Privilege Escalation

Privilege escalation in Inductive Automation Ignition 8.1.53 and earlier allows any authenticated user who can execute gateway scripts to create SCADA/HMI projects without restriction, because the Gateway 'Create Project Role(s)' setting shipped with a blank default - effectively disabling the access control gate entirely. In industrial control system (ICS) environments, unauthorized project creation is operationally significant: projects define the logic, tags, and screens that interact with physical process equipment. Ignition 8.1.54 closes the gap by restricting project creation to Designer sessions, removing reliance on the misconfigured role setting. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Privilege escalation through the DirectIo64.sys kernel driver affects three PassMark products - PerformanceTest before build 1012, BurnInTest before build 1000, and OSForensics before build 1016 - allowing any local Windows user with low privileges to issue arbitrary x86 IN/OUT instructions to hardware I/O ports via exposed IOCTLs that lack allowlist or port-range validation. From a standard user account an attacker can write to PS/2 controller, CPU reset, CMOS configuration, and interrupt controller ports, triggering an immediate forced system reset or persistent hardware-level manipulation. A public technical disclosure repository (github.com/floppywiggler/directio64-disclosure) and accompanying blog post exist; no CISA KEV listing is present and no EPSS score was provided.

Privilege escalation in PassMark's shared DirectIo64.sys kernel driver, bundled with PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allows any low-privileged local user to gain complete hardware-level control over the host. The driver exposes IOCTLs without validating the target device, register offset, or value, enabling arbitrary PCI configuration space reads and writes. An attacker can leverage this to enable Bus Master DMA on any PCI device, remap Base Address Registers to attacker-controlled physical memory addresses, or halt storage controller I/O - all without kernel exploits. A public proof-of-concept is available; no active exploitation (CISA KEV) confirmed at time of analysis.

Privilege escalation and kernel DoS in PassMark's shared DirectIo64.sys kernel driver affect PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allowing a local low-privileged attacker to read arbitrary Model-Specific Registers or write zero to any MSR via IOCTLs with an insufficient blocklist. Writing zero to the system call handler MSR (e.g., IA32_LSTAR) causes an immediate unrecoverable kernel panic on the next system call, while reading security-sensitive MSRs (such as those storing kernel base addresses) enables KASLR bypass to support privilege escalation chains. A public proof-of-concept is available via GitHub, and vendor patches have been released; no KEV listing at time of analysis.

Local privilege escalation to kernel in PassMark PerformanceTest, BurnInTest, and OSForensics allows a low-privileged local user to achieve arbitrary physical memory bit-clearing via an exposed, unvalidated IOCTL in the shared DirectIo64.sys kernel driver. By supplying a crafted 64-bit physical address and bit index to the driver, an attacker can invoke MmMapIoSpace to map and modify kernel code pages or page table entries, yielding full system compromise. A public proof-of-concept is available and patches have been released by PassMark across all three affected product lines.

Unprivileged local users can issue privileged hardware IOCTLs through PassMark's DirectIo64.sys kernel driver across three PassMark products - PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) - because the driver's device object is created without a security descriptor, allowing Windows to apply a permissive default ACL. Any standard Windows user account can open a handle to the device and invoke kernel-level hardware operations regardless of their privilege or integrity level, effectively bypassing Windows privilege boundaries. A public proof-of-concept is available on GitHub, and vendor patches have been released for all three affected products.

Local privilege escalation in Acunetix 25.11.251107123 for Windows enables low-privileged local users to execute arbitrary code as SYSTEM by exploiting CWE-427 (Uncontrolled Search Path Element) in the wvsc.exe Web Vulnerability Scanning Engine. The SYSTEM-level wvsc.exe process searches for OpenSSL-related files at a hardcoded directory path that does not exist by default; an attacker creates the missing directory and plants a malicious file, which the service subsequently loads and executes, yielding full SYSTEM-level control. A public proof-of-concept is available via the Full Disclosure mailing list and corroborated by a VulnCheck advisory, making this trivially reproducible by any local user on affected Windows installations.

Improper privilege management in StackStorm st2's API Key Handler allows authenticated remote attackers to manipulate the `api_key_api.user` argument in `st2api/st2api/controllers/v1/auth.py`, enabling unauthorized privilege escalation within the automation platform. All versions through 3.9.0 are affected per the CPE data, and a publicly available proof-of-concept exploit exists (GitHub issue #6380). No vendor patch has been released; the StackStorm project has not responded to the responsible disclosure report.

Improper privilege management in StackStorm st2 up to 3.9.0 allows authenticated low-privilege users to bypass user-scoping restrictions on the action executions API by manipulating the `user` query parameter. The root cause is that `assert_user_is_admin_if_user_query_param_is_provided` in `st2api/st2api/controllers/v1/actionexecutions.py` performs no enforcement when the default NoOp RBAC backend is active - meaning every default StackStorm installation without explicit RBAC configuration is vulnerable. A public proof-of-concept exists via GitHub issue #6379, and the vendor has not yet responded to the disclosure; no patch is available at time of analysis.

