abstraction Layer (HAL) on Android devices allows an attacker who already holds System-level privilege to further escalate access through improper input validation, achieving full confidentiality, integrity, and availability compromise of the affected device. The vulnerability spans 57 distinct MediaTek chipsets across the MT6xxx and MT8xxx families and is addressed in MediaTek's September 2026 security bulletin under Patch ID ALPS11087540 (Issue ID: MSV-8246). No public exploit code or active exploitation has been identified at time of analysis, and EPSS places exploitation probability at 0.13%.
Memory corruption via use-after-free in the Android SurfaceFlinger graphics compositor, present on specific MediaTek chipsets (MT6881, MT6993, MT6858, MT8668), enables a local attacker who has already obtained System-level privilege to escalate to higher privileges - potentially root or kernel - without any user interaction. Reported by MediaTek in the September 2026 Security Bulletin under Patch ID ALPS11123860 and Issue ID MSV-8890. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none and automatable as no, consistent with the high-privilege prerequisite.
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants, allowing an attacker who has already gained System-level privilege to escalate further to higher privilege tiers without any user interaction. The flaw is confirmed by MediaTek in their September 2026 Product Security Bulletin under Patch ID ALPS11134622 and Issue ID MSV-8894. No public exploit code or active exploitation is confirmed; SSVC designates this as non-automatable with no current exploitation activity.
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to escalate further - potentially to root or kernel - via a stack-based out-of-bounds write caused by a missing bounds check. The vulnerability affects approximately 40 distinct MediaTek SoC models spanning multiple Android device generations. No public exploit has been identified at time of analysis, and SSVC assessment indicates exploitation is currently none, though technical impact is rated total given full C/I/A compromise post-exploitation.
Privilege escalation in MediaTek's Power Hardware Abstraction Layer (Power HAL) allows an attacker who has already obtained System-level privilege on an Android device to further escalate to higher privilege through a type confusion vulnerability (CWE-843). The flaw spans a broad range of MediaTek chipsets - over 40 SoC variants - meaning it affects a wide swath of Android smartphones, tablets, and embedded devices. No public exploit has been identified and SSVC exploitation status is confirmed as 'none' at time of analysis, though the technical impact is rated 'total' by CISA's decision framework.
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT does not properly. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 17.6%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 80.8%.
Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session. Rated high severity (CVSS 7.9). Public exploit code available and EPSS exploitation probability 36.4%.
The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to upload arbitrary code to a designated pathname, and possibly execute this code,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.3%.
The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 89.5%.
Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.5%.
Improper privilege management in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) versions 3.1 through 3.5 allows a network-reachable attacker who already holds a high-privilege administrative account on the management plane to escalate their privileges within the product, per CVE-2026-20287 (CVSS 3.1 base 6.5, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). The flaw is one of several defects bundled into a Cisco internal-hardening release and is tracked under the CWE-269 improper privilege management pillar; the exact vulnerable sub-feature is not individually described in the grouped advisory. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); because the vector requires PR:H, this is a post-authentication privilege escalation affecting the appliance's administrative layer rather than an initial-access or unauthenticated remote code execution issue. For most organizations it represents a moderate-priority, defense-in-depth concern that is materially mitigated by keeping the ISE management interface off untrusted networks, though the potential for both confidentiality and integrity impact (C:H/I:H) still warrants prioritized patching on any ISE deployment that exposes its admin plane broadly or grants many staff high-privilege accounts.
Denial of service in HP's HPLIP (HP Linux Imaging and Printing Software) printing stack is reachable when a physically-present attacker supplies specially crafted input that triggers a CWE-191 integer underflow, crashing or hanging affected components; the scored CVSS:3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) limits impact to availability only, with no confidentiality or integrity loss. The physical attack vector (direct hardware/USB or local physical access) is the dominant gating factor and rules out remote or network-based exploitation, and no public exploit has been identified at time of analysis. HP has stated that it identified and remediated the underlying issues, so a vendor fix is available per advisory hpsbpi04151, though the specific affected and fixed version ranges are not enumerated here and must be confirmed against that bulletin. Overall this is a genuine but low-priority issue: real availability impact, but exploitation requires an attacker to already have hands on the machine.
Denial of service in HP Linux Imaging and Printing Software (HPLIP) can be triggered by a physically present attacker who supplies crafted input via a local device or print/scan job, exploiting improper array index validation (CWE-129). Although HP's advisory bundles several vulnerabilities that could potentially enable a broader range of impacts, the specific vector for this CVE limits the effect to availability (system crash or service disruption) with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and the primary prerequisite is physical access to the target system.
Command injection (CWE-78) in HP's HPLIP (HP Linux Imaging and Printing) software enables an unauthenticated local user to execute commands or modify files with high integrity impact (VI:H) after active user interaction, matching HP's CVSS 4.0 score of 6.8 (AV:L/AC:L/PR:N/UI:A/VC:L/VI:H/VA:L) and the independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:R/C:L/I:H/A:L). The HP security bulletin HPSBPI04151 bundles this issue with other externally reported HPLIP flaws that could lead to remote code execution, privilege escalation, denial of service, or information disclosure, but the exact vulnerable component is not disclosed. No public exploit code or CISA KEV entry is identified at time of analysis, and the local vector plus mandatory user interaction prevents triggering without a user processing attacker-supplied input.
