Privilege Escalation
Monthly
Improperly controlled modification of dynamically-determined object attributes in the Ash framework for Elixir (ash 2.17.15 through 3.33.10) lets a caller set private action arguments, declared with public?: false, on the bulk update and bulk destroy code paths. The affected matching logic in Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 compares every key of a caller-supplied parameter map against all of the action's arguments without checking public?, so any application that forwards end-user parameters into Ash.bulk_update/4 or Ash.bulk_destroy/4 (for example via AshJsonApi, AshGraphql, or a controller) can have a private argument injected; when that argument is referenced by an arg(...) template driving authorization, record ownership, or audit metadata, the result is an integrity violation or privilege escalation. The vendor has released a patch in 3.33.11 that requires public? in the bulk argument matching; no public exploit code has been identified at time of analysis, and the impact is conditional on the application both exposing a bulk action to untrusted input and using a security-relevant private argument.
Workspace ADMIN accounts in Docmost prior to 0.90.1 can mint OWNER-level accounts through the workspace invitation flow, because the invite path never enforces a role ceiling that would stop an administrator from granting privileges above their own. An attacker who already holds the ADMIN role can invite an external email address with the OWNER role; once that invitation is accepted, the resulting account holds the highest privilege level in the workspace, enabling a persistent backdoor OWNER account or the elevation of a colluding external user. Exploitation is access-gated rather than anonymous - it requires an authenticated HIGH-privilege (ADMIN) account and the invitee must accept the emailed invitation (PR:H, UI:R) - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in TÜBİTAK ULAKBİM UlakPDF (all versions through 09092026) allows an authenticated, low-privileged user to reach data and functionality that should be reserved for higher-privileged roles, driven by an incorrect authorization check in the application's access-control logic. The issue carries a CVSS 3.1 base score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is network-reachable but requires a pre-existing valid low-privileged account plus a non-trivial precondition that the public description does not name, and requires no user interaction; confidentiality and integrity impacts are high while availability is unaffected. Reported by TR-CERT via siberguvenlik.gov.tr, the flaw is constrained in real-world priority by the credential prerequisite, the elevated attack complexity, and UlakPDF's narrow academic and government deployment footprint - no public exploit identified at time of analysis.
RabbitMQ stream-management HTTP API allows an authenticated user holding the management tag and vhost access - but no configure permission on any resource - to create super-streams, which consist of an exchange, N partition stream queues, and their bindings, without the per-resource authorization check the native stream protocol path enforces. This is a genuine but low-impact authorization flaw (CWE-862 missing authorization) rated CVSS 2.1 by the vendor and an assessed CVSS:3.1 of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, since the impact is confined to unauthorized integrity changes (persistent resource creation) with no data disclosure or denial of service. Exploitation requires the non-default rabbitmq_stream_management plugin to be enabled and a management-tagged account with vhost access; no KEV listing or public exploit was identified, and vendor fixes are available in 4.0.22, 4.1.11, 4.2.6, and 4.3.0.
Improper access control in IBM Concert 1.0.0 through 3.0.0 lets a local attacker who already has access to the host modify application files that should be protected, yielding an integrity-only impact with no data disclosure or denial of service. The vendor CVSS vector is 6.2 with AV:L/PR:N, while the independent assessment rates PR:L because exploiting this flaw in practice typically requires at least a local account or a compromised co-resident process; IBM has released a vendor patch. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied. This is a genuine integrity risk but not a top-priority emergency, given the local attack vector and the product's limited deployment.
Argument injection in the ad hoc command builder of Red Hat Ansible Automation Platform 2 lets an authenticated user who is permitted to run ad hoc commands smuggle ansible CLI options by passing a host-restriction (`limit`) value beginning with a hyphen, which ansible-core then parses as an option flag. Impact today is minimal (CVSS 3.1, CWE-88): because the injected token displaces the required `pattern` positional argument, only short-circuit flags such as `--version` and `--help` are reachable, so integrity impact is limited to low and no arbitrary option or command control is achievable. There is no public exploit identified at time of analysis, and the issue would only escalate if a future ansible-core release were to default or make optional the `pattern` positional - a hypothetical, non-default upstream change rather than current behavior.
Local privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an attacker who already holds a low-privileged foothold inside a running FTM container - such as a compromised service account or code execution gained through a separate flaw - elevate their privileges within that container. The issue is rated CVSS 3.1 base 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and stems from improper privilege management (CWE-250), meaning the component runs with more authority than it needs; the scope is unchanged, so the flaw by itself does not provide a path to the host node or to other containers. No public exploit identified at time of analysis, and exploitation requires local authenticated access with no remote or unauthenticated vector.
Improper privilege management in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets an attacker who already holds a low-privileged authenticated account on the management interface escalate to unauthorized access with high confidentiality and integrity impact (CVSS 6.8, AV:N/AC:H/PR:L/UI:N). The weakness maps to CWE-269 and requires network reachability plus a non-trivial precondition (AC:H), so it is not triggerable by a fully unauthenticated remote attacker. No public exploit code has been identified and the flaw is not confirmed actively exploited (CISA KEV), so urgency is moderate and driven primarily by the mandatory low-privilege foothold; the vendor-released fix is version 5.34.00.16.
Stored cross-site scripting in Nautobot (all versions prior to 2.4.37 on the 2.x branch and prior to 3.1.8 on the 3.x branch) lets an authenticated user with extras.add_relationship or extras.change_relationship permission inject HTML or JavaScript into a Relationship description, or with dcim.add_modulefamily or dcim.change_modulefamily permission inject it into a Module Family name, which then executes in the browser session of any user - including administrators and superusers - who opens an affected create or edit form. Because the payload runs in the victim's authenticated context with same-site access to the Nautobot UI, an attacker can perform actions as the victim and potentially steal session cookies or API tokens, enabling lateral movement and privilege escalation toward a full administrative compromise of the platform. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so risk is assessed as moderate rather than critical: exploitation requires a pre-existing authorized account with specific object-level write permissions, and a higher-privileged victim must interact with the poisoned form.
Remote unauthenticated attackers can perform unlimited password guessing against the pH7Builder (pH7 Social Dating CMS) administration login through version 19.2.0 by bypassing the CAPTCHA, which is only rendered when the PHP session flag captcha_admin_enabled is set. Publicly available exploit code exists, and the bypass chain is detailed in a third-party blog, though the EPSS score is low at 0.38% (31st percentile) and CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). The practical impact is limited to enabling brute-force attempts; strong admin passwords or an external rate limiter materially reduce risk.
Local information disclosure in Dell Command | Integration Suite for System Center (versions prior to 6.7.2) allows a low-privileged, authenticated local user to read sensitive data that should not be accessible to that account. The root cause is incorrect default file or directory permissions (CWE-276) shipped with the SCCM add-on, which grant broader read access than intended. Exploitation requires an existing local session on the Windows host running the affected software - there is no remote vector, no user interaction, and no privilege escalation needed beyond the initial foothold - and the result is confidentiality impact only, with no code execution, data modification, or availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the assessed CVSS 3.1 base score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Local information disclosure in Dell Command | Intel vPro Out of Band versions prior to 4.7.2 lets an authenticated, low-privileged user on a Windows host read data that should have been restricted, because the product ships files, directories, registry keys, or objects with overly permissive default access controls (CWE-276). Per the vendor's own advisory the impact is limited to confidentiality - no integrity or availability effect - and the vector requires local access plus a valid low-privilege account (AV:L/PR:L/UI:N), which is why it scores a moderate 5.5. No KEV listing or public exploit code was identified at time of analysis, and no public exploit has been identified; real-world risk is confined to hosts where an attacker already has a foothold, so this is routine patch-cycle work rather than an emergency.
Privilege escalation in UVdesk core-framework before 1.1.7 lets an authenticated agent who already holds the agent-management privilege promote their own account to ROLE_ADMIN through the editAgent endpoint, gaining full administrative control over agents, tickets and mail configuration. The attacker simply submits their own account identifier together with a role parameter set to ROLE_ADMIN, so the flaw converts a delegated helpdesk-management role into complete tenant takeover. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is only practical in deployments that grant agent-management rights to non-administrators.
Authenticated privilege escalation in CodeAstro QR Code Attendance Management System 1.0 lets a logged-in, low-privileged user manipulate the role_id argument in the UserController Save action to assign elevated roles, up to administrator, to any account they control. The flaw is an improper privilege management weakness (CWE-269) exposed through the PHP web interface, and publicly available exploit code exists (a GitHub proof-of-concept), though there is no CISA KEV entry confirming active exploitation. Severity is modest and consistent with the raw numbers: vendor CVSS 5.1 with low confidentiality, integrity and availability impact, and independently assessed as requiring an authenticated session (PR:L) against this single, obscure application at version 1.0.
Improper privilege management in samanhappy MCPHub up to 1.0.32 lets any authenticated non-admin user import a configuration template that defines a 'privileged' server (a stdio server, any config carrying command/args, or any config with no remote target), which MCPHub then spawns locally as an operating-system command - resulting in arbitrary command execution as the MCPHub process. Exploitation only requires a valid low-privilege login and access to the Template Import Endpoint (CVSS 4.0 vector shows PR:L), and publicly available exploit code exists via GitHub issue #1094, so the practical risk is higher than the vendor's 5.3 score suggests; this assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The flaw is fixed in MCPHub 1.0.33, where importTemplate enforces the admin-only privileged-config policy.
Improper default filesystem permissions in WatchDog Anti-Virus for Windows let any local, low-privileged user take over the installation directory, because the default installer grants the Users group Full Control over C:\Program Files (x86)\Watchdog Anti-Virus. That access alone is enough to disable protection by deleting or rewriting antivirus binaries and configuration files, and it can escalate to privileged code execution if a tampered binary is subsequently loaded by an elevated WatchDog process, for example after a service restart, scheduled scan, or update cycle. The flaw requires an existing local user account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; vendor CVSS 4.0 base 5.9, PR:L) and is confined to hosts still running the affected installer build; no public exploit code was identified at time of analysis, and WatchDog's release notes reference the corrected build.
Improper privilege management in SxDevOps 1.0/1.1 allows an authenticated user to escalate their own privileges by manipulating the update path of the UserSerializer in backend/rbac/serializers.py, reachable remotely over the network against the RBAC user-update API. The vulnerability is rated medium (CVSS 4.0 base 5.1, AV:N/AC:L/PR:H/UI:N/VC:N/VI:L/VA:L), with the main impact being integrity of role/permission data; a public exploit has not been identified at time of analysis and there is no CISA KEV listing. The vendor was contacted early, responded promptly, and published a fix in commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9, so patched deployments are no longer exposed.
An authenticated user holding the quiz-import capability in the Forminator Forms WordPress plugin (versions 1.57.0 through before 1.57.2.1) can escalate to full site control by embedding a role-assigning registration form inside an imported quiz and publishing it, granting any role - including administrator - to anyone who submits the public form. The plugin enforces role validation in the ordinary form editor and ordinary form import paths but omits that check in the quiz-import code path, making the nested-quiz route the only viable bypass; the identical form is rejected through both normal routes. A vendor patch is available (1.57.2.1) and publicly available exploit code exists, so although the vendor scores this 6.6 (AC:H/PR:H), the assessed vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) is materially higher given that a non-administrator with delegated import rights can achieve complete site compromise.
ZTE SmartLife's backend signup interface (/account/person/signup.serv) creates accounts for arbitrary email addresses without verifying that the requester owns the address, so an attacker who has extracted the app's runtime-generated authentication parameters can complete registration against any email string. The assigned vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3) and our independent assessment agree on moderate severity: the primary barrier is first obtaining the client-generated app authentication parameters - obtainable via reverse engineering or traffic interception and reflected as PR:L - with no per-victim credentials, user interaction, or non-default configuration required and the endpoint network-reachable. No KEV entry and no public exploit identified at time of analysis, so real-world urgency is genuinely low, though the integrity impact on account/identity assurance is real anywhere the platform subsequently trusts the registered email for identity, notifications, or recovery.