Local privilege escalation in JAL Information Technology's Pallet Control suite (including PalletControl and PalletControl Cloud) enables a low-privileged local attacker to execute arbitrary code with SYSTEM-level privileges due to incorrect default installation permissions (CWE-276). All tracked versions across three CPE entries are listed as affected per JPCERT/CC coordination notice JVN#84094853. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.

Unauthenticated account takeover in the ACPT (Premium) WordPress plugin (versions up to and including 2.0.66) lets remote attackers hijack any account, including administrators. The plugin's submit() handler processes anonymous form submissions without verifying that the submitter is authorized to modify the targeted user, then passes an attacker-controlled user ID to wp_update_user(), allowing the attacker to overwrite that user's email address and password. Reported by Wordfence; no public exploit and no CISA KEV listing at time of analysis, but the CVSS 9.8 rating reflects a trivially weaponizable full-compromise path where a vulnerable form is exposed.

Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a specific combination of flags on the allocation interface that would cause an incorrect double free event when freed.

An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component

An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component.

Privilege escalation in MBS-solutions X-Serie Gateway firmware V6_00_05 allows a remote attacker to gain elevated privileges by abusing two CGI endpoints, /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi. Per the CVSS vector the attack requires no authentication (PR:N) and yields high confidentiality and integrity impact, effectively granting an attacker administrative control over the gateway's configuration and data. A public write-up and proof-of-concept exist in a GitHub research repository, though there is no evidence of active exploitation.

Privilege abuse in Kibana allows an authenticated user holding Security read-level access in a single Kibana space to trigger Entity Analytics migration operations that perform write actions across all Kibana spaces, violating the platform's space-isolation access control model. The vulnerability stems from CWE-862 (Missing Authorization): the migration API endpoint executes privileged writes without verifying whether the caller's authorization scope covers the target spaces. No public exploit has been identified at time of analysis; a vendor patch is available per ESA-2026-154.

Template injection in Kibana's Cribl integration allows a low-privileged authenticated user holding Fleet management rights to write Elasticsearch ingest pipelines exceeding their authorized Elasticsearch permissions. The flaw stems from insufficient validation of a configuration field that is rendered server-side as a script template, giving the attacker a code injection foothold (CWE-94) into the pipeline generation path. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L/I:L) reflects the constrained privilege requirement and limited integrity impact.

Privilege escalation in Kibana's Fleet management component allows any user holding Fleet management privileges to mint arbitrarily elevated Elasticsearch cluster credentials - up to full cluster administration - for every Elastic Agent enrolled in a targeted policy. Elasticsearch cluster privilege declarations sourced from integration packages were not validated before being used to generate agent credentials (CWE-863: Incorrect Authorization), enabling an attacker to inject overprivileged credentials across an entire agent fleet. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed, but the impact is laterally broad: a single privileged user can compromise all agents and the Elasticsearch cluster they authenticate to.

Local privilege escalation in HP Support Assistant (versions prior to 9.53.2.0) allows a low-privileged local user to gain elevated system privileges by exploiting insufficient granularity in access controls (CWE-1220). The vulnerability requires local authenticated access but no user interaction, and the CVSS 4.0 AT:P metric indicates specific attack conditions must be present. No public exploit code or active exploitation has been identified at time of analysis; HP has released a patched version addressing the issue.

Privilege escalation in the Bricksforge WordPress plugin (versions <= 3.1.8.8) lets a low-privileged user elevate their account to higher-privileged roles, per a Patchstack advisory. The flaw (CWE-266, Incorrect Privilege Assignment) carries a CVSS of 9.8 with a network/no-auth vector, though the 'Subscriber Privilege Escalation' label implies a logged-in subscriber account is the realistic starting point. No public exploit code, KEV listing, or EPSS score was provided at time of analysis.

Subscriber-level privilege escalation in WCFM Membership WordPress plugin (versions ≤ 2.11.11) enables any authenticated user holding a basic subscriber account to elevate their role to a higher-privileged level, producing high-integrity impact on the affected WordPress/WooCommerce installation. The flaw falls under CWE-266 (Incorrect Privilege Assignment) and was responsibly disclosed by Patchstack. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and broad attacker pool (any registered subscriber) make this a realistic threat for multivendor marketplace deployments.

Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate privileges and gain limited read and write access to affected systems. The vulnerable administrative component is network-restricted by default, which partially contains exposure, but the scope change indicator in the CVSS vector signals that successful exploitation can affect components beyond the directly targeted service. No public exploit code or CISA KEV listing has been identified at time of analysis.

Full account takeover in WWBN AVideo arises because the video_id_hash acts as a non-expiring, non-revocable bearer token that authenticates the holder as the video owner with complete administrator privileges. Any attacker who obtains a valid video_id_hash can replay it indefinitely to gain full admin session access, and the credential keeps working even after the victim rotates their password - eliminating the primary recovery mechanism. Reported by VulnCheck with a fix in the vendor GitHub Security Advisory; no public exploit identified at time of analysis, and no EPSS or KEV data was provided.