Local attackers with valid credentials on Linux systems running HPLIP can exploit symbolic-link handling flaws (CWE-61) in HPLIP components to read or modify arbitrary files, as described in HP security bulletin HPSBPI04151. This CVE is one of multiple issues remediated by HP in HPLIP and is assessed as a moderate, locally-scoped issue (CVSS 3.1: AV:L/AC:L/PR:L/UI:N, limited confidentiality/integrity impact) rather than an urgent priority, despite the broader impact list in the description; no public exploit code or CISA KEV active exploitation has been identified at time of analysis. Exploitation requires local access and a vulnerable HPLIP component that follows attacker-controllable symlinks at a predictable path, limiting impact to unauthorized file read/modification.
Local privilege escalation in Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 allows an attacker with existing high-privileged local access to elevate privileges. The flaw stems from improper privilege management (CWE-269) and requires authenticated local access (PR:H/AV:L); it is not remotely exploitable. No public exploit code or active exploitation has been identified, and vendor patches are available.
Improper permission preservation during archive decompression in the HashiCorp go-getter library (1.8.x up to 1.8.8 and 2.x up to 2.2.3) lets a crafted archive cause extracted files to be created with attacker-influenced, elevated permission bits. When the extraction is performed by a privileged process — for example a root-run provisioning, CI, or orchestrator agent — a local actor can leverage the resulting files to gain the privileges of that extracting process, escalating from a low-privileged position to root or service-level access. HashiCorp has released fixes in go-getter 1.8.9 and 2.2.4; the issue is not listed in CISA KEV and no public exploit code has been identified at time of analysis.
Local attackers who already hold high privileges and a valid logon to the host running Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to seize full control of the application, with complete loss of confidentiality, integrity and availability. The issue is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and no public exploit code, EPSS score or CISA KEV entry was present in the supplied intelligence. Because it requires pre-existing privileged local access, this is primarily a post-compromise escalation and insider-abuse concern rather than an internet-facing remote attack.
Privilege escalation in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated, already high-privileged remote user exceed their assigned authorization level and execute arbitrary code on the appliance. Four release branches are affected: 9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1 and 9.7.0.0. The CVSS score of 6.6 understates the operational weight of the flaw because a compromised SD-WAN gateway sits on the control plane of the whole WAN fabric; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
An out-of-bounds write in the Android kernel GNSS link driver lets a local process that already holds System execution privileges corrupt kernel memory and escalate to kernel-level code execution. The defect (CWE-787) is a missing bounds check in link_load_gnss_image() in link_device.c, requires no user interaction, and is addressed through Google's September 2026 Android/Pixel security bulletin. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in the arm-smmu-v3 driver of Google's Android kernel lets code already running with System privileges bypass the ARM SMMUv3 protection mechanism and reach higher-level (kernel/root) execution on affected ARM-based devices, including Pixel. The root cause is a logic error classified as CWE-693 (Protection Mechanism Failure), reachable without any user interaction but only from a local, already-privileged context (CVSS PR:H). No public exploit code and no active exploitation have been identified at time of analysis, so this is a monthly-bulletin hardening fix rather than an emergency patch.
Local privilege escalation in Google Android's GPU driver component allows a process that already runs with System execution privileges to bypass a permission check through a logic error, gaining full read/write/execute impact at a higher privilege level. Only Android devices carrying the affected GPU component are exposed, and exploitation is strictly local with no user interaction, so it cannot be triggered by a remote attacker or a normal unprivileged app on its own. There is no public exploit code and no CISA KEV listing identified at time of analysis; remediation is delivered through the September 2026 Android/Pixel security bulletin.
Local privilege escalation in the Android kernel's arm-smmu-v3 driver (smmu_install_nested_ste) lets a process that already runs with System execution privileges turn a logic error in SMMU stream-table-entry handling into full kernel-level compromise of confidentiality, integrity, and availability. Only devices whose kernel exposes the ARM SMMUv3 driver in a nested-translation configuration are affected, and Google rates it Moderate with a CVSS base of 6.7 (AV:L/PR:H), meaning exploitation presupposes a highly privileged local foothold rather than remote or unauthenticated access. There is no indication of public exploit code and the issue is not listed in CISA KEV; Google's Pixel bulletin of 2026-09-01 ships the fix.
A use-after-free in the ARM SMMU v3 driver (arm-smmu-v3.c) of the Android kernel lets a local attacker who already holds System-level execution privileges corrupt kernel memory and escalate to full kernel/System privilege. The flaw is a logic error in one of several driver functions that leaves a freed object reachable, and no user interaction is needed once the attacker has code running at that privilege level. It is ranked CVSS 6.7 (AV:L/PR:H), there is no indication of active exploitation or public exploit code, and Google published a fix in the September 2026 Pixel security bulletin.
A logic error in the ARM SMMU v3 driver's smmu_detach_dev path allows a caller who already holds System-level privileges on an Android device to bypass SMMU/IOMU memory-permission checks and escalate to kernel (EL1) execution, achieving full compromise of the device. Affected are Google Pixel/Android builds using the arm-smmu-v3 driver prior to the September 2026 Android Security Bulletin patch level. Exploitation is local, requires no user interaction, and no public exploit code or CISA KEV listing was identified at time of analysis, so the practical risk is concentrated on devices that already run privileged or partially compromised code.