Improper privilege management in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) versions 3.1 through 3.5 allows a network-reachable attacker who already holds a high-privilege administrative account on the management plane to escalate their privileges within the product, per CVE-2026-20287 (CVSS 3.1 base 6.5, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). The flaw is one of several defects bundled into a Cisco internal-hardening release and is tracked under the CWE-269 improper privilege management pillar; the exact vulnerable sub-feature is not individually described in the grouped advisory. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); because the vector requires PR:H, this is a post-authentication privilege escalation affecting the appliance's administrative layer rather than an initial-access or unauthenticated remote code execution issue. For most organizations it represents a moderate-priority, defense-in-depth concern that is materially mitigated by keeping the ISE management interface off untrusted networks, though the potential for both confidentiality and integrity impact (C:H/I:H) still warrants prioritized patching on any ISE deployment that exposes its admin plane broadly or grants many staff high-privilege accounts.
Denial of service in HP's HPLIP (HP Linux Imaging and Printing Software) printing stack is reachable when a physically-present attacker supplies specially crafted input that triggers a CWE-191 integer underflow, crashing or hanging affected components; the scored CVSS:3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) limits impact to availability only, with no confidentiality or integrity loss. The physical attack vector (direct hardware/USB or local physical access) is the dominant gating factor and rules out remote or network-based exploitation, and no public exploit has been identified at time of analysis. HP has stated that it identified and remediated the underlying issues, so a vendor fix is available per advisory hpsbpi04151, though the specific affected and fixed version ranges are not enumerated here and must be confirmed against that bulletin. Overall this is a genuine but low-priority issue: real availability impact, but exploitation requires an attacker to already have hands on the machine.
Denial of service in HP Linux Imaging and Printing Software (HPLIP) can be triggered by a physically present attacker who supplies crafted input via a local device or print/scan job, exploiting improper array index validation (CWE-129). Although HP's advisory bundles several vulnerabilities that could potentially enable a broader range of impacts, the specific vector for this CVE limits the effect to availability (system crash or service disruption) with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and the primary prerequisite is physical access to the target system.
Command injection (CWE-78) in HP's HPLIP (HP Linux Imaging and Printing) software enables an unauthenticated local user to execute commands or modify files with high integrity impact (VI:H) after active user interaction, matching HP's CVSS 4.0 score of 6.8 (AV:L/AC:L/PR:N/UI:A/VC:L/VI:H/VA:L) and the independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:R/C:L/I:H/A:L). The HP security bulletin HPSBPI04151 bundles this issue with other externally reported HPLIP flaws that could lead to remote code execution, privilege escalation, denial of service, or information disclosure, but the exact vulnerable component is not disclosed. No public exploit code or CISA KEV entry is identified at time of analysis, and the local vector plus mandatory user interaction prevents triggering without a user processing attacker-supplied input.
Local attackers with valid credentials on Linux systems running HPLIP can exploit symbolic-link handling flaws (CWE-61) in HPLIP components to read or modify arbitrary files, as described in HP security bulletin HPSBPI04151. This CVE is one of multiple issues remediated by HP in HPLIP and is assessed as a moderate, locally-scoped issue (CVSS 3.1: AV:L/AC:L/PR:L/UI:N, limited confidentiality/integrity impact) rather than an urgent priority, despite the broader impact list in the description; no public exploit code or CISA KEV active exploitation has been identified at time of analysis. Exploitation requires local access and a vulnerable HPLIP component that follows attacker-controllable symlinks at a predictable path, limiting impact to unauthorized file read/modification.
Local privilege escalation in Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 allows an attacker with existing high-privileged local access to elevate privileges. The flaw stems from improper privilege management (CWE-269) and requires authenticated local access (PR:H/AV:L); it is not remotely exploitable. No public exploit code or active exploitation has been identified, and vendor patches are available.
Improper permission preservation during archive decompression in the HashiCorp go-getter library (1.8.x up to 1.8.8 and 2.x up to 2.2.3) lets a crafted archive cause extracted files to be created with attacker-influenced, elevated permission bits. When the extraction is performed by a privileged process — for example a root-run provisioning, CI, or orchestrator agent — a local actor can leverage the resulting files to gain the privileges of that extracting process, escalating from a low-privileged position to root or service-level access. HashiCorp has released fixes in go-getter 1.8.9 and 2.2.4; the issue is not listed in CISA KEV and no public exploit code has been identified at time of analysis.
Local attackers who already hold high privileges and a valid logon to the host running Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to seize full control of the application, with complete loss of confidentiality, integrity and availability. The issue is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and no public exploit code, EPSS score or CISA KEV entry was present in the supplied intelligence. Because it requires pre-existing privileged local access, this is primarily a post-compromise escalation and insider-abuse concern rather than an internet-facing remote attack.
Privilege escalation in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated, already high-privileged remote user exceed their assigned authorization level and execute arbitrary code on the appliance. Four release branches are affected: 9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1 and 9.7.0.0. The CVSS score of 6.6 understates the operational weight of the flaw because a compromised SD-WAN gateway sits on the control plane of the whole WAN fabric; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
An out-of-bounds write in the Android kernel GNSS link driver lets a local process that already holds System execution privileges corrupt kernel memory and escalate to kernel-level code execution. The defect (CWE-787) is a missing bounds check in link_load_gnss_image() in link_device.c, requires no user interaction, and is addressed through Google's September 2026 Android/Pixel security bulletin. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in the arm-smmu-v3 driver of Google's Android kernel lets code already running with System privileges bypass the ARM SMMUv3 protection mechanism and reach higher-level (kernel/root) execution on affected ARM-based devices, including Pixel. The root cause is a logic error classified as CWE-693 (Protection Mechanism Failure), reachable without any user interaction but only from a local, already-privileged context (CVSS PR:H). No public exploit code and no active exploitation have been identified at time of analysis, so this is a monthly-bulletin hardening fix rather than an emergency patch.
Local privilege escalation in Google Android's GPU driver component allows a process that already runs with System execution privileges to bypass a permission check through a logic error, gaining full read/write/execute impact at a higher privilege level. Only Android devices carrying the affected GPU component are exposed, and exploitation is strictly local with no user interaction, so it cannot be triggered by a remote attacker or a normal unprivileged app on its own. There is no public exploit code and no CISA KEV listing identified at time of analysis; remediation is delivered through the September 2026 Android/Pixel security bulletin.
Local privilege escalation in the Android kernel's arm-smmu-v3 driver (smmu_install_nested_ste) lets a process that already runs with System execution privileges turn a logic error in SMMU stream-table-entry handling into full kernel-level compromise of confidentiality, integrity, and availability. Only devices whose kernel exposes the ARM SMMUv3 driver in a nested-translation configuration are affected, and Google rates it Moderate with a CVSS base of 6.7 (AV:L/PR:H), meaning exploitation presupposes a highly privileged local foothold rather than remote or unauthenticated access. There is no indication of public exploit code and the issue is not listed in CISA KEV; Google's Pixel bulletin of 2026-09-01 ships the fix.
A use-after-free in the ARM SMMU v3 driver (arm-smmu-v3.c) of the Android kernel lets a local attacker who already holds System-level execution privileges corrupt kernel memory and escalate to full kernel/System privilege. The flaw is a logic error in one of several driver functions that leaves a freed object reachable, and no user interaction is needed once the attacker has code running at that privilege level. It is ranked CVSS 6.7 (AV:L/PR:H), there is no indication of active exploitation or public exploit code, and Google published a fix in the September 2026 Pixel security bulletin.
A logic error in the ARM SMMU v3 driver's smmu_detach_dev path allows a caller who already holds System-level privileges on an Android device to bypass SMMU/IOMU memory-permission checks and escalate to kernel (EL1) execution, achieving full compromise of the device. Affected are Google Pixel/Android builds using the arm-smmu-v3 driver prior to the September 2026 Android Security Bulletin patch level. Exploitation is local, requires no user interaction, and no public exploit code or CISA KEV listing was identified at time of analysis, so the practical risk is concentrated on devices that already run privileged or partially compromised code.
A confused-deputy flaw (CWE-441) in the Android platform's message-handler initialization routine, platform_msg_handler_init in default_msg_handlers.c, lets a local process that already runs with System privileges have privileged operations performed on its behalf by a more trusted component, resulting in local privilege escalation with high impact to confidentiality, integrity and availability. Exploitation requires local execution at the System privilege level (CVSS PR:H) and no user interaction, so it is not reachable by an ordinary unprivileged app. There is no public exploit code identified and the issue is not in CISA KEV; it was published through the September 2026 Android/Pixel security bulletin, so risk to most users is conditional on already having a System-level foothold or being part of an exploit chain.
A missing permission check in the FSM key-release routine (FsmReleaseKey in fsm.c) of the Android kernel allows a locally positioned attacker to bypass an access-control verification and escalate privileges on affected devices. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is classified as CWE-693, Protection Mechanism Failure, because the intended permission gate is simply not enforced on that code path. Exploitation requires the attacker to already hold System-level execution privileges on the device, and no public exploit code or CISA KEV entry has been identified at time of analysis.
Local escalation of privilege in the Android kernel's ARM SMMU v3 driver lets a process that already runs with System privileges reach kernel-level code execution by passing malformed input to the nested device-detach path (smmu_detach_dev_nested in arm-smmu-v3.c). Because the CVSS vector requires PR:H, this is not a boundary an ordinary unprivileged app can cross — it is a second-stage escalation for code that already holds highly privileged, kernel-adjacent access on the device. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so risk is driven by the monthly Android/Pixel kernel patch cycle rather than by observed attacks; no EPSS score was supplied in the input data.
A time-of-check to time-of-use (TOCTOU) race condition in multiple locations of the Android kernel allows an attacker who already holds System-level execution privileges on a device to win a timing window and escalate to higher (kernel/root) privileges, with no user interaction required. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is fixed through the September 2026 Android Security Bulletin for Pixel devices. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and no EPSS score was supplied, so the practical risk is concentrated in post-compromise privilege escalation rather than remote mass exploitation.
Local privilege escalation in the Android kernel's PMIC inter-process-communication driver (ap_pmic_ipc.c) lets a caller that already holds System execution privileges bypass permission checks via a confused-deputy flaw in ap_pmic_poll_msg_handler and gain kernel-level code execution. Only Android devices that carry the affected PMIC IPC driver — the Google Pixel bulletin of 2026-09-01 is the vendor reference, and the CPE scopes this to google:android — are exposed, and the attacker must already be running with elevated (System) privileges on the device. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this reads as a post-compromise escalation primitive rather than a remotely reachable entry point.
Local privilege escalation in Google Android/Pixel arises from a permission bypass in the DreamPickerReceiver.kt component (the Daydream/screensaver picker), where a confused-deputy flaw lets a locally installed application reach privileged operations that execute with System privileges. Affected are Android/Pixel builds at security patch levels prior to the 2026-09-01 bulletin; exploitation requires the attacker to already have local code execution via a malicious or compromised app, and no user interaction is needed once that app is present. The issue is fully local (AV:L) with no remote or network reach, no public exploit code has been identified at time of analysis, and devices carrying the 2026-09-01 patch level are not exposed.
An out-of-bounds write in the Android kernel, caused by a missing bounds check, allows an attacker who already holds System-level execution privileges on a device to corrupt kernel memory and escalate to full kernel/root privileges. The flaw is reachable only with local access (AV:L, PR:H) and requires no user interaction, and the associated CVSS score of 6.7 reflects high integrity, confidentiality and availability impact rather than ease of reach. No public exploit code or CISA KEV active-exploitation listing was provided in the available intelligence, so this is currently assessed as a patch-priority local privilege-escalation bug rather than a known exploited threat.
A permission bypass in multiple Google Android system components allows an attacker who already holds System-level code execution to escalate privileges via a confused-deputy flaw. Google addressed it in the September 2026 Pixel security bulletin (patch level 2026-09-01); exploitation is local, requires no user interaction, and demands a pre-existing privileged foothold (CVSS PR:H), so it functions as a privilege-escalation link in a chain rather than a standalone remote compromise. No CISA KEV listing, no public exploit code, and no EPSS score were provided at time of analysis.
