Privilege Escalation

Local privilege escalation to full system takeover in Oracle Solaris 11.4 lets a low-privileged local user compromise the Filesystems component and, due to a scope change, significantly impact additional products beyond Solaris itself. Exploitation is rated difficult (high attack complexity) and requires an existing local logon, but a successful attack yields complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis; this was disclosed in the Oracle Critical Patch Update of July 2026 and is not listed in CISA KEV.

Account takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the server. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local privilege escalation to full product takeover in Oracle Data Integrator (Studio component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a low-privileged attacker who can log on to the host where ODI runs fully compromise the product with high confidentiality, integrity, and availability impact. Oracle rates it CVSS 3.1 7.8; there is no public exploit identified at time of analysis and it is not on the CISA KEV list. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update.

Full application takeover in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (Time Accounting and HRM Base component) allows an authenticated, low-privileged attacker to compromise the product over HTTP. Per the CVSS vector (PR:L), a valid low-privilege account is required and exploitation is difficult (AC:H), but success yields high confidentiality, integrity, and availability impact — effectively total compromise of the HCM Foundation instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.

Full compromise of Oracle Transportation Management 6.5.3 (Supply Chain suite, Install component) is possible for a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability loss - Oracle describes the outcome as a 'takeover' of the product. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.

Unauthenticated data compromise in Oracle Identity Manager (Fusion Middleware, OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0 lets remote attackers read and modify all OIM-accessible data over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 9.1 and was addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis.

Full product takeover of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a remote, unauthenticated attacker over HTTP against the Runtime Tools component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8) reflects that no credentials, user interaction, or special conditions are needed, and a successful attack fully compromises confidentiality, integrity, and availability. This is a July 2026 Oracle Critical Patch Update item with no public exploit identified at time of analysis and no CISA KEV listing.

Full compromise of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Integration Business Insight component in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the product with high confidentiality, integrity, and availability impact. Addressed in the Oracle Critical Patch Update of July 2026, this issue carries a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 'easily exploitable' language from Oracle (reflected as AC:L) makes prompt patching prudent for exposed instances.

Complete takeover of the Oracle Identity Manager Connector (PeopleSoft Applications component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, with CVSS 9.8 reflecting full confidentiality, integrity, and availability loss. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, and the fix ships in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and 'takeover' outcome make it a top-tier patch priority for any environment running this connector.

Local privilege-driven takeover in Oracle HTTP Server 14.1.2.0.0 (Oracle Fusion Middleware) lets a low-privileged attacker with logon access to the host running OHS fully compromise the server via the bundled HTTP/2 module (mod_http2.so). With a CVSS 3.1 base score of 7.8 and full confidentiality, integrity, and availability impact, successful exploitation yields complete takeover of the OHS instance. Fixed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis.

Denial-of-service and information disclosure in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (OW HR PR Foundation component) allows a low-privileged, authenticated attacker with network/HTTP access to hang or repeatedly crash the application (complete DoS) and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.

Local privilege-based takeover of Oracle HTTP Server (12.2.1.4.0 and 14.1.2.0.0) allows a low-privileged attacker with a logon session on the host to fully compromise the web server, yielding high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.8 with a local attack vector (AV:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but complete server takeover makes it a meaningful lateral-movement and privilege-consolidation target once a foothold exists.

Takeover of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a low-privileged attacker with network access over LDAP can fully compromise the directory service. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, Oracle describes the flaw as 'easily exploitable', meaning an authenticated LDAP user can escalate to full control of the directory. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-user prerequisite make it a high priority for LDAP-exposed deployments.

Privilege-based takeover of Oracle Unified Directory (OUD Core) affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a high-privileged attacker with LDAP network access can fully compromise the directory service. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit identified at time of analysis; addressed in Oracle's July 2026 Critical Patch Update.

Full takeover of Oracle Project Costing (part of Oracle E-Business Suite) is possible via the Enterprise Command Center component, where a high-privileged, network-authenticated attacker sending HTTP requests can compromise confidentiality, integrity, and availability of the module. Affected releases span EBS 12.2.3 through 12.2.15, and Oracle rates the flaw CVSS 3.1 7.2 while noting it is 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fix is delivered in the Oracle July 2026 Critical Patch Update.

Local privilege-based takeover in Oracle Coherence (component: Core) allows a low-privileged attacker with logon access to the host where Coherence executes to fully compromise the product, yielding high confidentiality, integrity, and availability impact. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Full compromise of Oracle Coherence (Fusion Middleware Core component) is possible by an unauthenticated attacker who holds a local logon on the host where Coherence runs, per Oracle's July 2026 Critical Patch Update. The flaw scores CVSS 9.3 because a successful attack yields complete confidentiality, integrity, and availability loss and, via a scope change, can significantly impact additional products beyond Coherence itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable.'