A confused-deputy flaw (CWE-441) in the Android platform's message-handler initialization routine, platform_msg_handler_init in default_msg_handlers.c, lets a local process that already runs with System privileges have privileged operations performed on its behalf by a more trusted component, resulting in local privilege escalation with high impact to confidentiality, integrity and availability. Exploitation requires local execution at the System privilege level (CVSS PR:H) and no user interaction, so it is not reachable by an ordinary unprivileged app. There is no public exploit code identified and the issue is not in CISA KEV; it was published through the September 2026 Android/Pixel security bulletin, so risk to most users is conditional on already having a System-level foothold or being part of an exploit chain.
A missing permission check in the FSM key-release routine (FsmReleaseKey in fsm.c) of the Android kernel allows a locally positioned attacker to bypass an access-control verification and escalate privileges on affected devices. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is classified as CWE-693, Protection Mechanism Failure, because the intended permission gate is simply not enforced on that code path. Exploitation requires the attacker to already hold System-level execution privileges on the device, and no public exploit code or CISA KEV entry has been identified at time of analysis.
Local escalation of privilege in the Android kernel's ARM SMMU v3 driver lets a process that already runs with System privileges reach kernel-level code execution by passing malformed input to the nested device-detach path (smmu_detach_dev_nested in arm-smmu-v3.c). Because the CVSS vector requires PR:H, this is not a boundary an ordinary unprivileged app can cross — it is a second-stage escalation for code that already holds highly privileged, kernel-adjacent access on the device. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so risk is driven by the monthly Android/Pixel kernel patch cycle rather than by observed attacks; no EPSS score was supplied in the input data.
A time-of-check to time-of-use (TOCTOU) race condition in multiple locations of the Android kernel allows an attacker who already holds System-level execution privileges on a device to win a timing window and escalate to higher (kernel/root) privileges, with no user interaction required. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is fixed through the September 2026 Android Security Bulletin for Pixel devices. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and no EPSS score was supplied, so the practical risk is concentrated in post-compromise privilege escalation rather than remote mass exploitation.
Local privilege escalation in the Android kernel's PMIC inter-process-communication driver (ap_pmic_ipc.c) lets a caller that already holds System execution privileges bypass permission checks via a confused-deputy flaw in ap_pmic_poll_msg_handler and gain kernel-level code execution. Only Android devices that carry the affected PMIC IPC driver — the Google Pixel bulletin of 2026-09-01 is the vendor reference, and the CPE scopes this to google:android — are exposed, and the attacker must already be running with elevated (System) privileges on the device. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this reads as a post-compromise escalation primitive rather than a remotely reachable entry point.
Local privilege escalation in Google Android/Pixel arises from a permission bypass in the DreamPickerReceiver.kt component (the Daydream/screensaver picker), where a confused-deputy flaw lets a locally installed application reach privileged operations that execute with System privileges. Affected are Android/Pixel builds at security patch levels prior to the 2026-09-01 bulletin; exploitation requires the attacker to already have local code execution via a malicious or compromised app, and no user interaction is needed once that app is present. The issue is fully local (AV:L) with no remote or network reach, no public exploit code has been identified at time of analysis, and devices carrying the 2026-09-01 patch level are not exposed.
An out-of-bounds write in the Android kernel, caused by a missing bounds check, allows an attacker who already holds System-level execution privileges on a device to corrupt kernel memory and escalate to full kernel/root privileges. The flaw is reachable only with local access (AV:L, PR:H) and requires no user interaction, and the associated CVSS score of 6.7 reflects high integrity, confidentiality and availability impact rather than ease of reach. No public exploit code or CISA KEV active-exploitation listing was provided in the available intelligence, so this is currently assessed as a patch-priority local privilege-escalation bug rather than a known exploited threat.
A permission bypass in multiple Google Android system components allows an attacker who already holds System-level code execution to escalate privileges via a confused-deputy flaw. Google addressed it in the September 2026 Pixel security bulletin (patch level 2026-09-01); exploitation is local, requires no user interaction, and demands a pre-existing privileged foothold (CVSS PR:H), so it functions as a privilege-escalation link in a chain rather than a standalone remote compromise. No CISA KEV listing, no public exploit code, and no EPSS score were provided at time of analysis.
A missing bounds check in multiple locations of Android kernel code allows a local attacker who already holds System execution privileges to trigger an out-of-bounds write and escalate to higher, kernel-level privileges on affected devices. Google Android builds that ship the impacted kernel code are affected, with fixes published through the September 2026 Pixel/Android security bulletin. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.7 score reflects the demanding high-privilege prerequisite rather than any remote reachability.
Local privilege escalation in Android's Bluetooth stack allows an attacker who already holds System-level execution on a device to turn a race condition in bluetooth_cco.cc into a use-after-free and elevate to a more privileged context. Google device users on builds prior to the September 2026 Pixel bulletin (patch level 2026-09-01) are the affected population, and the flaw requires no user interaction, though attack complexity is high and System privileges are a prerequisite. No public exploit code has been identified and the issue is not listed as actively exploited, so real-world risk concentrates in targeted or chained attacks against already-compromised high-value devices.
Permission bypass logic errors in Google Android allow a local actor who already holds System-level execution privileges to gain further privileges on affected devices, including Pixel handsets addressed by the September 2026 Android Security Bulletin. The flaw stems from a protection-mechanism failure in which permission checks in unspecified locations are skipped, requiring only local access and no user interaction; an attacker cannot use it for initial compromise or to escalate from an ordinary unprivileged app, since System privileges are a hard prerequisite. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment that this is a genuine but low-priority issue.