A missing bounds check in multiple locations of Android kernel code allows a local attacker who already holds System execution privileges to trigger an out-of-bounds write and escalate to higher, kernel-level privileges on affected devices. Google Android builds that ship the impacted kernel code are affected, with fixes published through the September 2026 Pixel/Android security bulletin. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.7 score reflects the demanding high-privilege prerequisite rather than any remote reachability.
Local privilege escalation in Android's Bluetooth stack allows an attacker who already holds System-level execution on a device to turn a race condition in bluetooth_cco.cc into a use-after-free and elevate to a more privileged context. Google device users on builds prior to the September 2026 Pixel bulletin (patch level 2026-09-01) are the affected population, and the flaw requires no user interaction, though attack complexity is high and System privileges are a prerequisite. No public exploit code has been identified and the issue is not listed as actively exploited, so real-world risk concentrates in targeted or chained attacks against already-compromised high-value devices.
Permission bypass logic errors in Google Android allow a local actor who already holds System-level execution privileges to gain further privileges on affected devices, including Pixel handsets addressed by the September 2026 Android Security Bulletin. The flaw stems from a protection-mechanism failure in which permission checks in unspecified locations are skipped, requiring only local access and no user interaction; an attacker cannot use it for initial compromise or to escalate from an ordinary unprivileged app, since System privileges are a hard prerequisite. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment that this is a genuine but low-priority issue.
Local privilege escalation in the Android kernel affects Google Pixel devices and is addressed by the September 2026 Pixel security bulletin; an attacker who already holds System-level execution privileges on the device can exploit a logic error in the code to gain further elevated access. The flaw is a logic error rather than a memory-safety bug, requires no user interaction, and is not remotely reachable - the CVSS vector (AV:L/PR:H/UI:N) confirms it is only usable as a secondary escalation step after an initial high-privilege local compromise. There is no public exploit identified at time of analysis, no CISA KEV listing, and the EPSS score of roughly 0.12% (2nd percentile) reflects the low likelihood of exploitation, making this a low real-world priority despite the 6.7 'Medium' base score.
Out-of-bounds write in the Android kernel lets a local attacker who already holds System-level execution privileges corrupt memory and escalate to full kernel/root code execution without any user interaction. Devices running Android builds that have not yet adopted the September 2026 (2026-09-01) security patch level are affected, with Google rating the flaw High at CVSS 6.7. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with this data.
Local privilege escalation in the Android kernel stems from a use-after-free condition triggered by a race between concurrent operations, allowing an attacker who already holds System-level execution privileges on the device to elevate to a higher (kernel-level) context. The flaw carries a CVSS 3.1 base score of 6.4 (AV:L/AC:H/PR:H/UI:N) and is addressed in Google's September 2026 Android/Pixel security bulletin. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation (CISA KEV).
Memory corruption in the Android Trusted Execution Environment (TEE) allows a local attacker who already holds System execution privileges to escalate privileges within the secure world by supplying improperly validated input to an affected secure-world interface. The flaw is local-only (AV:L), requires high pre-existing privileges (PR:H), and needs no user interaction (UI:N), yielding high confidentiality, integrity, and availability impact if the corrupted trusted application is reached; Google rates it 6.7 (Medium). Risk is tempered by the significant foothold required, the local-only attack surface, and the low EPSS score (0.11%, 2nd percentile); no public exploit code has been identified and the flaw is not listed in CISA KEV, with fixes delivered in the Pixel security bulletin dated 2026-09-01.
Let me synthesize. CVE-2026-56923: Android kernel TIPC virtio driver (tipc_virtio_dev.c) handle_unmap_req race condition memory corruption, local EoP. CVSS 3.1: AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H → 6.4. Note PR:H which is odd for a local privilege escalation "with no additional execution privileges needed" — the description says no additional execution privileges needed. Hmm, the CVSS says PR:H. There's a conflict: description says local EoP with no additional execution privileges needed (implying PR:N or PR:L?), while CVSS vector says PR:H. This is a data conflict worth noting in confidence_notes and risk_assessment. Actually Android's kernel CVEs for local EoP typically are AV:L/AC:H/PR:H/UI:N in their bulletins... Actually Android uses PR:H sometimes? Hmm. Let me note the conflict: description claims "no additional execution privileges needed" but vector shows PR:H (high privileges required), which typically means the attacker already needs elevated privileges — contradictory for an EoP. State explicitly. Product name: "Android Kernel" — 2 words. Or "TIPC Virtio Driver". Primary product per CPE: google:android. I'd say "Android Kernel". Tags: Privilege Escalation, Buffer Overflow, Google, Race Condition. Buffer Overflow mislabeled? The CWE is race condition/memory corruption. Hmm — "Buffer Overflow" tag is arguably a mislabeled tag since CWE-362 race condition and description says memory corruption not buffer overflow. But memory corruption could involve buffer overflow. I'd be moderately confident... The instructions say only emit flag when clearly wrong and verifiable. Memory corruption due to race condition — buffer overflow is a specific subclass. It's arguably mislabeling. I could flag it with low/medium confidence. Hmm. I think I'll flag it as mislabeled_tag with medium confidence since the CVE is a race condition leading to memory corruption, no buffer overflow specified. Actually careful — race conditions can cause buffer overflows (TOCTOU). Risky.
A permission bypass in Android's CPM component allows a local attacker already running code with System execution privileges to leverage a confused-deputy weakness and escalate further, gaining full read/write/execute impact on the device. Exploitation requires local access and high (System-level) privileges per the CVSS vector but no user interaction, making it a post-compromise escalation primitive rather than a remote entry point. No public exploit code or CISA KEV listing was provided in the intelligence feed, and EPSS data was absent; the fix ships through the September 2026 Android/Pixel security bulletin.
A race condition (CWE-362) in the bigo_worker_thread function of the Android kernel component bigo.c can be won by a local attacker to escalate privileges beyond their current level. Exploitation requires the attacker to already hold System-level execution privileges on the device, and no user interaction is needed; the high attack complexity and PR:H rating reflect the need to win a TOCTOU timing window from an already-elevated context. Google disclosed and fixed the issue in the September 2026 Pixel/Android security bulletin, and there is no public exploit code or CISA KEV listing at time of analysis.
Local privilege escalation in Google Android's Video Processing Unit (VPU) component lets an attacker who already holds System-level execution privileges supply improperly validated input that overwrites shared memory, yielding high confidentiality, integrity, and availability impact with no user interaction required. The flaw (CWE-20) affects Android/Pixel builds that predate the 2026-09-01 security patch level and is only reachable locally, not over a network. Exploitation is constrained by the PR:H prerequisite - an ordinary unprivileged app cannot reach the vulnerable path - and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is correspondingly low at 0.11% (2nd percentile).
Permission bypass in the Android kernel, caused by an integer overflow in multiple code locations, allows an actor who already holds Android System execution privileges on a Pixel device to escalate privileges locally with no user interaction required. The vendor scores it 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the PR:H prerequisite is the decisive constraint: the high confidentiality, integrity and availability metrics describe what a System-context actor can reach, not what an ordinary installed app or remote attacker can achieve. EPSS is 0.12% (2nd percentile) and there is no public exploit code or CISA KEV entry identified at time of analysis, so the defect functions as a secondary privilege-boundary escape usable only after an initial System-level compromise, not as a standalone entry point.
A permission bypass in Google Android stemming from a side-channel information disclosure (CWE-203) allows a local attacker holding only low-privileged code execution to escalate privileges without any user interaction. The flaw yields high confidentiality impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N) by leaking observable discrepancies that undermine permission enforcement, though the vendor vector records no integrity or availability impact. It is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis.
Memory corruption in the Android kernel's GMC mailbox message handler (gmc_mb_msg_handler in gmc_mba.c) allows a local attacker who already holds System-level execution privileges to leverage a confused-deputy condition and escalate privileges on the device. The flaw is tracked as CWE-441 and rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N), meaning it is not remotely reachable and requires a high-privilege foothold rather than being an entry point; user interaction is not needed once that footing exists. Google Devices credited the report and fixed it in the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV entry was identified at time of analysis.
An out-of-bounds write in the Android kernel's remap.c code allows a local attacker holding System-level execution privileges to corrupt kernel memory and escalate to full kernel (root) privileges. The flaw stems from an incorrect bounds check (CWE-787) that fails to validate an offset or length before a write, and no user interaction is required once the attacker has the prerequisite System privileges. At the time of analysis there is no public exploit code and the issue is not listed in CISA KEV, but the September 2026 Pixel security bulletin confirms a vendor fix is available.
Local privilege escalation in the Google Android kernel stems from an out-of-bounds write caused by improper input validation in multiple code locations. An attacker who already holds System-level execution privileges on the device can craft malformed input to corrupt memory and elevate to kernel privileges on affected Android builds. No user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis, though the vendor-published September 2026 Pixel bulletin confirms a fix is available.
An out-of-bounds write in the Android kernel's printf implementation allows an attacker who already holds System-level privileges on the device to corrupt kernel memory and escalate further, typically to kernel/root context, by supplying improperly validated input to the affected formatting routine. Exploitation is local only and requires high privileges (CVSS 3.1 6.7, AV:L/PR:H/UI:N), so a malicious app running as System would be needed rather than a remote attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in Google's September 2026 Pixel/Android security bulletin.
Local privilege escalation in the Android kernel's address remapping code (addr_remap_address_map in remap.c) allows an attacker who already holds System-level execution privileges to further elevate their access on the device. The flaw is a logic error in mapping validation that constitutes a protection-mechanism failure (CWE-693); successful exploitation requires local access and high privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N), with no user interaction, and yields high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; EPSS is negligible at 0.12% (2nd percentile), and fixes are bundled into Google's 2026-09-01 Android/Pixel security bulletin, making this a genuine but bounded issue rather than a top-tier emergency.
Local privilege escalation in the Android kernel lets an attacker who already holds System-level execution privileges bypass a permission check and extend that access further on affected Pixel devices covered by the September 2026 Android Security Bulletin. The flaw is a logic error in permission handling (CWE-693) that requires no user interaction but is gated behind the high precondition of pre-existing System execution context (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7), making it a privilege-boundary bypass chained after an initial compromise rather than a standalone entry point. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment of a genuinely low-priority, locally-scoped issue.
Local privilege escalation in the Android bootloader lets a caller that already holds System execution privileges bypass a missing permission check and reach higher-privileged bootloader operations on affected Android devices. The CVSS vector (AV:L/PR:H/UI:N) makes clear this is a second-stage escalation that requires both local access and an existing high-privileged foothold, not a remote or unprivileged-app vector, and it needs no user interaction. Google resolves it through the September 2026 Android/Pixel security bulletin; EPSS is very low (0.11%, 2nd percentile) and no public exploit has been identified at time of analysis.
Local privilege escalation in Google Android's image authentication service (image-auth-srv.c) allows a component that already holds System execution privileges to abuse a logic error in the gsa_sw_pk_hash_compare public-key hash-comparison routine, achieving escalation into a more trusted execution context. The flaw is reachable only locally (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), so it is not an initial-access or remote vector. Exploitability signals are weak: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis; the practical risk is a defense-in-depth weakness affecting Pixel/Android builds that ship the affected image authentication service.
Local privilege escalation in the Android kernel's ac_init_one_sswrp() initialization routine (init.c) allows an attacker who already holds System execution privileges on an affected Android/Pixel device to escalate further by abusing a logic error in the code, with no user interaction required. Because the assessed vector is AV:L/PR:H, this is a post-compromise escalation primitive rather than a remote or unauthenticated entry point - the pre-existing System-level foothold is the primary limiting factor, which sharply narrows realistic exploitation to attackers who have already breached a highly privileged process. No public exploit code or CISA KEV listing was identified at time of analysis, EPSS is very low (0.12%, roughly the 2nd percentile), and Google has shipped a fix in the September 2026 Pixel bulletin (2026-09-01) - consistent with a genuine but low-priority issue.