Privilege escalation in util-linux through versions 2.41.5 and 2.42.2 allows local low-privilege users to execute privileged post-mount hook operations on pre-existing filesystems by exploiting libmount's failure to validate mount helper exit status before dispatching the MOUNT_POST stage. The root cause - captured by CWE-390 - lies in context_mount.c functions mnt_context_do_mount() and mnt_context_mount(), which gate post-mount hook execution solely on a zero result code without verifying whether the underlying mount helper or kernel syscall actually succeeded. No public exploit code has been identified at time of analysis, but the public GHSA advisory and three upstream patch commits provide sufficient technical detail to support independent exploit development.

Privilege escalation in an Ubuntu-packaged application allows an operator-level authenticated user to modify Administrator accounts by exploiting insufficient authorization controls in the accounting database layer. The exact affected product is not determinable from available data - the description appears to be a commit-message-style changelog entry rather than a formal CVE description. No patch version, CPE string, CVSS score, or CWE identifier has been assigned, severely limiting independent verification. No public exploit has been identified at time of analysis.

Stored cross-site scripting in the SEOWriting WordPress plugin (through version 1.12.5) allows authenticated Contributor-level users to inject arbitrary JavaScript that executes in the browser session of higher-privileged users - Editors or Administrators - who view or preview the affected post. The root cause is a misconfigured KSES allowlist that explicitly whitelists the `onload` event attribute on `iframe` elements, bypassing WordPress's built-in content sanitization. A publicly available proof-of-concept confirms the attack path is reproducible; the vulnerability is not currently listed in the CISA KEV catalog, suggesting active exploitation has not been widely observed at time of analysis.

Local privilege escalation in Elastic Agent on Windows enables a low-privileged local user to achieve SYSTEM-level code execution by exploiting overly permissive access controls (CWE-732) on resources created during unprivileged-mode installation. The agent service, running as SYSTEM, will execute attacker-controlled binaries placed via the CAPEC-642 binary replacement technique. Vendor-released patches 8.19.21, 9.4.6, and 9.5.2 are available per advisory ESA-2026-150; no public exploit identified at time of analysis.

Privilege escalation in Drupal's External Authentication contributed module (versions 0.0.0 through <2.0.13) allows low-privileged network users to gain elevated Drupal permissions by exploiting improper case-sensitivity handling during identity resolution. The module fails to normalize case in username or identity attribute comparisons against existing Drupal accounts, meaning an attacker can present a case-variant identity (e.g., 'Admin' for a privileged 'admin' account) and be mapped to a higher-privileged user. A vendor-released patch is available at version 2.0.13 per Drupal security advisory SA-CONTRIB-2026-098, and no public exploit code has been identified at time of analysis.

Privilege escalation in Drupal's Content Moderation Notifications module (all versions before 3.9.0) stems from unsafe privilege definitions (CWE-267) embedded in the module's moderation workflow handling. An already-highly-privileged Drupal user can exploit improperly scoped permissions granted by the module to perform actions or access content beyond their intended role boundary within Drupal's RBAC model. No active exploitation (CISA KEV) or public proof-of-concept has been identified; a vendor patch at version 3.9.0 is available per Drupal security advisory SA-CONTRIB-2026-107.

Privilege escalation in the LiquidThemes Booking Hub WordPress plugin (≤1.3.1) allows authenticated low-privileged users to incorrectly assign themselves or others elevated WordPress roles, up to and including administrator. The flaw stems from CWE-266 (Incorrect Privilege Assignment) - the plugin fails to enforce proper capability checks before processing role or privilege assignment operations. CVSS 8.8 (PR:L) confirms exploitation requires an existing low-privilege account; no public exploit code or CISA KEV listing identified at time of analysis.

Unauthenticated privilege escalation in the WordPress Authorizer plugin (versions 3.15.1 and earlier) lets remote attackers with no credentials elevate themselves to elevated/administrative roles, according to a CVSS 9.8 rating and CWE-266 (incorrect privilege assignment). Authorizer is an authentication/SSO plugin, so a flaw in its role-assignment logic effectively hands attackers control of the authentication gate itself. No public exploit identified at time of analysis, and the issue is reported by Patchstack rather than listed in CISA KEV.

Privilege escalation in Craft CMS before 5.10.11 lets remote attackers gain administrator rights by registering a new account using the email address of a previously deactivated admin, because the admin flag is not validated and persists across registration. Exploitation requires public user registration to be enabled and email verification to be disabled. Reported by VulnCheck with a vendor security advisory (GHSA-242m-9wq7-vhwq); no public exploit identified at time of analysis.

Privilege escalation in the Theme My Login WordPress plugin (versions before 7.2.0) allows low-privileged users to silently bypass the network's site-creation restrictions on multisite WordPress installations, gaining administrator-level control over a newly created site. Subscriber-level authenticated users - and on some networks, unauthenticated users - can invoke the site-signup flow to create sites even when the network's registration setting prohibits it. A publicly available proof-of-concept exploit exists, raising the urgency for patching. The vendor has released a fix in version 7.2.0.

Privilege escalation to administrator in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 allows unauthenticated visitors to bypass role restrictions enforced on front-end user registration forms. The plugin fails to validate that a submitted role value matches those actually offered by the configured form, and its blocklist against privileged roles is incomplete, enabling a two-stage attack: register with an elevated role, then escalate that account to full site administrator. A publicly available exploit exists per WPScan disclosure, raising the urgency of patching; no public KEV listing has been identified at time of analysis.