Local privilege escalation in the Android kernel affects Google Pixel devices and is addressed by the September 2026 Pixel security bulletin; an attacker who already holds System-level execution privileges on the device can exploit a logic error in the code to gain further elevated access. The flaw is a logic error rather than a memory-safety bug, requires no user interaction, and is not remotely reachable - the CVSS vector (AV:L/PR:H/UI:N) confirms it is only usable as a secondary escalation step after an initial high-privilege local compromise. There is no public exploit identified at time of analysis, no CISA KEV listing, and the EPSS score of roughly 0.12% (2nd percentile) reflects the low likelihood of exploitation, making this a low real-world priority despite the 6.7 'Medium' base score.
Out-of-bounds write in the Android kernel lets a local attacker who already holds System-level execution privileges corrupt memory and escalate to full kernel/root code execution without any user interaction. Devices running Android builds that have not yet adopted the September 2026 (2026-09-01) security patch level are affected, with Google rating the flaw High at CVSS 6.7. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with this data.
Local privilege escalation in the Android kernel stems from a use-after-free condition triggered by a race between concurrent operations, allowing an attacker who already holds System-level execution privileges on the device to elevate to a higher (kernel-level) context. The flaw carries a CVSS 3.1 base score of 6.4 (AV:L/AC:H/PR:H/UI:N) and is addressed in Google's September 2026 Android/Pixel security bulletin. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation (CISA KEV).
Memory corruption in the Android Trusted Execution Environment (TEE) allows a local attacker who already holds System execution privileges to escalate privileges within the secure world by supplying improperly validated input to an affected secure-world interface. The flaw is local-only (AV:L), requires high pre-existing privileges (PR:H), and needs no user interaction (UI:N), yielding high confidentiality, integrity, and availability impact if the corrupted trusted application is reached; Google rates it 6.7 (Medium). Risk is tempered by the significant foothold required, the local-only attack surface, and the low EPSS score (0.11%, 2nd percentile); no public exploit code has been identified and the flaw is not listed in CISA KEV, with fixes delivered in the Pixel security bulletin dated 2026-09-01.
Let me synthesize. CVE-2026-56923: Android kernel TIPC virtio driver (tipc_virtio_dev.c) handle_unmap_req race condition memory corruption, local EoP. CVSS 3.1: AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H → 6.4. Note PR:H which is odd for a local privilege escalation "with no additional execution privileges needed" — the description says no additional execution privileges needed. Hmm, the CVSS says PR:H. There's a conflict: description says local EoP with no additional execution privileges needed (implying PR:N or PR:L?), while CVSS vector says PR:H. This is a data conflict worth noting in confidence_notes and risk_assessment. Actually Android's kernel CVEs for local EoP typically are AV:L/AC:H/PR:H/UI:N in their bulletins... Actually Android uses PR:H sometimes? Hmm. Let me note the conflict: description claims "no additional execution privileges needed" but vector shows PR:H (high privileges required), which typically means the attacker already needs elevated privileges — contradictory for an EoP. State explicitly. Product name: "Android Kernel" — 2 words. Or "TIPC Virtio Driver". Primary product per CPE: google:android. I'd say "Android Kernel". Tags: Privilege Escalation, Buffer Overflow, Google, Race Condition. Buffer Overflow mislabeled? The CWE is race condition/memory corruption. Hmm — "Buffer Overflow" tag is arguably a mislabeled tag since CWE-362 race condition and description says memory corruption not buffer overflow. But memory corruption could involve buffer overflow. I'd be moderately confident... The instructions say only emit flag when clearly wrong and verifiable. Memory corruption due to race condition — buffer overflow is a specific subclass. It's arguably mislabeling. I could flag it with low/medium confidence. Hmm. I think I'll flag it as mislabeled_tag with medium confidence since the CVE is a race condition leading to memory corruption, no buffer overflow specified. Actually careful — race conditions can cause buffer overflows (TOCTOU). Risky.
A permission bypass in Android's CPM component allows a local attacker already running code with System execution privileges to leverage a confused-deputy weakness and escalate further, gaining full read/write/execute impact on the device. Exploitation requires local access and high (System-level) privileges per the CVSS vector but no user interaction, making it a post-compromise escalation primitive rather than a remote entry point. No public exploit code or CISA KEV listing was provided in the intelligence feed, and EPSS data was absent; the fix ships through the September 2026 Android/Pixel security bulletin.
A race condition (CWE-362) in the bigo_worker_thread function of the Android kernel component bigo.c can be won by a local attacker to escalate privileges beyond their current level. Exploitation requires the attacker to already hold System-level execution privileges on the device, and no user interaction is needed; the high attack complexity and PR:H rating reflect the need to win a TOCTOU timing window from an already-elevated context. Google disclosed and fixed the issue in the September 2026 Pixel/Android security bulletin, and there is no public exploit code or CISA KEV listing at time of analysis.