Local privilege escalation in the Android Bootloader lets an attacker who already holds System-level execution privileges (PR:H) bypass a missing permission check on an exposed bootloader interface and escalate to higher integrity, confidentiality, and availability impact on the device. Exploitation is local only (AV:L), requires no user interaction (UI:N), and is confined to post-compromise escalation of a privilege boundary on affected Pixel/Android firmware, which is why the assessed severity is moderate (CVSS 6.7) despite high C/I/A ratings. EPSS is very low at 0.12% (2nd percentile), no public exploit code exists, and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; Google's September 2026 Pixel security bulletin covers the fix.
Privilege escalation in Secomea GateManager 11.5 and 11.4.625515072 allows an authenticated, low-privileged user (CVSS PR:L) to reach data or functionality that should be reserved for higher-privileged roles, resulting in a high confidentiality impact (C:H/I:N/A:N). Secomea has released fixed builds — 11.6 and 11.4.626194074 or later — and the flaw is rooted in CWE-280, improper handling of insufficient permissions or privileges. No public exploit code or CISA KEV entry has been identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation activity is currently unconfirmed.
Apps installed on Apple iOS/iPadOS, tvOS, visionOS, and watchOS prior to version 27 can read the user-assigned device name without the additional authorization Apple intended, an improper permission-management flaw tracked as CVE-2026-86893 and fixed in the iOS 27, iPadOS 27, tvOS 27, visionOS 27 and watchOS 27 releases. The issue requires a malicious or compromised app already running locally with ordinary low-privilege sandbox access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 3.3) and yields nothing beyond disclosure of that single low-sensitivity identifier - no code execution, no privilege escalation, and no effect on integrity or availability, with macOS unaffected. There is no public exploit identified at time of analysis, EPSS is 0.16% (6th percentile), and the CVE is not in CISA KEV; the practical gate is getting a hostile app onto the device in the first place, which keeps real-world exposure low.
A locally installed app on unpatched Apple platforms can read a persistent account identifier it is not authorized to access, handing the app a stable value that could be used to correlate or track a user across apps and sessions. Impact is confined to privacy-relevant information disclosure: the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (3.3), meaning a low-privilege app must already be installed and running on the device, with no remote or network vector and no user interaction beyond launching that app. Affected are iOS and iPadOS before 27, macOS before 27 (Golden Gate) and before 26.7 (Tahoe), tvOS before 27, visionOS before 27, and watchOS before 27, all of which now have fixed releases. This is a low-priority issue overall: exploitation is not confirmed, no public exploit identified at time of analysis, and EPSS is just 0.19% (9th percentile).
Protection-bypass in Apple macOS allows a malicious or compromised app already running with normal (non-root) user privileges to circumvent intended permission restrictions and read protected user data; the flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Exploitation is strictly local (AV:L, PR:L, UI:N) - there is no remote or network path - so the attacker must first obtain local code execution, for example through a downloaded or sideloaded application, making this a post-compromise data-access primitive rather than an initial-access vector, with the confidentiality impact rated High while integrity and availability are unaffected. Apple has released fixes (patch available), and at time of analysis there is no public exploit identified and no confirmed active exploitation (CISA KEV not listed); EPSS is only 0.17% (6th percentile), so this is a low-to-moderate priority issue despite its 5.5 (Medium) CVSS score.
Locally installed applications on Apple iOS/iPadOS, macOS Golden Gate, tvOS, and watchOS releases prior to version 27 can bypass intended permission restrictions and read sensitive user data they should be denied. Exploitation requires a malicious or compromised app already running on the device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5 MEDIUM) - there is no network-reachable path, so an attacker must first deliver an app through the App Store, sideloading, or enterprise/MDM distribution, after which no further user interaction is needed. There is no public exploit identified at time of analysis and the EPSS score is 0.16% (6th percentile); Apple has shipped fixes in the version 27 releases across all four affected platforms, so exposure is limited to unpatched devices below version 27.
Insufficient permission restrictions in Apple's iOS/iPadOS, visionOS, and watchOS allow an app already installed and running locally on the device to reach sensitive user data it should not be able to read. Exploitation requires local code execution with the privileges of a normal installed app (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and yields confidentiality impact only - no integrity or availability effect, and no remote or unauthenticated path. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.16% (6th percentile), so this is a low-priority, patch-and-move-on issue that is fully resolved by updating to iOS 27/iPadOS 27, visionOS 27, or watchOS 27; macOS and tvOS are not listed as affected.
Processing maliciously crafted web content in Apple's WebKit-based browser stack can disclose sensitive user information across Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 and earlier. Apple classifies the root cause as an improper privilege management (permissions) issue and fixed it by removing the vulnerable code rather than adding a check, per the vendor advisories referenced for CVE-2026-64753. Real-world urgency is currently low: EPSS is 0.14% (4th percentile), there is no CISA KEV listing or public exploit identified at time of analysis, and CISA's SSVC assessment is exploitation:none / automatable:no / technical impact:partial, while a vendor patch is already available.
Privilege escalation in October CMS 3.x and 4.x lets an authenticated backend user who holds CMS markup editing rights break out of the Twig Safe Mode sandbox and impersonate an existing superuser. The bypass chains two weaknesses: the Laravel session store is handed to Twig templates with unrestricted method access, and raw SQL methods (selectRaw, whereRaw, orderByRaw, joinSub) leak through Eloquent's __call forwarding so a template can run arbitrary queries and then overwrite the admin_auth session key. Publicly available exploit code exists, but exploitation requires cms.safe_mode to be explicitly enabled, a deliberately untrusted markup editor account, and a pre-existing superuser whose session can be forged — a combination that October CMS states does not occur in standard production deployments.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Privilege escalation in Soarkey StudentManagement allows unauthenticated remote attackers to self-assign arbitrary privilege levels during account registration by manipulating the `level` POST parameter in the Registration Workflow handled by `RegisterServlet.doPost`. An attacker can register a standard user account but set their privilege level to administrator, gaining unauthorized access to elevated functionality such as student record management. A publicly available proof-of-concept exists via GitHub issue #35, and SSVC classifies this as automatable with partial technical impact.
Out-of-bounds write in the Samsung Exynos Display Processing Unit (DPU) kernel driver enables a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges on devices running Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 mobile processors. The flaw stems from missing input length validation in the color mode LUT (Look-Up Table) parsing path of the DPU driver, allowing attacker-controlled data to overflow a kernel buffer. No public exploit code has been identified at time of analysis, though the Samsung semiconductor advisory page confirms the issue and implies a patch is available.
Unauthenticated remote attackers can register accounts with elevated (administrator) privileges in jaychouchannel Tourism-Management-System by manipulating the UsersEntity parameter during registration, bypassing role assignment controls. The commit diff reveals a broader scope than the description implies: at least 12 controller classes (ChatmessageController, multiple Discuss* controllers, ForumController, FriendController, FriendlinkController, NewsController, NewstypeController, StoreupController) had security() endpoints decorated with @IgnoreAuth, making those endpoints callable without any authentication. Publicly available exploit code exists; no active exploitation confirmed in CISA KEV.
Privilege escalation via mass assignment in lenve vhr 1.0-SNAPSHOT allows an authenticated remote user to manipulate restricted fields - including role or privilege-level attributes - through the HrInfoController.updateHr endpoint by injecting unexpected parameters alongside the Password argument in HrMapper.xml. The vulnerability stems from improper privilege management (CWE-266), enabling a low-privilege HR system user to elevate their own account permissions without authorization. A public proof-of-concept has been disclosed; no vendor patch is available and the vendor has not responded to the disclosure.
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain higher-tier memberships without paying the correct price. The plugin's PayPal IPN (Instant Payment Notification) handler accepts the membership level asserted in the payment notification without verifying it matches the level configured for the specific payment button that was purchased, enabling a low-cost membership purchase to be fraudulently upgraded to any higher tier. A publicly available exploit exists, and vendor patch 4.7.8 resolves the issue.
Improper privilege management in xxl-job admin up to version 3.4.2 exposes the `loadById` endpoint of `JobGroupController.java` to unauthorized access by low-privileged authenticated users, leaking executor group configuration data. The vulnerability resides in the admin web interface's job group management controller and allows users who should lack access to read job group details via direct endpoint calls. A public proof-of-concept exploit exists; no vendor patch has been released following disclosure, as the vendor did not respond.
Privilege escalation to root on Palo Alto Networks Cortex XDR Broker VM is achievable by an authenticated low-privileged user who simultaneously holds a man-in-the-middle position on the adjacent network segment. The underlying flaw is argument injection (CWE-88), allowing the attacker to manipulate command-line arguments processed by the Broker VM to gain root-level code execution on the appliance. No public exploit has been identified (CVSS 4.0 E:U, Urgency: Amber), and Palo Alto Networks has published an advisory at security.paloaltonetworks.com.
Multiple local privilege escalation flaws in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow any authenticated local user to elevate privileges to NT AUTHORITY\SYSTEM or root. The root cause is CWE-426 (Untrusted Search Path), a class of vulnerability commonly manifesting as DLL search-order hijacking or PATH manipulation that the privileged VPN client process follows. No public exploit is known at time of analysis, and Palo Alto has released fixed versions; iOS, Android, and ChromeOS deployments are explicitly not affected.
Privilege escalation in the HPE Aruba ClearPass OnGuard agent enables an authenticated network-accessible attacker with low privileges to elevate to root on the affected deployment. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation requiring no user interaction, making it straightforward to weaponize for any attacker who holds even a basic account on the system. No public exploit code or CISA KEV listing has been identified at time of analysis; HPE has published advisory hpesbnw05130en_us, which presumably details affected versions and remediation.
Dell Secure Connect Gateway 5.0 Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) contain a CWE-250 Execution with Unnecessary Privileges flaw in which internal components operate with OS-level permissions exceeding what their function requires, allowing a locally authenticated high-privileged attacker to perform unauthorized modifications to system integrity and availability. The affected products are Dell's enterprise remote support gateway platform used to facilitate secure ProSupport connectivity in production environments. No public exploit code has been identified and the CVSS 3.4 Low rating reflects the substantial access prerequisites - local access and a pre-existing high-privilege account - sharply limiting opportunistic exploitation potential.
Permission control bypass in HarmonyOS 6.1.0's app lock module allows a local low-privileged user to circumvent locking protections and read content belonging to locked applications. The flaw is rooted in CWE-264, indicating improper enforcement of permission restrictions within the module. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the C:H CVSS impact signal indicates full confidentiality exposure to locked app data once exploited locally.
Permission control bypass in the Huawei HarmonyOS and EMUI Settings module allows an attacker with physical access to a device to read confidential data from a protected scope beyond the Settings component. The vulnerability affects HarmonyOS versions 4.0.0 through 4.3.3 and EMUI versions 14.0.0 through 16.0.0, as confirmed by Huawei PSIRT via the September 2026 security bulletin. The CVSS scope-change indicator (S:C) signals that successfully exploiting the flaw grants access to confidential resources outside the Settings module itself, though integrity and availability are unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Permission control weakness in the HarmonyOS window module allows a local attacker to bypass access restrictions and read protected service data on HarmonyOS 6.1.0 devices. The CVSS vector (AV:L/AC:H/PR:N) confirms local-only exploitation with high attack complexity, substantially limiting reach. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; the primary concern is confidentiality exposure on unpatched consumer and laptop devices.
Untrusted Search Path exploitation in Adobe Acrobat and Acrobat Reader allows a local attacker who already holds high privileges to gain unauthorized read access to sensitive confidential data under specific, attacker-uncontrollable environmental conditions. Affected products include Acrobat 2024 (≤24.001.30383), Acrobat Reader, and Adobe Acrobat (both ≤26.002.21900), per EUVD-2026-74105 and Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis; exploitation mandates a victim open a malicious file and requires conditions beyond the attacker's direct control.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Improper access control (CWE-284) in Fortinet FortiSOAR allows an authenticated low-privilege user to escalate their privileges within the platform via an undisclosed attack vector. Both PaaS and on-premise deployments across FortiSOAR versions 7.3 through 7.6.6 are affected. No public exploit or CISA KEV listing is present at time of analysis; the Fortinet PSIRT advisory FG-IR-26-164 is the sole authoritative source.