Privilege escalation in the JetBackup WordPress plugin before 3.1.23.5 allows a subscriber-level user to gain full administrator access by exploiting the plugin's failure to validate account roles during a site restore or migration. When the site owner performs a legitimate backup restore or migration, JetBackup blindly preserves and promotes accounts in the backup set without re-verifying their roles or capabilities, silently elevating an attacker's low-privilege account to administrator. A publicly available proof-of-concept exists per WPScan, though no confirmed mass exploitation (CISA KEV) is on record; the CVSS 7.1 score (AC:H/UI:R) reflects real-world complexity imposed by the site-owner trigger.

Unauthenticated privilege escalation in the WordPress plugin Booking for Appointments and Events Calendar - Amelia (Premium) versions 8.0 through 9.6.2 lets remote attackers gain full administrator control of a site. By abusing insufficient validation of the 'type' parameter in the customer update endpoint (with 'externalId' set to 0), an attacker elevates a customer to the manager role, then creates a provider entity linked to an existing administrator and overwrites that administrator's password. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network reachability make this a high-priority patch for affected sites.

Address bar spoofing in Google Chrome's Downloads component (versions prior to 152.0.7977.75) is reachable only after an attacker has already achieved code execution within the renderer process, enabling display of a falsified URL via a crafted HTML page. The flaw stems from improper privilege management (CWE-269) in the Downloads subsystem, which fails to enforce the privilege boundary between the sandboxed renderer and the trusted browser UI. No public exploit identified at time of analysis; a vendor-released patch is available in Chrome 152.0.7977.75.

Stored XSS in the Apache Spark History Server (versions 3.0.0 through 3.5.7) allows a user with Spark job submission rights to inject unsanitized HTML/JavaScript into the History Server web UI via the application name field (spark.app.name), which executes in the browser of any higher-privileged user who subsequently views that job's history page. Apache rates this low severity due to layered prerequisites - the attacker must hold job submission rights and socially engineer an administrator into visiting the History Server. No public exploit has been identified at time of analysis; the vendor-released fix is Spark 3.5.8.

Authentication bypass in HPE AOS-CX switch operating system allows an adjacent unauthenticated attacker, under high-complexity conditions, to circumvent authentication controls and achieve both integrity compromise and sensitive information exposure. The scope change in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond the directly targeted switch - relevant in networked environments where a compromised switch becomes a pivot point. No public exploit code or CISA KEV listing is present at time of analysis.

Privilege escalation in the HPE AOS-CX management API allows authenticated low-privilege operator-level users to modify system settings that should require higher authorization. Reported by HPE under advisory hpesbnw05134en_us - the same bulletin covering CVE-2026-73749, 73766, 73778, and 73782 - the flaw carries a CVSS 3.1 score of 6.5 with network attack vector, low complexity, and high integrity impact. No public exploit code or active exploitation has been identified at time of analysis.

Privilege escalation in HPE AOS-CX's API endpoint allows an authenticated low-privilege operator to access sensitive system information that should be restricted to higher-privilege roles, provided a required user action is completed. The CVSS vector (PR:L/UI:R/C:H/I:N/A:N) confirms this manifests as an information disclosure escalation rather than full privilege takeover - a low-privilege operator reads confidential data normally gated behind elevated roles. This CVE is part of the same HPE advisory (hpesbnw05134) as CVE-2026-73749 (unauthenticated RCE, CVSS 9.8), CVE-2026-73766 (admin command injection, CVSS 7.2), CVE-2026-73778 (default-credential auth bypass, CVSS 8.1), and CVE-2026-73782 (adjacent format-string RCE, CVSS 8.8); no public exploit has been identified at time of analysis.

Local privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator with physical or shell access to elevate user privileges and make limited modifications to the affected system. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires both local system access and a low-privilege operator account, and the high attack complexity suggests non-trivial preconditions must be met. Impact is strictly bounded: the CVSS registers no confidentiality or availability impact, only limited integrity modification (I:L), meaning full administrative compromise is not achieved. No public exploit code or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in HPE Networking Fabric Composer enables an authenticated, highly privileged operator on the underlying host to elevate their role within the Fabric Composer management hierarchy, gaining access to higher-privileged administrative functions. The impact is bounded to integrity - specifically the ability to alter certain system configuration settings - with no confidentiality or availability consequence reported. No public exploit code and no CISA KEV listing exist at time of analysis, consistent with the low CVSS score of 4.4 and the stringent local, high-privilege prerequisite.

Privilege escalation in HPE Networking Fabric Composer allows an authenticated operator-level user to modify system settings that the API is intended to restrict to higher-privilege roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms network-exploitable with low attack complexity, requiring only a valid operator credential and no user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Sensitive information exposure in HPE Networking Fabric Composer allows an authenticated low-privilege operator user with local access to upstream AFC dependencies to read data outside their authorized scope. The CVSS vector (S:C/C:H) reflects that the confidentiality breach crosses authorization boundaries within the underlying OS layer, not merely within the user's own privilege tier. No public exploit code exists and the vulnerability has not been added to CISA KEV at time of analysis, but the high confidentiality impact and scope change elevate real-world concern for multi-tenant or shared-operator deployments.