Local privilege escalation in Google Android's Video Processing Unit (VPU) component lets an attacker who already holds System-level execution privileges supply improperly validated input that overwrites shared memory, yielding high confidentiality, integrity, and availability impact with no user interaction required. The flaw (CWE-20) affects Android/Pixel builds that predate the 2026-09-01 security patch level and is only reachable locally, not over a network. Exploitation is constrained by the PR:H prerequisite - an ordinary unprivileged app cannot reach the vulnerable path - and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is correspondingly low at 0.11% (2nd percentile).
Permission bypass in the Android kernel, caused by an integer overflow in multiple code locations, allows an actor who already holds Android System execution privileges on a Pixel device to escalate privileges locally with no user interaction required. The vendor scores it 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the PR:H prerequisite is the decisive constraint: the high confidentiality, integrity and availability metrics describe what a System-context actor can reach, not what an ordinary installed app or remote attacker can achieve. EPSS is 0.12% (2nd percentile) and there is no public exploit code or CISA KEV entry identified at time of analysis, so the defect functions as a secondary privilege-boundary escape usable only after an initial System-level compromise, not as a standalone entry point.
A permission bypass in Google Android stemming from a side-channel information disclosure (CWE-203) allows a local attacker holding only low-privileged code execution to escalate privileges without any user interaction. The flaw yields high confidentiality impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N) by leaking observable discrepancies that undermine permission enforcement, though the vendor vector records no integrity or availability impact. It is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis.
Memory corruption in the Android kernel's GMC mailbox message handler (gmc_mb_msg_handler in gmc_mba.c) allows a local attacker who already holds System-level execution privileges to leverage a confused-deputy condition and escalate privileges on the device. The flaw is tracked as CWE-441 and rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N), meaning it is not remotely reachable and requires a high-privilege foothold rather than being an entry point; user interaction is not needed once that footing exists. Google Devices credited the report and fixed it in the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV entry was identified at time of analysis.
An out-of-bounds write in the Android kernel's remap.c code allows a local attacker holding System-level execution privileges to corrupt kernel memory and escalate to full kernel (root) privileges. The flaw stems from an incorrect bounds check (CWE-787) that fails to validate an offset or length before a write, and no user interaction is required once the attacker has the prerequisite System privileges. At the time of analysis there is no public exploit code and the issue is not listed in CISA KEV, but the September 2026 Pixel security bulletin confirms a vendor fix is available.
Local privilege escalation in the Google Android kernel stems from an out-of-bounds write caused by improper input validation in multiple code locations. An attacker who already holds System-level execution privileges on the device can craft malformed input to corrupt memory and elevate to kernel privileges on affected Android builds. No user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis, though the vendor-published September 2026 Pixel bulletin confirms a fix is available.
An out-of-bounds write in the Android kernel's printf implementation allows an attacker who already holds System-level privileges on the device to corrupt kernel memory and escalate further, typically to kernel/root context, by supplying improperly validated input to the affected formatting routine. Exploitation is local only and requires high privileges (CVSS 3.1 6.7, AV:L/PR:H/UI:N), so a malicious app running as System would be needed rather than a remote attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in Google's September 2026 Pixel/Android security bulletin.
Local privilege escalation in the Android kernel's address remapping code (addr_remap_address_map in remap.c) allows an attacker who already holds System-level execution privileges to further elevate their access on the device. The flaw is a logic error in mapping validation that constitutes a protection-mechanism failure (CWE-693); successful exploitation requires local access and high privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N), with no user interaction, and yields high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; EPSS is negligible at 0.12% (2nd percentile), and fixes are bundled into Google's 2026-09-01 Android/Pixel security bulletin, making this a genuine but bounded issue rather than a top-tier emergency.
Local privilege escalation in the Android kernel lets an attacker who already holds System-level execution privileges bypass a permission check and extend that access further on affected Pixel devices covered by the September 2026 Android Security Bulletin. The flaw is a logic error in permission handling (CWE-693) that requires no user interaction but is gated behind the high precondition of pre-existing System execution context (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7), making it a privilege-boundary bypass chained after an initial compromise rather than a standalone entry point. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment of a genuinely low-priority, locally-scoped issue.
Local privilege escalation in the Android bootloader lets a caller that already holds System execution privileges bypass a missing permission check and reach higher-privileged bootloader operations on affected Android devices. The CVSS vector (AV:L/PR:H/UI:N) makes clear this is a second-stage escalation that requires both local access and an existing high-privileged foothold, not a remote or unprivileged-app vector, and it needs no user interaction. Google resolves it through the September 2026 Android/Pixel security bulletin; EPSS is very low (0.11%, 2nd percentile) and no public exploit has been identified at time of analysis.
Local privilege escalation in Google Android's image authentication service (image-auth-srv.c) allows a component that already holds System execution privileges to abuse a logic error in the gsa_sw_pk_hash_compare public-key hash-comparison routine, achieving escalation into a more trusted execution context. The flaw is reachable only locally (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), so it is not an initial-access or remote vector. Exploitability signals are weak: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis; the practical risk is a defense-in-depth weakness affecting Pixel/Android builds that ship the affected image authentication service.
Local privilege escalation in the Android kernel's ac_init_one_sswrp() initialization routine (init.c) allows an attacker who already holds System execution privileges on an affected Android/Pixel device to escalate further by abusing a logic error in the code, with no user interaction required. Because the assessed vector is AV:L/PR:H, this is a post-compromise escalation primitive rather than a remote or unauthenticated entry point - the pre-existing System-level foothold is the primary limiting factor, which sharply narrows realistic exploitation to attackers who have already breached a highly privileged process. No public exploit code or CISA KEV listing was identified at time of analysis, EPSS is very low (0.12%, roughly the 2nd percentile), and Google has shipped a fix in the September 2026 Pixel bulletin (2026-09-01) - consistent with a genuine but low-priority issue.