Improperly controlled modification of dynamically-determined object attributes in the Ash framework for Elixir (ash 2.17.15 through 3.33.10) lets a caller set private action arguments, declared with public?: false, on the bulk update and bulk destroy code paths. The affected matching logic in Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 compares every key of a caller-supplied parameter map against all of the action's arguments without checking public?, so any application that forwards end-user parameters into Ash.bulk_update/4 or Ash.bulk_destroy/4 (for example via AshJsonApi, AshGraphql, or a controller) can have a private argument injected; when that argument is referenced by an arg(...) template driving authorization, record ownership, or audit metadata, the result is an integrity violation or privilege escalation. The vendor has released a patch in 3.33.11 that requires public? in the bulk argument matching; no public exploit code has been identified at time of analysis, and the impact is conditional on the application both exposing a bulk action to untrusted input and using a security-relevant private argument.
Workspace ADMIN accounts in Docmost prior to 0.90.1 can mint OWNER-level accounts through the workspace invitation flow, because the invite path never enforces a role ceiling that would stop an administrator from granting privileges above their own. An attacker who already holds the ADMIN role can invite an external email address with the OWNER role; once that invitation is accepted, the resulting account holds the highest privilege level in the workspace, enabling a persistent backdoor OWNER account or the elevation of a colluding external user. Exploitation is access-gated rather than anonymous - it requires an authenticated HIGH-privilege (ADMIN) account and the invitee must accept the emailed invitation (PR:H, UI:R) - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in TÜBİTAK ULAKBİM UlakPDF (all versions through 09092026) allows an authenticated, low-privileged user to reach data and functionality that should be reserved for higher-privileged roles, driven by an incorrect authorization check in the application's access-control logic. The issue carries a CVSS 3.1 base score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is network-reachable but requires a pre-existing valid low-privileged account plus a non-trivial precondition that the public description does not name, and requires no user interaction; confidentiality and integrity impacts are high while availability is unaffected. Reported by TR-CERT via siberguvenlik.gov.tr, the flaw is constrained in real-world priority by the credential prerequisite, the elevated attack complexity, and UlakPDF's narrow academic and government deployment footprint - no public exploit identified at time of analysis.
RabbitMQ stream-management HTTP API allows an authenticated user holding the management tag and vhost access - but no configure permission on any resource - to create super-streams, which consist of an exchange, N partition stream queues, and their bindings, without the per-resource authorization check the native stream protocol path enforces. This is a genuine but low-impact authorization flaw (CWE-862 missing authorization) rated CVSS 2.1 by the vendor and an assessed CVSS:3.1 of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, since the impact is confined to unauthorized integrity changes (persistent resource creation) with no data disclosure or denial of service. Exploitation requires the non-default rabbitmq_stream_management plugin to be enabled and a management-tagged account with vhost access; no KEV listing or public exploit was identified, and vendor fixes are available in 4.0.22, 4.1.11, 4.2.6, and 4.3.0.
Improper access control in IBM Concert 1.0.0 through 3.0.0 lets a local attacker who already has access to the host modify application files that should be protected, yielding an integrity-only impact with no data disclosure or denial of service. The vendor CVSS vector is 6.2 with AV:L/PR:N, while the independent assessment rates PR:L because exploiting this flaw in practice typically requires at least a local account or a compromised co-resident process; IBM has released a vendor patch. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied. This is a genuine integrity risk but not a top-priority emergency, given the local attack vector and the product's limited deployment.
Argument injection in the ad hoc command builder of Red Hat Ansible Automation Platform 2 lets an authenticated user who is permitted to run ad hoc commands smuggle ansible CLI options by passing a host-restriction (`limit`) value beginning with a hyphen, which ansible-core then parses as an option flag. Impact today is minimal (CVSS 3.1, CWE-88): because the injected token displaces the required `pattern` positional argument, only short-circuit flags such as `--version` and `--help` are reachable, so integrity impact is limited to low and no arbitrary option or command control is achievable. There is no public exploit identified at time of analysis, and the issue would only escalate if a future ansible-core release were to default or make optional the `pattern` positional - a hypothetical, non-default upstream change rather than current behavior.
Local privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an attacker who already holds a low-privileged foothold inside a running FTM container - such as a compromised service account or code execution gained through a separate flaw - elevate their privileges within that container. The issue is rated CVSS 3.1 base 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and stems from improper privilege management (CWE-250), meaning the component runs with more authority than it needs; the scope is unchanged, so the flaw by itself does not provide a path to the host node or to other containers. No public exploit identified at time of analysis, and exploitation requires local authenticated access with no remote or unauthenticated vector.
Improper privilege management in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets an attacker who already holds a low-privileged authenticated account on the management interface escalate to unauthorized access with high confidentiality and integrity impact (CVSS 6.8, AV:N/AC:H/PR:L/UI:N). The weakness maps to CWE-269 and requires network reachability plus a non-trivial precondition (AC:H), so it is not triggerable by a fully unauthenticated remote attacker. No public exploit code has been identified and the flaw is not confirmed actively exploited (CISA KEV), so urgency is moderate and driven primarily by the mandatory low-privilege foothold; the vendor-released fix is version 5.34.00.16.
Stored cross-site scripting in Nautobot (all versions prior to 2.4.37 on the 2.x branch and prior to 3.1.8 on the 3.x branch) lets an authenticated user with extras.add_relationship or extras.change_relationship permission inject HTML or JavaScript into a Relationship description, or with dcim.add_modulefamily or dcim.change_modulefamily permission inject it into a Module Family name, which then executes in the browser session of any user - including administrators and superusers - who opens an affected create or edit form. Because the payload runs in the victim's authenticated context with same-site access to the Nautobot UI, an attacker can perform actions as the victim and potentially steal session cookies or API tokens, enabling lateral movement and privilege escalation toward a full administrative compromise of the platform. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so risk is assessed as moderate rather than critical: exploitation requires a pre-existing authorized account with specific object-level write permissions, and a higher-privileged victim must interact with the poisoned form.
Remote unauthenticated attackers can perform unlimited password guessing against the pH7Builder (pH7 Social Dating CMS) administration login through version 19.2.0 by bypassing the CAPTCHA, which is only rendered when the PHP session flag captcha_admin_enabled is set. Publicly available exploit code exists, and the bypass chain is detailed in a third-party blog, though the EPSS score is low at 0.38% (31st percentile) and CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). The practical impact is limited to enabling brute-force attempts; strong admin passwords or an external rate limiter materially reduce risk.
Local information disclosure in Dell Command | Integration Suite for System Center (versions prior to 6.7.2) allows a low-privileged, authenticated local user to read sensitive data that should not be accessible to that account. The root cause is incorrect default file or directory permissions (CWE-276) shipped with the SCCM add-on, which grant broader read access than intended. Exploitation requires an existing local session on the Windows host running the affected software - there is no remote vector, no user interaction, and no privilege escalation needed beyond the initial foothold - and the result is confidentiality impact only, with no code execution, data modification, or availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the assessed CVSS 3.1 base score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Local information disclosure in Dell Command | Intel vPro Out of Band versions prior to 4.7.2 lets an authenticated, low-privileged user on a Windows host read data that should have been restricted, because the product ships files, directories, registry keys, or objects with overly permissive default access controls (CWE-276). Per the vendor's own advisory the impact is limited to confidentiality - no integrity or availability effect - and the vector requires local access plus a valid low-privilege account (AV:L/PR:L/UI:N), which is why it scores a moderate 5.5. No KEV listing or public exploit code was identified at time of analysis, and no public exploit has been identified; real-world risk is confined to hosts where an attacker already has a foothold, so this is routine patch-cycle work rather than an emergency.
Privilege escalation in UVdesk core-framework before 1.1.7 lets an authenticated agent who already holds the agent-management privilege promote their own account to ROLE_ADMIN through the editAgent endpoint, gaining full administrative control over agents, tickets and mail configuration. The attacker simply submits their own account identifier together with a role parameter set to ROLE_ADMIN, so the flaw converts a delegated helpdesk-management role into complete tenant takeover. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is only practical in deployments that grant agent-management rights to non-administrators.
Authenticated privilege escalation in CodeAstro QR Code Attendance Management System 1.0 lets a logged-in, low-privileged user manipulate the role_id argument in the UserController Save action to assign elevated roles, up to administrator, to any account they control. The flaw is an improper privilege management weakness (CWE-269) exposed through the PHP web interface, and publicly available exploit code exists (a GitHub proof-of-concept), though there is no CISA KEV entry confirming active exploitation. Severity is modest and consistent with the raw numbers: vendor CVSS 5.1 with low confidentiality, integrity and availability impact, and independently assessed as requiring an authenticated session (PR:L) against this single, obscure application at version 1.0.
Improper privilege management in samanhappy MCPHub up to 1.0.32 lets any authenticated non-admin user import a configuration template that defines a 'privileged' server (a stdio server, any config carrying command/args, or any config with no remote target), which MCPHub then spawns locally as an operating-system command - resulting in arbitrary command execution as the MCPHub process. Exploitation only requires a valid low-privilege login and access to the Template Import Endpoint (CVSS 4.0 vector shows PR:L), and publicly available exploit code exists via GitHub issue #1094, so the practical risk is higher than the vendor's 5.3 score suggests; this assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The flaw is fixed in MCPHub 1.0.33, where importTemplate enforces the admin-only privileged-config policy.
Improper default filesystem permissions in WatchDog Anti-Virus for Windows let any local, low-privileged user take over the installation directory, because the default installer grants the Users group Full Control over C:\Program Files (x86)\Watchdog Anti-Virus. That access alone is enough to disable protection by deleting or rewriting antivirus binaries and configuration files, and it can escalate to privileged code execution if a tampered binary is subsequently loaded by an elevated WatchDog process, for example after a service restart, scheduled scan, or update cycle. The flaw requires an existing local user account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; vendor CVSS 4.0 base 5.9, PR:L) and is confined to hosts still running the affected installer build; no public exploit code was identified at time of analysis, and WatchDog's release notes reference the corrected build.
Improper privilege management in SxDevOps 1.0/1.1 allows an authenticated user to escalate their own privileges by manipulating the update path of the UserSerializer in backend/rbac/serializers.py, reachable remotely over the network against the RBAC user-update API. The vulnerability is rated medium (CVSS 4.0 base 5.1, AV:N/AC:L/PR:H/UI:N/VC:N/VI:L/VA:L), with the main impact being integrity of role/permission data; a public exploit has not been identified at time of analysis and there is no CISA KEV listing. The vendor was contacted early, responded promptly, and published a fix in commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9, so patched deployments are no longer exposed.
An authenticated user holding the quiz-import capability in the Forminator Forms WordPress plugin (versions 1.57.0 through before 1.57.2.1) can escalate to full site control by embedding a role-assigning registration form inside an imported quiz and publishing it, granting any role - including administrator - to anyone who submits the public form. The plugin enforces role validation in the ordinary form editor and ordinary form import paths but omits that check in the quiz-import code path, making the nested-quiz route the only viable bypass; the identical form is rejected through both normal routes. A vendor patch is available (1.57.2.1) and publicly available exploit code exists, so although the vendor scores this 6.6 (AC:H/PR:H), the assessed vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) is materially higher given that a non-administrator with delegated import rights can achieve complete site compromise.
ZTE SmartLife's backend signup interface (/account/person/signup.serv) creates accounts for arbitrary email addresses without verifying that the requester owns the address, so an attacker who has extracted the app's runtime-generated authentication parameters can complete registration against any email string. The assigned vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3) and our independent assessment agree on moderate severity: the primary barrier is first obtaining the client-generated app authentication parameters - obtainable via reverse engineering or traffic interception and reflected as PR:L - with no per-victim credentials, user interaction, or non-default configuration required and the endpoint network-reachable. No KEV entry and no public exploit identified at time of analysis, so real-world urgency is genuinely low, though the integrity impact on account/identity assurance is real anywhere the platform subsequently trusts the registered email for identity, notifications, or recovery.