Local privilege escalation in HPE Networking Fabric Composer allows an attacker holding a low-privileged local account to execute arbitrary code with root privileges, achieving complete host compromise. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation is confined to the local system and requires high attack complexity - consistent with a race condition or SUID-binary class of flaw. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.

Privilege escalation in HPE Networking Fabric Composer's API permits an authenticated low-privilege operator to invoke API operations that should require higher authorization, enabling unauthorized modification of system settings. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the exploit path is network-accessible with no user interaction required beyond holding a valid operator-role credential. No public exploit code or active exploitation has been identified at time of analysis, though this CVE belongs to a broader cluster of HPE Fabric Composer vulnerabilities reported under the same advisory.

Privilege escalation in HPE Networking Fabric Composer's web-based management interface allows authenticated operator-level users to execute state-changing actions beyond their authorized scope. The CVSS vector (PR:L/I:H) confirms exploitation requires low-privilege credentials but yields high-integrity impact - unauthorized modification of platform state that should be gated to higher-privilege roles. No active exploitation or public exploit code has been identified at time of analysis.

Arbitrary file write via the HPE Networking Fabric Composer API enables an authenticated administrative user to escalate privileges to root on the underlying operating system. The vulnerability allows admin-level API users to write attacker-controlled content to arbitrary filesystem paths, which can then be leveraged to execute arbitrary OS commands as root. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Broken access control in HPE Networking Fabric Composer's API allows authenticated low-privilege operator users to read data beyond their authorized scope, potentially enabling lateral movement or privilege escalation within the management plane. The vulnerability is network-exploitable with low attack complexity once a valid operator credential is obtained, as reflected by the CVSS 7.6 score (AV:N/AC:L/PR:L). No public exploit code or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in HPE Networking Fabric Composer allows an attacker with low-level local access to execute arbitrary code with root privileges on the host operating system. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local foothold with minimal privileges - no user interaction or elevated rights needed beyond initial system access. No public exploit code or CISA KEV listing has been identified at time of analysis; however, HPE has published a security bulletin acknowledging the issue.

Privilege escalation via an unauthenticated API endpoint in HPE Networking Fabric Composer allows a remote attacker to obtain administrative privileges and achieve complete compromise of the Fabric Composer host. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exploitation, though AC:H indicates a non-trivial exploitation condition such as a race, specific request sequence, or transient configuration state. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.

Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invoke state-changing API operations beyond their authorized scope, including modifications to configurations of network systems managed by the platform. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/I:H) confirms the flaw is remotely exploitable with no complexity or interaction requirements, and that the integrity impact extends beyond Fabric Composer itself to the downstream network infrastructure it manages. No public exploit code or CISA KEV listing is present at time of analysis, but the low exploitation barrier - a valid low-privilege credential - makes this a meaningful insider and credential-theft escalation risk.

Privilege escalation in Easybyte Software's Konga before 2.1.0 allows any authenticated local Windows user to execute arbitrary code at the privilege level of the account running Konga by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path that is absent from default installations and resides in a location writable by all authenticated users. The root cause is CWE-427 (Uncontrolled Search Path Element): Konga loads OpenSSL from a fixed, predictable path without verifying the integrity or provenance of files found there, enabling a classic library-planting attack. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available in version 2.1.0.

Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elevate permissions to administrative level, resulting in complete system compromise. The flaw is exploitable over the network without user interaction, making it accessible to any attacker holding a valid operator account. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes this a credible internal-threat vector in any environment where operator credentials are broadly issued or have been exposed.

Privilege abuse in Kibana's machine learning feature allows any user holding read-only ML access to retrieve data from Elasticsearch indices they are not authorized to see. The flaw (CWE-250) occurs because Kibana executes certain ML read operations under an internal service identity rather than forwarding the requesting user's credentials to Elasticsearch, effectively bypassing Elasticsearch's index-level access controls. Elastic self-disclosed the issue in ESA-2026-135 and released fixes across three active release lines; no public exploit code has been identified.

Privilege escalation in Kibana allows an authenticated user holding workflow edit permissions to cause scheduled workflow executions to run under the privileges of a higher-privileged user, granting unauthorized read and write access to data outside their authorization scope. The flaw (CWE-863, Incorrect Authorization) stems from Kibana's workflow scheduling subsystem failing to enforce authorization boundaries when executing scheduled jobs - a pattern classified under CAPEC-180. No public exploit exists at time of analysis, but the CVSS 8.3 (High) score with a network-accessible, low-privilege attack vector reflects genuine impact for any multi-user Kibana deployment. Elastic's advisory ESA-2026-61 references Kibana 9.4.3 as the fix release.

Privilege escalation in Rockwell Automation's Redundancy Module Configuration Tool (RMConfigTool.exe) enables a local standard user to execute arbitrary code with Administrator or SYSTEM privileges via DLL search order hijacking. The tool searches system PATH directories for required DLLs, and one or more of those directories have incorrect default permissions allowing write access by non-privileged accounts; if a malicious DLL is planted there before an administrator runs the tool, it loads into the elevated process. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the underlying technique is well-understood and commonly leveraged in post-exploitation privilege escalation chains.