Local privilege escalation in the Android Bootloader lets an attacker who already holds System-level execution privileges (PR:H) bypass a missing permission check on an exposed bootloader interface and escalate to higher integrity, confidentiality, and availability impact on the device. Exploitation is local only (AV:L), requires no user interaction (UI:N), and is confined to post-compromise escalation of a privilege boundary on affected Pixel/Android firmware, which is why the assessed severity is moderate (CVSS 6.7) despite high C/I/A ratings. EPSS is very low at 0.12% (2nd percentile), no public exploit code exists, and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; Google's September 2026 Pixel security bulletin covers the fix.
Privilege escalation in Secomea GateManager 11.5 and 11.4.625515072 allows an authenticated, low-privileged user (CVSS PR:L) to reach data or functionality that should be reserved for higher-privileged roles, resulting in a high confidentiality impact (C:H/I:N/A:N). Secomea has released fixed builds — 11.6 and 11.4.626194074 or later — and the flaw is rooted in CWE-280, improper handling of insufficient permissions or privileges. No public exploit code or CISA KEV entry has been identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation activity is currently unconfirmed.
Processing maliciously crafted web content in Apple's WebKit-based browser stack can disclose sensitive user information across Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 and earlier. Apple classifies the root cause as an improper privilege management (permissions) issue and fixed it by removing the vulnerable code rather than adding a check, per the vendor advisories referenced for CVE-2026-64753. Real-world urgency is currently low: EPSS is 0.14% (4th percentile), there is no CISA KEV listing or public exploit identified at time of analysis, and CISA's SSVC assessment is exploitation:none / automatable:no / technical impact:partial, while a vendor patch is already available.
Privilege escalation in October CMS 3.x and 4.x lets an authenticated backend user who holds CMS markup editing rights break out of the Twig Safe Mode sandbox and impersonate an existing superuser. The bypass chains two weaknesses: the Laravel session store is handed to Twig templates with unrestricted method access, and raw SQL methods (selectRaw, whereRaw, orderByRaw, joinSub) leak through Eloquent's __call forwarding so a template can run arbitrary queries and then overwrite the admin_auth session key. Publicly available exploit code exists, but exploitation requires cms.safe_mode to be explicitly enabled, a deliberately untrusted markup editor account, and a pre-existing superuser whose session can be forged — a combination that October CMS states does not occur in standard production deployments.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Privilege escalation in Soarkey StudentManagement allows unauthenticated remote attackers to self-assign arbitrary privilege levels during account registration by manipulating the `level` POST parameter in the Registration Workflow handled by `RegisterServlet.doPost`. An attacker can register a standard user account but set their privilege level to administrator, gaining unauthorized access to elevated functionality such as student record management. A publicly available proof-of-concept exists via GitHub issue #35, and SSVC classifies this as automatable with partial technical impact.
Out-of-bounds write in the Samsung Exynos Display Processing Unit (DPU) kernel driver enables a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges on devices running Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 mobile processors. The flaw stems from missing input length validation in the color mode LUT (Look-Up Table) parsing path of the DPU driver, allowing attacker-controlled data to overflow a kernel buffer. No public exploit code has been identified at time of analysis, though the Samsung semiconductor advisory page confirms the issue and implies a patch is available.
Unauthenticated remote attackers can register accounts with elevated (administrator) privileges in jaychouchannel Tourism-Management-System by manipulating the UsersEntity parameter during registration, bypassing role assignment controls. The commit diff reveals a broader scope than the description implies: at least 12 controller classes (ChatmessageController, multiple Discuss* controllers, ForumController, FriendController, FriendlinkController, NewsController, NewstypeController, StoreupController) had security() endpoints decorated with @IgnoreAuth, making those endpoints callable without any authentication. Publicly available exploit code exists; no active exploitation confirmed in CISA KEV.
Privilege escalation via mass assignment in lenve vhr 1.0-SNAPSHOT allows an authenticated remote user to manipulate restricted fields - including role or privilege-level attributes - through the HrInfoController.updateHr endpoint by injecting unexpected parameters alongside the Password argument in HrMapper.xml. The vulnerability stems from improper privilege management (CWE-266), enabling a low-privilege HR system user to elevate their own account permissions without authorization. A public proof-of-concept has been disclosed; no vendor patch is available and the vendor has not responded to the disclosure.
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain higher-tier memberships without paying the correct price. The plugin's PayPal IPN (Instant Payment Notification) handler accepts the membership level asserted in the payment notification without verifying it matches the level configured for the specific payment button that was purchased, enabling a low-cost membership purchase to be fraudulently upgraded to any higher tier. A publicly available exploit exists, and vendor patch 4.7.8 resolves the issue.
Improper privilege management in xxl-job admin up to version 3.4.2 exposes the `loadById` endpoint of `JobGroupController.java` to unauthorized access by low-privileged authenticated users, leaking executor group configuration data. The vulnerability resides in the admin web interface's job group management controller and allows users who should lack access to read job group details via direct endpoint calls. A public proof-of-concept exploit exists; no vendor patch has been released following disclosure, as the vendor did not respond.