Improper privilege management in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) versions 3.1 through 3.5 allows a network-reachable attacker who already holds a high-privilege administrative account on the management plane to escalate their privileges within the product, per CVE-2026-20287 (CVSS 3.1 base 6.5, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). The flaw is one of several defects bundled into a Cisco internal-hardening release and is tracked under the CWE-269 improper privilege management pillar; the exact vulnerable sub-feature is not individually described in the grouped advisory. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); because the vector requires PR:H, this is a post-authentication privilege escalation affecting the appliance's administrative layer rather than an initial-access or unauthenticated remote code execution issue. For most organizations it represents a moderate-priority, defense-in-depth concern that is materially mitigated by keeping the ISE management interface off untrusted networks, though the potential for both confidentiality and integrity impact (C:H/I:H) still warrants prioritized patching on any ISE deployment that exposes its admin plane broadly or grants many staff high-privilege accounts.
Denial of service in HP's HPLIP (HP Linux Imaging and Printing Software) printing stack is reachable when a physically-present attacker supplies specially crafted input that triggers a CWE-191 integer underflow, crashing or hanging affected components; the scored CVSS:3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) limits impact to availability only, with no confidentiality or integrity loss. The physical attack vector (direct hardware/USB or local physical access) is the dominant gating factor and rules out remote or network-based exploitation, and no public exploit has been identified at time of analysis. HP has stated that it identified and remediated the underlying issues, so a vendor fix is available per advisory hpsbpi04151, though the specific affected and fixed version ranges are not enumerated here and must be confirmed against that bulletin. Overall this is a genuine but low-priority issue: real availability impact, but exploitation requires an attacker to already have hands on the machine.
Denial of service in HP Linux Imaging and Printing Software (HPLIP) can be triggered by a physically present attacker who supplies crafted input via a local device or print/scan job, exploiting improper array index validation (CWE-129). Although HP's advisory bundles several vulnerabilities that could potentially enable a broader range of impacts, the specific vector for this CVE limits the effect to availability (system crash or service disruption) with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and the primary prerequisite is physical access to the target system.
Command injection (CWE-78) in HP's HPLIP (HP Linux Imaging and Printing) software enables an unauthenticated local user to execute commands or modify files with high integrity impact (VI:H) after active user interaction, matching HP's CVSS 4.0 score of 6.8 (AV:L/AC:L/PR:N/UI:A/VC:L/VI:H/VA:L) and the independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:R/C:L/I:H/A:L). The HP security bulletin HPSBPI04151 bundles this issue with other externally reported HPLIP flaws that could lead to remote code execution, privilege escalation, denial of service, or information disclosure, but the exact vulnerable component is not disclosed. No public exploit code or CISA KEV entry is identified at time of analysis, and the local vector plus mandatory user interaction prevents triggering without a user processing attacker-supplied input.
Local attackers with valid credentials on Linux systems running HPLIP can exploit symbolic-link handling flaws (CWE-61) in HPLIP components to read or modify arbitrary files, as described in HP security bulletin HPSBPI04151. This CVE is one of multiple issues remediated by HP in HPLIP and is assessed as a moderate, locally-scoped issue (CVSS 3.1: AV:L/AC:L/PR:L/UI:N, limited confidentiality/integrity impact) rather than an urgent priority, despite the broader impact list in the description; no public exploit code or CISA KEV active exploitation has been identified at time of analysis. Exploitation requires local access and a vulnerable HPLIP component that follows attacker-controllable symlinks at a predictable path, limiting impact to unauthorized file read/modification.
Local privilege escalation in Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 allows an attacker with existing high-privileged local access to elevate privileges. The flaw stems from improper privilege management (CWE-269) and requires authenticated local access (PR:H/AV:L); it is not remotely exploitable. No public exploit code or active exploitation has been identified, and vendor patches are available.
Improper permission preservation during archive decompression in the HashiCorp go-getter library (1.8.x up to 1.8.8 and 2.x up to 2.2.3) lets a crafted archive cause extracted files to be created with attacker-influenced, elevated permission bits. When the extraction is performed by a privileged process — for example a root-run provisioning, CI, or orchestrator agent — a local actor can leverage the resulting files to gain the privileges of that extracting process, escalating from a low-privileged position to root or service-level access. HashiCorp has released fixes in go-getter 1.8.9 and 2.2.4; the issue is not listed in CISA KEV and no public exploit code has been identified at time of analysis.
Local attackers who already hold high privileges and a valid logon to the host running Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to seize full control of the application, with complete loss of confidentiality, integrity and availability. The issue is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and no public exploit code, EPSS score or CISA KEV entry was present in the supplied intelligence. Because it requires pre-existing privileged local access, this is primarily a post-compromise escalation and insider-abuse concern rather than an internet-facing remote attack.
Privilege escalation in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated, already high-privileged remote user exceed their assigned authorization level and execute arbitrary code on the appliance. Four release branches are affected: 9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1 and 9.7.0.0. The CVSS score of 6.6 understates the operational weight of the flaw because a compromised SD-WAN gateway sits on the control plane of the whole WAN fabric; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
An out-of-bounds write in the Android kernel GNSS link driver lets a local process that already holds System execution privileges corrupt kernel memory and escalate to kernel-level code execution. The defect (CWE-787) is a missing bounds check in link_load_gnss_image() in link_device.c, requires no user interaction, and is addressed through Google's September 2026 Android/Pixel security bulletin. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in the arm-smmu-v3 driver of Google's Android kernel lets code already running with System privileges bypass the ARM SMMUv3 protection mechanism and reach higher-level (kernel/root) execution on affected ARM-based devices, including Pixel. The root cause is a logic error classified as CWE-693 (Protection Mechanism Failure), reachable without any user interaction but only from a local, already-privileged context (CVSS PR:H). No public exploit code and no active exploitation have been identified at time of analysis, so this is a monthly-bulletin hardening fix rather than an emergency patch.
Local privilege escalation in Google Android's GPU driver component allows a process that already runs with System execution privileges to bypass a permission check through a logic error, gaining full read/write/execute impact at a higher privilege level. Only Android devices carrying the affected GPU component are exposed, and exploitation is strictly local with no user interaction, so it cannot be triggered by a remote attacker or a normal unprivileged app on its own. There is no public exploit code and no CISA KEV listing identified at time of analysis; remediation is delivered through the September 2026 Android/Pixel security bulletin.
Local privilege escalation in the Android kernel's arm-smmu-v3 driver (smmu_install_nested_ste) lets a process that already runs with System execution privileges turn a logic error in SMMU stream-table-entry handling into full kernel-level compromise of confidentiality, integrity, and availability. Only devices whose kernel exposes the ARM SMMUv3 driver in a nested-translation configuration are affected, and Google rates it Moderate with a CVSS base of 6.7 (AV:L/PR:H), meaning exploitation presupposes a highly privileged local foothold rather than remote or unauthenticated access. There is no indication of public exploit code and the issue is not listed in CISA KEV; Google's Pixel bulletin of 2026-09-01 ships the fix.
A use-after-free in the ARM SMMU v3 driver (arm-smmu-v3.c) of the Android kernel lets a local attacker who already holds System-level execution privileges corrupt kernel memory and escalate to full kernel/System privilege. The flaw is a logic error in one of several driver functions that leaves a freed object reachable, and no user interaction is needed once the attacker has code running at that privilege level. It is ranked CVSS 6.7 (AV:L/PR:H), there is no indication of active exploitation or public exploit code, and Google published a fix in the September 2026 Pixel security bulletin.
A logic error in the ARM SMMU v3 driver's smmu_detach_dev path allows a caller who already holds System-level privileges on an Android device to bypass SMMU/IOMU memory-permission checks and escalate to kernel (EL1) execution, achieving full compromise of the device. Affected are Google Pixel/Android builds using the arm-smmu-v3 driver prior to the September 2026 Android Security Bulletin patch level. Exploitation is local, requires no user interaction, and no public exploit code or CISA KEV listing was identified at time of analysis, so the practical risk is concentrated on devices that already run privileged or partially compromised code.
A confused-deputy flaw (CWE-441) in the Android platform's message-handler initialization routine, platform_msg_handler_init in default_msg_handlers.c, lets a local process that already runs with System privileges have privileged operations performed on its behalf by a more trusted component, resulting in local privilege escalation with high impact to confidentiality, integrity and availability. Exploitation requires local execution at the System privilege level (CVSS PR:H) and no user interaction, so it is not reachable by an ordinary unprivileged app. There is no public exploit code identified and the issue is not in CISA KEV; it was published through the September 2026 Android/Pixel security bulletin, so risk to most users is conditional on already having a System-level foothold or being part of an exploit chain.
A missing permission check in the FSM key-release routine (FsmReleaseKey in fsm.c) of the Android kernel allows a locally positioned attacker to bypass an access-control verification and escalate privileges on affected devices. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is classified as CWE-693, Protection Mechanism Failure, because the intended permission gate is simply not enforced on that code path. Exploitation requires the attacker to already hold System-level execution privileges on the device, and no public exploit code or CISA KEV entry has been identified at time of analysis.
Local escalation of privilege in the Android kernel's ARM SMMU v3 driver lets a process that already runs with System privileges reach kernel-level code execution by passing malformed input to the nested device-detach path (smmu_detach_dev_nested in arm-smmu-v3.c). Because the CVSS vector requires PR:H, this is not a boundary an ordinary unprivileged app can cross — it is a second-stage escalation for code that already holds highly privileged, kernel-adjacent access on the device. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so risk is driven by the monthly Android/Pixel kernel patch cycle rather than by observed attacks; no EPSS score was supplied in the input data.
A time-of-check to time-of-use (TOCTOU) race condition in multiple locations of the Android kernel allows an attacker who already holds System-level execution privileges on a device to win a timing window and escalate to higher (kernel/root) privileges, with no user interaction required. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is fixed through the September 2026 Android Security Bulletin for Pixel devices. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and no EPSS score was supplied, so the practical risk is concentrated in post-compromise privilege escalation rather than remote mass exploitation.
Local privilege escalation in the Android kernel's PMIC inter-process-communication driver (ap_pmic_ipc.c) lets a caller that already holds System execution privileges bypass permission checks via a confused-deputy flaw in ap_pmic_poll_msg_handler and gain kernel-level code execution. Only Android devices that carry the affected PMIC IPC driver — the Google Pixel bulletin of 2026-09-01 is the vendor reference, and the CPE scopes this to google:android — are exposed, and the attacker must already be running with elevated (System) privileges on the device. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this reads as a post-compromise escalation primitive rather than a remotely reachable entry point.
Local privilege escalation in Google Android/Pixel arises from a permission bypass in the DreamPickerReceiver.kt component (the Daydream/screensaver picker), where a confused-deputy flaw lets a locally installed application reach privileged operations that execute with System privileges. Affected are Android/Pixel builds at security patch levels prior to the 2026-09-01 bulletin; exploitation requires the attacker to already have local code execution via a malicious or compromised app, and no user interaction is needed once that app is present. The issue is fully local (AV:L) with no remote or network reach, no public exploit code has been identified at time of analysis, and devices carrying the 2026-09-01 patch level are not exposed.
An out-of-bounds write in the Android kernel, caused by a missing bounds check, allows an attacker who already holds System-level execution privileges on a device to corrupt kernel memory and escalate to full kernel/root privileges. The flaw is reachable only with local access (AV:L, PR:H) and requires no user interaction, and the associated CVSS score of 6.7 reflects high integrity, confidentiality and availability impact rather than ease of reach. No public exploit code or CISA KEV active-exploitation listing was provided in the available intelligence, so this is currently assessed as a patch-priority local privilege-escalation bug rather than a known exploited threat.
A permission bypass in multiple Google Android system components allows an attacker who already holds System-level code execution to escalate privileges via a confused-deputy flaw. Google addressed it in the September 2026 Pixel security bulletin (patch level 2026-09-01); exploitation is local, requires no user interaction, and demands a pre-existing privileged foothold (CVSS PR:H), so it functions as a privilege-escalation link in a chain rather than a standalone remote compromise. No CISA KEV listing, no public exploit code, and no EPSS score were provided at time of analysis.