DLL hijacking in Rockwell Automation's Redundancy Module Configuration Tool (RM3ConfigTool.exe) allows a local low-privileged attacker to escalate to Administrator or SYSTEM privileges by planting a malicious DLL in a writable system PATH directory before an administrator launches the utility. The root cause is CWE-276 (Incorrect Default Permissions): the installer grants standard users write access to one or more directories that RM3ConfigTool.exe searches at runtime for a required DLL, enabling the classic DLL planting technique. No public exploit code has been identified at the time of analysis, and this CVE does not appear in the CISA KEV catalog.

Privilege escalation in Rockwell Automation FactoryTalk® Activation Manager exposes authenticated local Windows users to full SYSTEM-level access by exploiting visible console windows spawned by the installer's custom actions during installation or repair operations. Any low-privileged user present on the machine during an install or repair sequence can interact with these unprotected, SYSTEM-privileged console windows to launch an unrestricted command shell. No public exploit has been identified at time of analysis, but the attack technique - console window hijacking during elevated installer operations - is a well-documented Windows privilege escalation class requiring minimal skill once the precondition is met.

Privilege escalation in Firefox's WebDriver BiDi component allows network-based attackers, with user interaction, to achieve full compromise of the browser process across confidentiality, integrity, and availability dimensions. All Mozilla Firefox versions prior to 155 are affected, as confirmed by vendor advisory mfsa2026-82 and the wildcard CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis, and SSVC confirms no observed exploitation, though CISA rates the technical impact as total.

Use-after-free in Firefox's WebGPU graphics component allows privilege escalation when a victim visits a specially crafted webpage. Affecting all Firefox versions prior to 155 and ESR prior to 153.2, a remote unauthenticated attacker can trigger memory corruption by delivering malicious WebGPU content, achieving full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit or active exploitation has been identified at time of analysis; SSVC confirms exploitation status as none and the attack is not automatable due to required user interaction.

Privilege escalation in Mozilla Firefox for Android (versions prior to 155) allows a remote, unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability by exploiting improper access control (CWE-284) when a user interacts with attacker-controlled content. Mozilla confirmed the fix in Firefox 155, documented under MFSA2026-82. No public exploit code exists and CISA has not added this to KEV, though SSVC rates the technical impact as 'total', underscoring the severity if successfully triggered.

Privilege escalation in Mozilla Firefox's Graphics component via an invalid pointer (CWE-763) exposes users running all Firefox versions prior to 155 and ESR branches prior to 115.40, 140.15, and 153.2 to full compromise of confidentiality, integrity, and availability. The CVSS 8.8 network-vector score with no required privileges but mandatory user interaction (UI:R) places this squarely in the drive-by exploitation category - a victim visiting a crafted webpage is sufficient to trigger the flaw. No active exploitation is confirmed at time of analysis (SSVC exploitation: none, no KEV listing), but the total technical impact rating and the broad Firefox install base make this a high-priority patching target.

Privilege escalation in Dell PowerStore storage appliances allows an authenticated low-privilege user to invoke administrator-only management operations via the network, resulting in full confidentiality, integrity, and availability compromise of the storage system. The flaw stems from incorrect authorization checks (CWE-863), where the system fails to enforce proper privilege boundaries on API or management interface operations. No public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and high-impact CVSS 8.8 rating make this a credible threat in multi-tenant or shared-access storage environments.

Unauthenticated account takeover in the Nokri - Job Board WordPress theme (versions through 1.6.6) lets remote attackers reset any user's password, including administrators. The flaw stems from the nokri_reset_password() function accepting an empty reset token that matches the empty or unset sb_password_forget_token user meta value, so no valid token is ever needed. Reported by Wordfence and rated CVSS 9.8; no public exploit or CISA KEV listing is identified at time of analysis.

Privilege escalation to root in Plesk for Linux (18.0.34 up to 18.0.79.9 / 18.0.80.5) lets a customer- or reseller-level account with shell access run OS command injection (CWE-78) to take over the entire hosting server. Any tenant permitted to use - or to toggle on - their own shell access can break out of their restricted account and reach the root identity, collapsing the isolation between shared-hosting customers and the host. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the vendor rates it critical (CVSS 9.0) and has shipped fixed builds.

Privilege escalation in HP ImageDiags prior to version 5.0.0.36 enables a local low-privileged attacker - contingent on active interaction by a higher-privileged user - to gain elevated system privileges through insufficient access controls on temporary file resources (CWE-379). All versions of HP ImageDiags before 5.0.0.36 are affected per HP security bulletin HPSBGN04143. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.

Subscriber-level privilege escalation in Fluent Forms Pro Add On Pack (versions <= 6.2.12) allows authenticated users with minimal access to gain significantly elevated permissions within a WordPress installation. Reported by Patchstack against the wp_manage_ninja plugin, the flaw stems from incorrect privilege assignment (CWE-266), meaning subscriber-role accounts can trigger functionality reserved for higher-privileged roles such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis, though the network-accessible attack vector and high CVSS impact across confidentiality, integrity, and availability make this a meaningful risk for any WordPress site accepting subscriber registrations.