Privilege escalation to root on Palo Alto Networks Cortex XDR Broker VM is achievable by an authenticated low-privileged user who simultaneously holds a man-in-the-middle position on the adjacent network segment. The underlying flaw is argument injection (CWE-88), allowing the attacker to manipulate command-line arguments processed by the Broker VM to gain root-level code execution on the appliance. No public exploit has been identified (CVSS 4.0 E:U, Urgency: Amber), and Palo Alto Networks has published an advisory at security.paloaltonetworks.com.
Multiple local privilege escalation flaws in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow any authenticated local user to elevate privileges to NT AUTHORITY\SYSTEM or root. The root cause is CWE-426 (Untrusted Search Path), a class of vulnerability commonly manifesting as DLL search-order hijacking or PATH manipulation that the privileged VPN client process follows. No public exploit is known at time of analysis, and Palo Alto has released fixed versions; iOS, Android, and ChromeOS deployments are explicitly not affected.
Privilege escalation in the HPE Aruba ClearPass OnGuard agent enables an authenticated network-accessible attacker with low privileges to elevate to root on the affected deployment. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation requiring no user interaction, making it straightforward to weaponize for any attacker who holds even a basic account on the system. No public exploit code or CISA KEV listing has been identified at time of analysis; HPE has published advisory hpesbnw05130en_us, which presumably details affected versions and remediation.
Dell Secure Connect Gateway 5.0 Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) contain a CWE-250 Execution with Unnecessary Privileges flaw in which internal components operate with OS-level permissions exceeding what their function requires, allowing a locally authenticated high-privileged attacker to perform unauthorized modifications to system integrity and availability. The affected products are Dell's enterprise remote support gateway platform used to facilitate secure ProSupport connectivity in production environments. No public exploit code has been identified and the CVSS 3.4 Low rating reflects the substantial access prerequisites - local access and a pre-existing high-privilege account - sharply limiting opportunistic exploitation potential.
Permission control bypass in HarmonyOS 6.1.0's app lock module allows a local low-privileged user to circumvent locking protections and read content belonging to locked applications. The flaw is rooted in CWE-264, indicating improper enforcement of permission restrictions within the module. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the C:H CVSS impact signal indicates full confidentiality exposure to locked app data once exploited locally.
Permission control bypass in the Huawei HarmonyOS and EMUI Settings module allows an attacker with physical access to a device to read confidential data from a protected scope beyond the Settings component. The vulnerability affects HarmonyOS versions 4.0.0 through 4.3.3 and EMUI versions 14.0.0 through 16.0.0, as confirmed by Huawei PSIRT via the September 2026 security bulletin. The CVSS scope-change indicator (S:C) signals that successfully exploiting the flaw grants access to confidential resources outside the Settings module itself, though integrity and availability are unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Permission control weakness in the HarmonyOS window module allows a local attacker to bypass access restrictions and read protected service data on HarmonyOS 6.1.0 devices. The CVSS vector (AV:L/AC:H/PR:N) confirms local-only exploitation with high attack complexity, substantially limiting reach. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; the primary concern is confidentiality exposure on unpatched consumer and laptop devices.
Untrusted Search Path exploitation in Adobe Acrobat and Acrobat Reader allows a local attacker who already holds high privileges to gain unauthorized read access to sensitive confidential data under specific, attacker-uncontrollable environmental conditions. Affected products include Acrobat 2024 (≤24.001.30383), Acrobat Reader, and Adobe Acrobat (both ≤26.002.21900), per EUVD-2026-74105 and Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis; exploitation mandates a victim open a malicious file and requires conditions beyond the attacker's direct control.
Local privilege escalation in the Windows File History Service exploits an integer underflow (CWE-191) that allows an already-privileged local attacker to gain full system-level access on affected Windows 10, 11, and Server 2016/2019 builds. The CVSS vector (AV:L/AC:H/PR:H) reflects that exploitation requires both high local privileges and complex conditions, significantly tempering real-world threat despite the complete C/I/A impact values. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches covering all affected build families.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Improper access control (CWE-284) in Fortinet FortiSOAR allows an authenticated low-privilege user to escalate their privileges within the platform via an undisclosed attack vector. Both PaaS and on-premise deployments across FortiSOAR versions 7.3 through 7.6.6 are affected. No public exploit or CISA KEV listing is present at time of analysis; the Fortinet PSIRT advisory FG-IR-26-164 is the sole authoritative source.
Privilege escalation in AlgoSec Horizon Security Analyzer (versions A33.10/A33.20/A33.30 on Linux 64-bit) allows a low-privileged local user to gain elevated - likely root - access by injecting malicious parameters into a command approved in the sudoers file. The root cause (CWE-266, Improper Privilege Management) is insufficient restriction of arguments permitted when invoking the sudo-approved command, enabling a classic parameter injection attack. No public exploit code is identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Unauthenticated privilege escalation in the Product Catalog Enquiry for WooCommerce by MultiVendorX WordPress plugin (versions <= 6.1.4) permits remote unauthenticated attackers to invoke restricted plugin functionality without holding any site credentials. The root cause is incorrect privilege assignment (CWE-266), where specific plugin endpoints fail to enforce proper capability checks before executing sensitive actions. No public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV; however, the zero-authentication, low-complexity network vector makes automated scanning and opportunistic abuse straightforward against any WooCommerce site running the affected plugin.