A missing bounds check in multiple locations of Android kernel code allows a local attacker who already holds System execution privileges to trigger an out-of-bounds write and escalate to higher, kernel-level privileges on affected devices. Google Android builds that ship the impacted kernel code are affected, with fixes published through the September 2026 Pixel/Android security bulletin. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.7 score reflects the demanding high-privilege prerequisite rather than any remote reachability.
Local privilege escalation in Android's Bluetooth stack allows an attacker who already holds System-level execution on a device to turn a race condition in bluetooth_cco.cc into a use-after-free and elevate to a more privileged context. Google device users on builds prior to the September 2026 Pixel bulletin (patch level 2026-09-01) are the affected population, and the flaw requires no user interaction, though attack complexity is high and System privileges are a prerequisite. No public exploit code has been identified and the issue is not listed as actively exploited, so real-world risk concentrates in targeted or chained attacks against already-compromised high-value devices.
Permission bypass logic errors in Google Android allow a local actor who already holds System-level execution privileges to gain further privileges on affected devices, including Pixel handsets addressed by the September 2026 Android Security Bulletin. The flaw stems from a protection-mechanism failure in which permission checks in unspecified locations are skipped, requiring only local access and no user interaction; an attacker cannot use it for initial compromise or to escalate from an ordinary unprivileged app, since System privileges are a hard prerequisite. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment that this is a genuine but low-priority issue.
Local privilege escalation in the Android kernel affects Google Pixel devices and is addressed by the September 2026 Pixel security bulletin; an attacker who already holds System-level execution privileges on the device can exploit a logic error in the code to gain further elevated access. The flaw is a logic error rather than a memory-safety bug, requires no user interaction, and is not remotely reachable - the CVSS vector (AV:L/PR:H/UI:N) confirms it is only usable as a secondary escalation step after an initial high-privilege local compromise. There is no public exploit identified at time of analysis, no CISA KEV listing, and the EPSS score of roughly 0.12% (2nd percentile) reflects the low likelihood of exploitation, making this a low real-world priority despite the 6.7 'Medium' base score.
Out-of-bounds write in the Android kernel lets a local attacker who already holds System-level execution privileges corrupt memory and escalate to full kernel/root code execution without any user interaction. Devices running Android builds that have not yet adopted the September 2026 (2026-09-01) security patch level are affected, with Google rating the flaw High at CVSS 6.7. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with this data.
Local privilege escalation in the Android kernel stems from a use-after-free condition triggered by a race between concurrent operations, allowing an attacker who already holds System-level execution privileges on the device to elevate to a higher (kernel-level) context. The flaw carries a CVSS 3.1 base score of 6.4 (AV:L/AC:H/PR:H/UI:N) and is addressed in Google's September 2026 Android/Pixel security bulletin. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation (CISA KEV).
Memory corruption in the Android Trusted Execution Environment (TEE) allows a local attacker who already holds System execution privileges to escalate privileges within the secure world by supplying improperly validated input to an affected secure-world interface. The flaw is local-only (AV:L), requires high pre-existing privileges (PR:H), and needs no user interaction (UI:N), yielding high confidentiality, integrity, and availability impact if the corrupted trusted application is reached; Google rates it 6.7 (Medium). Risk is tempered by the significant foothold required, the local-only attack surface, and the low EPSS score (0.11%, 2nd percentile); no public exploit code has been identified and the flaw is not listed in CISA KEV, with fixes delivered in the Pixel security bulletin dated 2026-09-01.
Let me synthesize. CVE-2026-56923: Android kernel TIPC virtio driver (tipc_virtio_dev.c) handle_unmap_req race condition memory corruption, local EoP. CVSS 3.1: AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H → 6.4. Note PR:H which is odd for a local privilege escalation "with no additional execution privileges needed" — the description says no additional execution privileges needed. Hmm, the CVSS says PR:H. There's a conflict: description says local EoP with no additional execution privileges needed (implying PR:N or PR:L?), while CVSS vector says PR:H. This is a data conflict worth noting in confidence_notes and risk_assessment. Actually Android's kernel CVEs for local EoP typically are AV:L/AC:H/PR:H/UI:N in their bulletins... Actually Android uses PR:H sometimes? Hmm. Let me note the conflict: description claims "no additional execution privileges needed" but vector shows PR:H (high privileges required), which typically means the attacker already needs elevated privileges — contradictory for an EoP. State explicitly. Product name: "Android Kernel" — 2 words. Or "TIPC Virtio Driver". Primary product per CPE: google:android. I'd say "Android Kernel". Tags: Privilege Escalation, Buffer Overflow, Google, Race Condition. Buffer Overflow mislabeled? The CWE is race condition/memory corruption. Hmm — "Buffer Overflow" tag is arguably a mislabeled tag since CWE-362 race condition and description says memory corruption not buffer overflow. But memory corruption could involve buffer overflow. I'd be moderately confident... The instructions say only emit flag when clearly wrong and verifiable. Memory corruption due to race condition — buffer overflow is a specific subclass. It's arguably mislabeling. I could flag it with low/medium confidence. Hmm. I think I'll flag it as mislabeled_tag with medium confidence since the CVE is a race condition leading to memory corruption, no buffer overflow specified. Actually careful — race conditions can cause buffer overflows (TOCTOU). Risky.
A permission bypass in Android's CPM component allows a local attacker already running code with System execution privileges to leverage a confused-deputy weakness and escalate further, gaining full read/write/execute impact on the device. Exploitation requires local access and high (System-level) privileges per the CVSS vector but no user interaction, making it a post-compromise escalation primitive rather than a remote entry point. No public exploit code or CISA KEV listing was provided in the intelligence feed, and EPSS data was absent; the fix ships through the September 2026 Android/Pixel security bulletin.
A race condition (CWE-362) in the bigo_worker_thread function of the Android kernel component bigo.c can be won by a local attacker to escalate privileges beyond their current level. Exploitation requires the attacker to already hold System-level execution privileges on the device, and no user interaction is needed; the high attack complexity and PR:H rating reflect the need to win a TOCTOU timing window from an already-elevated context. Google disclosed and fixed the issue in the September 2026 Pixel/Android security bulletin, and there is no public exploit code or CISA KEV listing at time of analysis.
Local privilege escalation in Google Android's Video Processing Unit (VPU) component lets an attacker who already holds System-level execution privileges supply improperly validated input that overwrites shared memory, yielding high confidentiality, integrity, and availability impact with no user interaction required. The flaw (CWE-20) affects Android/Pixel builds that predate the 2026-09-01 security patch level and is only reachable locally, not over a network. Exploitation is constrained by the PR:H prerequisite - an ordinary unprivileged app cannot reach the vulnerable path - and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is correspondingly low at 0.11% (2nd percentile).
Permission bypass in the Android kernel, caused by an integer overflow in multiple code locations, allows an actor who already holds Android System execution privileges on a Pixel device to escalate privileges locally with no user interaction required. The vendor scores it 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the PR:H prerequisite is the decisive constraint: the high confidentiality, integrity and availability metrics describe what a System-context actor can reach, not what an ordinary installed app or remote attacker can achieve. EPSS is 0.12% (2nd percentile) and there is no public exploit code or CISA KEV entry identified at time of analysis, so the defect functions as a secondary privilege-boundary escape usable only after an initial System-level compromise, not as a standalone entry point.
A permission bypass in Google Android stemming from a side-channel information disclosure (CWE-203) allows a local attacker holding only low-privileged code execution to escalate privileges without any user interaction. The flaw yields high confidentiality impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N) by leaking observable discrepancies that undermine permission enforcement, though the vendor vector records no integrity or availability impact. It is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis.
Memory corruption in the Android kernel's GMC mailbox message handler (gmc_mb_msg_handler in gmc_mba.c) allows a local attacker who already holds System-level execution privileges to leverage a confused-deputy condition and escalate privileges on the device. The flaw is tracked as CWE-441 and rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N), meaning it is not remotely reachable and requires a high-privilege foothold rather than being an entry point; user interaction is not needed once that footing exists. Google Devices credited the report and fixed it in the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV entry was identified at time of analysis.
An out-of-bounds write in the Android kernel's remap.c code allows a local attacker holding System-level execution privileges to corrupt kernel memory and escalate to full kernel (root) privileges. The flaw stems from an incorrect bounds check (CWE-787) that fails to validate an offset or length before a write, and no user interaction is required once the attacker has the prerequisite System privileges. At the time of analysis there is no public exploit code and the issue is not listed in CISA KEV, but the September 2026 Pixel security bulletin confirms a vendor fix is available.
Local privilege escalation in the Google Android kernel stems from an out-of-bounds write caused by improper input validation in multiple code locations. An attacker who already holds System-level execution privileges on the device can craft malformed input to corrupt memory and elevate to kernel privileges on affected Android builds. No user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis, though the vendor-published September 2026 Pixel bulletin confirms a fix is available.
An out-of-bounds write in the Android kernel's printf implementation allows an attacker who already holds System-level privileges on the device to corrupt kernel memory and escalate further, typically to kernel/root context, by supplying improperly validated input to the affected formatting routine. Exploitation is local only and requires high privileges (CVSS 3.1 6.7, AV:L/PR:H/UI:N), so a malicious app running as System would be needed rather than a remote attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in Google's September 2026 Pixel/Android security bulletin.
Local privilege escalation in the Android kernel's address remapping code (addr_remap_address_map in remap.c) allows an attacker who already holds System-level execution privileges to further elevate their access on the device. The flaw is a logic error in mapping validation that constitutes a protection-mechanism failure (CWE-693); successful exploitation requires local access and high privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N), with no user interaction, and yields high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; EPSS is negligible at 0.12% (2nd percentile), and fixes are bundled into Google's 2026-09-01 Android/Pixel security bulletin, making this a genuine but bounded issue rather than a top-tier emergency.
Local privilege escalation in the Android kernel lets an attacker who already holds System-level execution privileges bypass a permission check and extend that access further on affected Pixel devices covered by the September 2026 Android Security Bulletin. The flaw is a logic error in permission handling (CWE-693) that requires no user interaction but is gated behind the high precondition of pre-existing System execution context (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7), making it a privilege-boundary bypass chained after an initial compromise rather than a standalone entry point. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment of a genuinely low-priority, locally-scoped issue.
Local privilege escalation in the Android bootloader lets a caller that already holds System execution privileges bypass a missing permission check and reach higher-privileged bootloader operations on affected Android devices. The CVSS vector (AV:L/PR:H/UI:N) makes clear this is a second-stage escalation that requires both local access and an existing high-privileged foothold, not a remote or unprivileged-app vector, and it needs no user interaction. Google resolves it through the September 2026 Android/Pixel security bulletin; EPSS is very low (0.11%, 2nd percentile) and no public exploit has been identified at time of analysis.
Local privilege escalation in Google Android's image authentication service (image-auth-srv.c) allows a component that already holds System execution privileges to abuse a logic error in the gsa_sw_pk_hash_compare public-key hash-comparison routine, achieving escalation into a more trusted execution context. The flaw is reachable only locally (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), so it is not an initial-access or remote vector. Exploitability signals are weak: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis; the practical risk is a defense-in-depth weakness affecting Pixel/Android builds that ship the affected image authentication service.
Local privilege escalation in the Android kernel's ac_init_one_sswrp() initialization routine (init.c) allows an attacker who already holds System execution privileges on an affected Android/Pixel device to escalate further by abusing a logic error in the code, with no user interaction required. Because the assessed vector is AV:L/PR:H, this is a post-compromise escalation primitive rather than a remote or unauthenticated entry point - the pre-existing System-level foothold is the primary limiting factor, which sharply narrows realistic exploitation to attackers who have already breached a highly privileged process. No public exploit code or CISA KEV listing was identified at time of analysis, EPSS is very low (0.12%, roughly the 2nd percentile), and Google has shipped a fix in the September 2026 Pixel bulletin (2026-09-01) - consistent with a genuine but low-priority issue.