Privilege escalation in MCPHub prior to version 1.0.29 allows any authenticated low-privilege user to modify system-wide configuration via the PUT /api/system-config endpoint. The handler updateSystemConfig never validates req.user.isAdmin, meaning the app-wide authentication middleware - which only confirms a valid session exists - is the sole barrier, granting any account holder effective administrative control over routing rules and server integrations. No public exploit has been identified at time of analysis, but the attack is trivially reproducible given network access and any valid credential.

Local privilege escalation in ieungSoft Ultra RAMDisk Pro 1.82 allows a low-privileged local user to gain SYSTEM or kernel-level control via improper privilege management in the URDSCSI.sys kernel driver (CWE-266). The vendor did not respond to coordinated disclosure, leaving no official patch; a public proof-of-concept exploit exists, confirmed by the CVSS 4.0 E:P metric and a detailed write-up. No active exploitation has been confirmed in CISA KEV, but the low exploitation barrier (low-privilege local access, no interaction, public PoC) makes this a credible post-compromise escalation tool.

Improper privilege management in IObit Unlocker 1.3.0.12's kernel driver (IObitUnlocker.sys) allows a locally authenticated high-privileged user to invoke ZwTerminateProcess through the IRP_MJ_DEVICE_CONTROL handler without adequate authorization checks, enabling termination of processes outside the caller's normal authority. The vulnerability is limited to systems with IObit Unlocker installed and the driver loaded, and requires existing administrator-level access to exploit. No public exploit has been identified at time of analysis, the vulnerability is not in the CISA KEV catalog, and the vendor did not respond to disclosure.

Privilege management failure in IObit Uninstaller 15.5.0.11's kernel driver IUForceDelete.sys allows a local low-privileged user to send crafted IOCTL requests to the IRP_MJ_DEVICE_CONTROL handler and trigger improper privilege operations, resulting in limited integrity and availability impact on the local Windows system. The vendor did not respond to coordinated disclosure, leaving no vendor-issued patch or official mitigation guidance available. No public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog at time of analysis.

Cross-workspace privilege escalation in ToolJet Database before v3.16.44 enables any authenticated user to read database tables belonging to arbitrary workspaces by supplying victim workspace identifiers in the join_tables endpoint request path. The endpoint grants JOIN_TABLES capability to all authenticated users without validating role membership or workspace affiliation, breaking ToolJet's multi-tenant isolation entirely. No public exploit or CISA KEV listing has been identified, but the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable and subsequent systems in shared deployments.

Privilege escalation in the @hulumi/policies npm package before 1.3.2 lets attackers bypass the administrator-policy guardrail (CIS 1.16) by crafting admin-equivalent inline or attached IAM policy shapes that the validator failed to fully inspect. Any environment relying on this library to detect over-privileged IAM policies could silently pass admin-equivalent access as compliant. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Privilege escalation in hulumi before v1.3.2 lets an actor holding the documented IAM principal abuse the weekly integration IAM policy to perform role lifecycle operations on af-e2e-* roles that lack sufficient permission-boundary restrictions. Because the policy allows role creation without a constraining boundary, the actor can mint persistent, higher-privilege roles inside the sandbox AWS account, converting scoped test access into durable elevated access. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Local privilege escalation in Colorful iGameCenter 2.0.0.81 stems from its bundled WinRing0x64.sys driver, whose sub_11504 IOCTL handler exposes arbitrary physical-memory access via attacker-controlled PhysicalAddress/AlignNumer/AlignSize arguments. A low-privileged local user can abuse this IOCTL Dispatch path to read and write kernel-visible physical memory and escalate to SYSTEM. Publicly available exploit code exists for the underlying WinRing0 driver class, but this specific CVE is not listed in CISA KEV and EPSS is unavailable; no active exploitation is confirmed.

Vertical privilege escalation in XueZhiSi XZS Open Source Exam System (versions <= 3.9.0) allows an authenticated teacher account (role=2) to permanently delete administrator accounts (role=3) via the POST /api/teacher/user/delete/{id} REST endpoint. The three-step delete sequence - getUserById(id), setDeleted(true), updateByIdFilter() - executes without any role-based authorization check on the target resource, enabling a lower-privileged user to destroy privileged accounts irreversibly. No public exploit code or CISA KEV listing exists; EPSS sits at 0.15%, reflecting minimal observed activity at time of analysis.

Privilege escalation in XueZhiSi Open Source Exam System (xzs) 3.9.0 and earlier allows authenticated teacher-level users to retrieve user listings across roles they are not authorized to view by freely controlling the role parameter in POST /api/teacher/user/page/list requests. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the server trusts the client-supplied role field in UserPageRequestVM without enforcing server-side role binding, exposing potentially sensitive user data. No public exploit code or active exploitation has been identified, and EPSS places this at the 4th percentile.