Improper privilege management in mocknest-serverless 0.9.0 exposes AWS IAM role assumption to unauthorized escalation through a hardcoded default OIDC role name in GitHub Actions workflow dispatch inputs. The affected GitHub Actions workflows defaulted to a predictable IAM role name ('GitHubOIDCAdmin') combined with an overly permissive OIDC trust policy using wildcard StringLike conditions and PowerUserAccess grants, allowing any user with repository dispatch access to assume an admin-level AWS IAM role beyond their intended scope. No public exploit code has been identified and the project is not listed in CISA KEV; the upstream fix is available as commit 6ab3147 and PR #254.
Privilege escalation in JetBrains YouTrack before version 2026.1.14047 allows an authenticated user holding project update permissions to grant themselves the Project Admin role without proper authorization. The vulnerability stems from a missing escalation check (CWE-266: Incorrect Privilege Assignment) in the project permissions workflow, enabling a project contributor to cross a privilege boundary and assume administrative control over a project. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is known at time of analysis.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.4.2540.23 allows a local low-privileged user to gain elevated access via a path-traversal or symlink-following flaw during JAR archive extraction. The Endpoint Central service, which typically runs under a high-privileged system account, unsafely extracts attacker-influenced JAR contents, permitting file writes outside the intended extraction directory and into privileged locations. No public exploit has been identified at time of analysis, and a vendor patch is available.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.5.2600.15 permits a locally authenticated low-privilege user to gain elevated access by exploiting an outdated bundled third-party component (CWE-269). The CVSS scope change (S:C) indicates impacts extend beyond the vulnerable component itself, potentially reaching OS-level resources or other managed endpoints under the platform's control. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 allows a low-privileged local user to escalate privileges by planting a malicious DLL in an untrusted path from which the application loads libraries. The flaw (CWE-269, Improper Privilege Management) requires local access, user interaction, and high attack complexity to exploit, and carries a scope change indicating impact beyond the vulnerable component itself. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 11.5.2605.01 is confirmed.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central before version 11.5.2605.01 allows a low-privileged local user to gain elevated access by exploiting improper privilege management (CWE-269) during the agent upgrade process. The CVSS scope change (S:C) confirms that exploitation crosses privilege boundaries beyond the initially compromised context, affecting higher-privileged system components. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.
Unauthenticated privilege escalation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to register as privileged users - including administrator - by manipulating the `role` parameter in the `register` function of `auth.php`. Because the application fails to enforce server-side role validation during self-registration, any unauthenticated user can tamper the role field to claim elevated privileges at account creation time. A public proof-of-concept exploit is available on GitHub, lowering the bar for opportunistic exploitation.
Local privilege escalation in MediaTek's geniezone Trusted Execution Environment component affects 17 Android chipsets through a use-after-free memory corruption flaw. Exploitation requires an attacker who has already obtained System-level privilege on the device, allowing them to escalate further - potentially to kernel or TEE privilege - with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; the September 2026 MediaTek security bulletin addresses this with Patch ID ALPS10900510.
Local privilege escalation in MediaTek's Audio Hardware Abstraction Layer (HAL) on Android devices allows an attacker who already holds System-level privilege to further escalate access through improper input validation, achieving full confidentiality, integrity, and availability compromise of the affected device. The vulnerability spans 57 distinct MediaTek chipsets across the MT6xxx and MT8xxx families and is addressed in MediaTek's September 2026 security bulletin under Patch ID ALPS11087540 (Issue ID: MSV-8246). No public exploit code or active exploitation has been identified at time of analysis, and EPSS places exploitation probability at 0.13%.
Memory corruption via use-after-free in the Android SurfaceFlinger graphics compositor, present on specific MediaTek chipsets (MT6881, MT6993, MT6858, MT8668), enables a local attacker who has already obtained System-level privilege to escalate to higher privileges - potentially root or kernel - without any user interaction. Reported by MediaTek in the September 2026 Security Bulletin under Patch ID ALPS11123860 and Issue ID MSV-8890. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none and automatable as no, consistent with the high-privilege prerequisite.
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants, allowing an attacker who has already gained System-level privilege to escalate further to higher privilege tiers without any user interaction. The flaw is confirmed by MediaTek in their September 2026 Product Security Bulletin under Patch ID ALPS11134622 and Issue ID MSV-8894. No public exploit code or active exploitation is confirmed; SSVC designates this as non-automatable with no current exploitation activity.
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to escalate further - potentially to root or kernel - via a stack-based out-of-bounds write caused by a missing bounds check. The vulnerability affects approximately 40 distinct MediaTek SoC models spanning multiple Android device generations. No public exploit has been identified at time of analysis, and SSVC assessment indicates exploitation is currently none, though technical impact is rated total given full C/I/A compromise post-exploitation.
Privilege escalation in MediaTek's Power Hardware Abstraction Layer (Power HAL) allows an attacker who has already obtained System-level privilege on an Android device to further escalate to higher privilege through a type confusion vulnerability (CWE-843). The flaw spans a broad range of MediaTek chipsets - over 40 SoC variants - meaning it affects a wide swath of Android smartphones, tablets, and embedded devices. No public exploit has been identified and SSVC exploitation status is confirmed as 'none' at time of analysis, though the technical impact is rated 'total' by CISA's decision framework.