Local privilege escalation in the Android Bootloader lets an attacker who already holds System-level execution privileges (PR:H) bypass a missing permission check on an exposed bootloader interface and escalate to higher integrity, confidentiality, and availability impact on the device. Exploitation is local only (AV:L), requires no user interaction (UI:N), and is confined to post-compromise escalation of a privilege boundary on affected Pixel/Android firmware, which is why the assessed severity is moderate (CVSS 6.7) despite high C/I/A ratings. EPSS is very low at 0.12% (2nd percentile), no public exploit code exists, and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; Google's September 2026 Pixel security bulletin covers the fix.
Privilege escalation in Secomea GateManager 11.5 and 11.4.625515072 allows an authenticated, low-privileged user (CVSS PR:L) to reach data or functionality that should be reserved for higher-privileged roles, resulting in a high confidentiality impact (C:H/I:N/A:N). Secomea has released fixed builds — 11.6 and 11.4.626194074 or later — and the flaw is rooted in CWE-280, improper handling of insufficient permissions or privileges. No public exploit code or CISA KEV entry has been identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation activity is currently unconfirmed.
Apps installed on Apple iOS/iPadOS, tvOS, visionOS, and watchOS prior to version 27 can read the user-assigned device name without the additional authorization Apple intended, an improper permission-management flaw tracked as CVE-2026-86893 and fixed in the iOS 27, iPadOS 27, tvOS 27, visionOS 27 and watchOS 27 releases. The issue requires a malicious or compromised app already running locally with ordinary low-privilege sandbox access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 3.3) and yields nothing beyond disclosure of that single low-sensitivity identifier - no code execution, no privilege escalation, and no effect on integrity or availability, with macOS unaffected. There is no public exploit identified at time of analysis, EPSS is 0.16% (6th percentile), and the CVE is not in CISA KEV; the practical gate is getting a hostile app onto the device in the first place, which keeps real-world exposure low.
A locally installed app on unpatched Apple platforms can read a persistent account identifier it is not authorized to access, handing the app a stable value that could be used to correlate or track a user across apps and sessions. Impact is confined to privacy-relevant information disclosure: the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (3.3), meaning a low-privilege app must already be installed and running on the device, with no remote or network vector and no user interaction beyond launching that app. Affected are iOS and iPadOS before 27, macOS before 27 (Golden Gate) and before 26.7 (Tahoe), tvOS before 27, visionOS before 27, and watchOS before 27, all of which now have fixed releases. This is a low-priority issue overall: exploitation is not confirmed, no public exploit identified at time of analysis, and EPSS is just 0.19% (9th percentile).
Protection-bypass in Apple macOS allows a malicious or compromised app already running with normal (non-root) user privileges to circumvent intended permission restrictions and read protected user data; the flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Exploitation is strictly local (AV:L, PR:L, UI:N) - there is no remote or network path - so the attacker must first obtain local code execution, for example through a downloaded or sideloaded application, making this a post-compromise data-access primitive rather than an initial-access vector, with the confidentiality impact rated High while integrity and availability are unaffected. Apple has released fixes (patch available), and at time of analysis there is no public exploit identified and no confirmed active exploitation (CISA KEV not listed); EPSS is only 0.17% (6th percentile), so this is a low-to-moderate priority issue despite its 5.5 (Medium) CVSS score.
Locally installed applications on Apple iOS/iPadOS, macOS Golden Gate, tvOS, and watchOS releases prior to version 27 can bypass intended permission restrictions and read sensitive user data they should be denied. Exploitation requires a malicious or compromised app already running on the device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5 MEDIUM) - there is no network-reachable path, so an attacker must first deliver an app through the App Store, sideloading, or enterprise/MDM distribution, after which no further user interaction is needed. There is no public exploit identified at time of analysis and the EPSS score is 0.16% (6th percentile); Apple has shipped fixes in the version 27 releases across all four affected platforms, so exposure is limited to unpatched devices below version 27.
Insufficient permission restrictions in Apple's iOS/iPadOS, visionOS, and watchOS allow an app already installed and running locally on the device to reach sensitive user data it should not be able to read. Exploitation requires local code execution with the privileges of a normal installed app (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and yields confidentiality impact only - no integrity or availability effect, and no remote or unauthenticated path. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.16% (6th percentile), so this is a low-priority, patch-and-move-on issue that is fully resolved by updating to iOS 27/iPadOS 27, visionOS 27, or watchOS 27; macOS and tvOS are not listed as affected.
Processing maliciously crafted web content in Apple's WebKit-based browser stack can disclose sensitive user information across Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 and earlier. Apple classifies the root cause as an improper privilege management (permissions) issue and fixed it by removing the vulnerable code rather than adding a check, per the vendor advisories referenced for CVE-2026-64753. Real-world urgency is currently low: EPSS is 0.14% (4th percentile), there is no CISA KEV listing or public exploit identified at time of analysis, and CISA's SSVC assessment is exploitation:none / automatable:no / technical impact:partial, while a vendor patch is already available.
Privilege escalation in October CMS 3.x and 4.x lets an authenticated backend user who holds CMS markup editing rights break out of the Twig Safe Mode sandbox and impersonate an existing superuser. The bypass chains two weaknesses: the Laravel session store is handed to Twig templates with unrestricted method access, and raw SQL methods (selectRaw, whereRaw, orderByRaw, joinSub) leak through Eloquent's __call forwarding so a template can run arbitrary queries and then overwrite the admin_auth session key. Publicly available exploit code exists, but exploitation requires cms.safe_mode to be explicitly enabled, a deliberately untrusted markup editor account, and a pre-existing superuser whose session can be forged — a combination that October CMS states does not occur in standard production deployments.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Privilege escalation in Soarkey StudentManagement allows unauthenticated remote attackers to self-assign arbitrary privilege levels during account registration by manipulating the `level` POST parameter in the Registration Workflow handled by `RegisterServlet.doPost`. An attacker can register a standard user account but set their privilege level to administrator, gaining unauthorized access to elevated functionality such as student record management. A publicly available proof-of-concept exists via GitHub issue #35, and SSVC classifies this as automatable with partial technical impact.
Out-of-bounds write in the Samsung Exynos Display Processing Unit (DPU) kernel driver enables a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges on devices running Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 mobile processors. The flaw stems from missing input length validation in the color mode LUT (Look-Up Table) parsing path of the DPU driver, allowing attacker-controlled data to overflow a kernel buffer. No public exploit code has been identified at time of analysis, though the Samsung semiconductor advisory page confirms the issue and implies a patch is available.
Unauthenticated remote attackers can register accounts with elevated (administrator) privileges in jaychouchannel Tourism-Management-System by manipulating the UsersEntity parameter during registration, bypassing role assignment controls. The commit diff reveals a broader scope than the description implies: at least 12 controller classes (ChatmessageController, multiple Discuss* controllers, ForumController, FriendController, FriendlinkController, NewsController, NewstypeController, StoreupController) had security() endpoints decorated with @IgnoreAuth, making those endpoints callable without any authentication. Publicly available exploit code exists; no active exploitation confirmed in CISA KEV.
Privilege escalation via mass assignment in lenve vhr 1.0-SNAPSHOT allows an authenticated remote user to manipulate restricted fields - including role or privilege-level attributes - through the HrInfoController.updateHr endpoint by injecting unexpected parameters alongside the Password argument in HrMapper.xml. The vulnerability stems from improper privilege management (CWE-266), enabling a low-privilege HR system user to elevate their own account permissions without authorization. A public proof-of-concept has been disclosed; no vendor patch is available and the vendor has not responded to the disclosure.
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain higher-tier memberships without paying the correct price. The plugin's PayPal IPN (Instant Payment Notification) handler accepts the membership level asserted in the payment notification without verifying it matches the level configured for the specific payment button that was purchased, enabling a low-cost membership purchase to be fraudulently upgraded to any higher tier. A publicly available exploit exists, and vendor patch 4.7.8 resolves the issue.
Improper privilege management in xxl-job admin up to version 3.4.2 exposes the `loadById` endpoint of `JobGroupController.java` to unauthorized access by low-privileged authenticated users, leaking executor group configuration data. The vulnerability resides in the admin web interface's job group management controller and allows users who should lack access to read job group details via direct endpoint calls. A public proof-of-concept exploit exists; no vendor patch has been released following disclosure, as the vendor did not respond.
Privilege escalation to root on Palo Alto Networks Cortex XDR Broker VM is achievable by an authenticated low-privileged user who simultaneously holds a man-in-the-middle position on the adjacent network segment. The underlying flaw is argument injection (CWE-88), allowing the attacker to manipulate command-line arguments processed by the Broker VM to gain root-level code execution on the appliance. No public exploit has been identified (CVSS 4.0 E:U, Urgency: Amber), and Palo Alto Networks has published an advisory at security.paloaltonetworks.com.
Multiple local privilege escalation flaws in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow any authenticated local user to elevate privileges to NT AUTHORITY\SYSTEM or root. The root cause is CWE-426 (Untrusted Search Path), a class of vulnerability commonly manifesting as DLL search-order hijacking or PATH manipulation that the privileged VPN client process follows. No public exploit is known at time of analysis, and Palo Alto has released fixed versions; iOS, Android, and ChromeOS deployments are explicitly not affected.
Privilege escalation in the HPE Aruba ClearPass OnGuard agent enables an authenticated network-accessible attacker with low privileges to elevate to root on the affected deployment. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation requiring no user interaction, making it straightforward to weaponize for any attacker who holds even a basic account on the system. No public exploit code or CISA KEV listing has been identified at time of analysis; HPE has published advisory hpesbnw05130en_us, which presumably details affected versions and remediation.
Dell Secure Connect Gateway 5.0 Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) contain a CWE-250 Execution with Unnecessary Privileges flaw in which internal components operate with OS-level permissions exceeding what their function requires, allowing a locally authenticated high-privileged attacker to perform unauthorized modifications to system integrity and availability. The affected products are Dell's enterprise remote support gateway platform used to facilitate secure ProSupport connectivity in production environments. No public exploit code has been identified and the CVSS 3.4 Low rating reflects the substantial access prerequisites - local access and a pre-existing high-privilege account - sharply limiting opportunistic exploitation potential.
Permission control bypass in HarmonyOS 6.1.0's app lock module allows a local low-privileged user to circumvent locking protections and read content belonging to locked applications. The flaw is rooted in CWE-264, indicating improper enforcement of permission restrictions within the module. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the C:H CVSS impact signal indicates full confidentiality exposure to locked app data once exploited locally.
Permission control bypass in the Huawei HarmonyOS and EMUI Settings module allows an attacker with physical access to a device to read confidential data from a protected scope beyond the Settings component. The vulnerability affects HarmonyOS versions 4.0.0 through 4.3.3 and EMUI versions 14.0.0 through 16.0.0, as confirmed by Huawei PSIRT via the September 2026 security bulletin. The CVSS scope-change indicator (S:C) signals that successfully exploiting the flaw grants access to confidential resources outside the Settings module itself, though integrity and availability are unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Permission control weakness in the HarmonyOS window module allows a local attacker to bypass access restrictions and read protected service data on HarmonyOS 6.1.0 devices. The CVSS vector (AV:L/AC:H/PR:N) confirms local-only exploitation with high attack complexity, substantially limiting reach. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; the primary concern is confidentiality exposure on unpatched consumer and laptop devices.
Untrusted Search Path exploitation in Adobe Acrobat and Acrobat Reader allows a local attacker who already holds high privileges to gain unauthorized read access to sensitive confidential data under specific, attacker-uncontrollable environmental conditions. Affected products include Acrobat 2024 (≤24.001.30383), Acrobat Reader, and Adobe Acrobat (both ≤26.002.21900), per EUVD-2026-74105 and Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis; exploitation mandates a victim open a malicious file and requires conditions beyond the attacker's direct control.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Improper access control (CWE-284) in Fortinet FortiSOAR allows an authenticated low-privilege user to escalate their privileges within the platform via an undisclosed attack vector. Both PaaS and on-premise deployments across FortiSOAR versions 7.3 through 7.6.6 are affected. No public exploit or CISA KEV listing is present at time of analysis; the Fortinet PSIRT advisory FG-IR-26-164 is the sole authoritative source.