Local privilege escalation in SiYuan's Windows NSIS installer affects versions 2.0.14 through 3.8.0, allowing a local attacker with write access to a directory to execute arbitrary code with elevated privileges by planting a malicious binary that the NSIS installer resolves ahead of System32 during an all-users installation. The root cause is electron-builder's preInit hook invoking system utilities such as TASKKILL by short name via nsExec::Exec, causing the installer's launch directory to take search-path precedence over System32 before the license page is even displayed. No public exploit code has been identified at time of analysis, though the binary-planting technique is well-documented in Windows installer security research.

Improper privilege management in the Really Simple Security WordPress plugin before 9.8.0 permits a subsite administrator on a WordPress multisite network to install an arbitrary plugin from a user-supplied URL, placing attacker-controlled PHP code into the network-shared plugin directory normally reserved for network (super) administrators. Successful exploitation achieves remote code execution with full confidentiality, integrity, and availability impact across the entire multisite network. A public proof-of-concept is available via WPScan, though EPSS remains low (0.15%) consistent with the high-privilege, non-default-configuration prerequisites; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.

Privilege escalation to Administrator in the Addify Custom User Registration Fields for WooCommerce plugin (versions ≤ 2.2.3) lets unauthenticated attackers gain admin rights by supplying an arbitrary role slug during WooCommerce checkout. The plugin trusts an attacker-controlled afreg_select_user_role value from the unauthenticated Store API /wc/store/v1/checkout request and passes it straight to WP_User::add_role() without validating it against the admin-configured allowed role list. No public exploit identified at time of analysis, and exploitation requires the plugin's 'User Role Selection' feature to be enabled.

Account takeover in the Uix UserCenter WordPress plugin (all versions through 1.0.3) lets unauthenticated attackers seize any account, including administrators. The plugin's profile-update action never checks that the targeted account belongs to the requester and authorizes the action with a token signed by a hardcoded key that is identical on every installation, so an attacker can forge a valid token for any user and overwrite that user's email and password. Rated CVSS 9.8 with publicly available exploit code (WPScan), though EPSS is low at 0.14%.

Privilege escalation to full site takeover affects the MemberHero WordPress plugin through version 6.9, where the frontend registration flow fails to restrict which account fields a visitor may set, letting unauthenticated attackers self-register with an arbitrary role - including Administrator. Version 6.9 was advertised as the fix but the patch is incomplete, so current installs remain exploitable to gain admin access and hijack existing accounts, and no fully-fixed release exists at time of analysis. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.15% (4th percentile).

Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitrary OS command execution under the server process identity. By saving a flow containing a crafted 'type' field and triggering a build of a wrapper flow that references it, the attacker coerces the backend into evaluating attacker-controlled code, defeating the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false guardrail intended to block custom code execution. The vendor (IBM) reported it and has released a fix; there is no public exploit identified at time of analysis and it is not in CISA KEV.

Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exploits a format string vulnerability (CWE-134) to allow a low-privileged local attacker to gain elevated - potentially root-level - privileges with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.10% (1st percentile), consistent with an SSVC exploitation status of 'none'. IBM has released a patch at the advisory linked below.

Privilege escalation in SpringBlade 2.7.3 through 3.5.0 lets authenticated low-privilege users forge admin JWT tokens using a hardcoded signing key embedded in publicly distributed JARs, then POST to an unprotected internal Feign user-creation endpoint to register new system administrator accounts. The Spring Cloud Gateway authentication filter validates JWT structure but performs no role or caller-identity checks, making bypass trivial for anyone with initial account access. A public POC is available; vendor-released patch exists in v5.0.0; no CISA KEV listing confirmed at time of analysis.

Missing authorization checks on three IAM REST API endpoints in Yamcs allow any authenticated low-privilege user to enumerate the server's complete privilege taxonomy and role-to-privilege mappings, directly enabling targeted privilege escalation reconnaissance. Affected are yamcs-core versions up to 5.12.7 and 5.13.0 through 5.13.1, used in production spacecraft operations and ground station environments. A proof-of-concept is confirmed in the GHSA advisory; no active exploitation (CISA KEV) has been identified, but the leaked data (including the ControlAccess and ChangeMissionDatabase privilege names) provides a precise roadmap for chained attacks including, per the advisory, algorithm-level remote code execution.

Incomplete authorization fix in Vikunja v2.3.0 allows Write-level collaborators to detach a shared child project from its parent hierarchy by supplying parent_project_id: 0, bypassing the Admin permission gate introduced by the CVE-2026-35595 fix. The flaw exists in versions v2.3.0 through the latest unstable builds and is fixed in v2.4.0. A detailed, independently reproducible proof-of-concept with curl commands is publicly documented in the GHSA advisory, though no CISA KEV listing has been identified at time of analysis.

Archive symlink traversal in aquaproj/aqua prior to v2.60.1 enables an attacker who controls a tool archive to write arbitrary files outside the extraction directory with the privileges of the user running aqua. The vulnerable combination in `pkg/unarchive/archives.go` - creating a symlink without destination validation, then following it with a regular file write - allows a malicious tar.gz to overwrite files such as shell startup scripts or PATH entries, resulting in user-level code execution. A working PoC is confirmed in GHSA-mf5c-hw34-4hpp; no CISA KEV listing is present and EPSS data is unavailable for this CVE.