Full database takeover in Oracle Database Server's RDBMS component allows an authenticated, low-privileged user with only network access via Oracle Net to fully compromise the database, per Oracle's July 2026 Critical Patch Update. The flaw affects versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2, carrying a CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege bar make it a high-priority patch.

Full server takeover of Oracle WebLogic Server (Fusion Middleware, Console component) is achievable by an already-authenticated high-privileged attacker reaching the management Console over HTTPS. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and successful exploitation yields complete compromise of confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is addressed in Oracle's July 2026 Critical Patch Update.

Local privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged attacker with a local logon on the host where VirtualBox executes to take over the VirtualBox installation, with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV; despite a vendor 'Information Disclosure' tag, the CVSS vector reports full C/I/A impact consistent with product takeover. Exploitation requires prior local access and low privileges, which limits mass exploitation but makes it valuable as a post-access escalation step.

Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged attacker who can log on to the host to compromise the VirtualBox Core component with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The single vendor reference is Oracle's July 2026 Critical Patch Update advisory.

Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged attacker with a logon session on the host where VirtualBox runs to fully compromise the VirtualBox instance, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. It was disclosed by Oracle in the July 2026 Critical Patch Update.

Full product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows a low-privileged, authenticated attacker with network access over HTTPS to fully compromise the platform via the Metadata Plugin component, yielding high confidentiality, integrity, and availability impact. Rated CVSS 3.1 8.8, the flaw is described by Oracle as 'easily exploitable' and requires only an existing low-privilege account and no user interaction. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV; no EPSS score was provided in the input.

Branch protection bypass in Gitea versions prior to 1.27.0 allows a user with write (non-admin) access to merge unauthorized code into a protected branch by exploiting a stale approval flag. When a pull request is retargeted from an unprotected branch to a protected one via ChangeTargetBranch, Gitea fails to re-evaluate the stored official=true flag on existing approvals, so an approval that was never valid under the protected branch's whitelist still satisfies its required-approvals gate. Publicly available exploit code exists (a detailed step-by-step PoC in the GHSA advisory); no public exploit identified as actively used and it is not in CISA KEV.

Privilege escalation in SolarWinds Serv-U file transfer server arises from an insecure direct object reference (IDOR) that lets an actor already holding domain administrator access reference and manipulate objects across an authorization boundary. The flaw is fixed in the Serv-U 2026-3 release and has no public exploit identified at time of analysis; SolarWinds itself reported it. Impact is reduced in Windows deployments, which tempers real-world severity despite the 9.1 CVSS score.

Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure direct object reference (IDOR) and elevate to a system administrator, ultimately executing commands as the root user on the underlying host. The flaw affects Serv-U file transfer server deployments, with a reduced impact on Windows installations, and carries a CVSS 9.1 rating driven by a scope change from application admin to OS-level root. There is no public exploit identified at time of analysis and no CISA KEV listing, but SolarWinds self-reported and shipped a fix in the Serv-U 2026-3 release.

Privilege escalation in SolarWinds Serv-U lets an authenticated group member elevate their access to system administrator and execute code as root on Linux/Unix deployments, with reduced impact on Windows. The root cause is improper authorization (CWE-285) reachable over the network; the vendor rates it CVSS 9.1 due to a scope change and full CIA impact, but there is no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in the Serv-U 2026-3 release.

Privilege escalation in SolarWinds Serv-U managed file transfer server allows an existing domain administrator to elevate their Serv-U account from a standard user type to a full system administrator, granting complete control over the file transfer service and its data. The flaw stems from missing authorization (CWE-862) and carries a CVSS 9.1 rating, driven by a scope change and high confidentiality, integrity, and availability impact. SolarWinds notes the impact is lower in Windows deployments, and there is no public exploit identified at time of analysis.

Privilege escalation in SolarWinds Serv-U allows an authenticated member of a domain user group to be elevated into an administrator group, granting full administrative control over the managed file transfer server. The flaw stems from improper access control (CWE-284) and carries a vendor CVSS of 9.1 due to a scope change and full confidentiality, integrity, and availability impact, though SolarWinds notes the impact is lower on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege escalation in SolarWinds Serv-U allows a domain administrator to elevate to a full Serv-U system administrator, granting complete control over the managed file transfer server and its data (CVSS 9.1, CWE-284 improper access control). Exploitation requires existing domain-administrator privileges (PR:H) but no user interaction, and the vendor notes the impact is reduced on Windows deployments, implying non-Windows (Linux) installs are more severely affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a defense-in-depth priority rather than a confirmed active threat.

Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object reference (IDOR) that lets an authenticated group administrator manipulate object references beyond their authority. The flaw carries a CVSS 9.1 rating because a scope change allows a lower-tier admin to fully compromise the underlying host on Linux/Unix, though impact is reduced on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high privilege prerequisite (group admin) is realistic in multi-tenant MFT environments.

Local privilege escalation in snap-confine - the SUID/set-capabilities helper snapd uses to build the confinement sandbox for snap applications - lets an unprivileged local user on Ubuntu 22.04, 24.04, and 26.04 LTS gain full root. The flaw only manifests where snap-confine is deployed with file capabilities (set-capabilities) instead of the traditional set-uid-root binary, where incorrect handling of ambient capabilities lets an attacker escape intended privilege boundaries and run arbitrary code as root. Reported by Canonical; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Sandbox confinement bypass in Canonical snapd (snap-confine) affects all supported Ubuntu LTS releases (16.04 through 26.04) because the default seccomp templates fail to block system calls that create or set set-user-ID flags on files. A process already running inside a strictly confined snap can compile or drop a binary, mark it setuid, and then execute it to escape confinement assumptions and perform privileged actions within the container namespace. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 8.4 (scope-changed) rating reflects a genuine confinement-escape primitive.

Privilege escalation in Mozilla Firefox's Data Loss Prevention (DLP) component allows an attacker to gain elevated privileges beyond those intended for the affected process or policy context, with all confidentiality, integrity, and availability impacts rated high. Mozilla assigned a CVSS base score of 9.8, though the network/unauthenticated vector conflicts with the 'privilege escalation' framing typical of local flaws. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.13% exploitation probability (3rd percentile), indicating low near-term real-world weaponization despite the high CVSS.

Privilege escalation in the WebExtensions subsystem of Mozilla Firefox lets a WebExtension gain capabilities beyond its granted permission set, corresponding to CWE-269 (Improper Privilege Management). Mozilla, the reporting vendor, fixed the issue in Firefox 153 and Firefox ESR 140.13 (advisories MFSA2026-68/70/71/72). No public exploit has been identified at time of analysis and the EPSS probability is low at 0.14% (4th percentile), despite the vendor-supplied 9.8 CVSS score.

Privilege escalation in Mozilla Firefox's DOM Content Processes component allows an attacker who influences a sandboxed content process to break out of the renderer sandbox and gain elevated privileges on the host, affecting Firefox before 153 and Firefox ESR before 140.13. Mozilla assigns a critical CVSS of 9.8, though the 'content process' scope suggests the practical entry point is attacker-controlled web content rather than a fully unauthenticated network service. No public exploit is identified at time of analysis, and the EPSS exploitation probability is very low (0.15%, 5th percentile).

Privilege escalation in Mozilla Firefox's DOM Content Processes component allows attackers to escape or elevate beyond the sandboxed content process, gaining higher browser privileges on affected versions prior to Firefox 153. The flaw is a CWE-269 improper privilege management issue reported by Mozilla and patched in Firefox 153 (advisory MFSA2026-68). No public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no observed exploitation activity at time of analysis despite the high CVSS 9.8 rating.

Privilege escalation in Mozilla Firefox's DOM Navigation component allows remote attackers to elevate privileges, and given the CVSS network vector (AV:N/PR:N/UI:N) an attacker could compromise confidentiality, integrity, and availability without authentication or user interaction. The flaw affects Firefox before version 153 and Firefox ESR before 140.13, and was fixed by Mozilla in those releases. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.15%, 5th percentile).

Privilege escalation in Mozilla Firefox's DOM Navigation component (fixed in Firefox 153) allows an attacker to improperly gain elevated privileges within the browser, per Mozilla advisory MFSA2026-68. The flaw carries a CVSS 9.8 rating claiming full confidentiality, integrity, and availability impact with no privileges or user interaction, though this is atypical for a browser DOM bug. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).

Privilege escalation in Mozilla Firefox's DOM: Workers component lets remote attackers gain elevated privileges within the browser through web-facing content, potentially enabling sandbox/privilege boundary compromise. The flaw was resolved in Firefox 153 and is described in Mozilla advisory MFSA2026-68. There is no public exploit identified at time of analysis, and the EPSS score is low (0.14%, 4th percentile), indicating no evidence of active or imminent widespread exploitation.

Broken authorization in the Grav api plugin (grav-plugin-api) before 1.0.8 lets any authenticated panel user holding the baseline admin.login permission forge persistent API keys bound to arbitrary accounts, resulting in impersonation and privilege escalation up to account takeover. The plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks ahead of the account-management ACL, so a low-privilege operator can mint a key that inherits a higher-privileged account's API permissions. Reported by VulnCheck with a fix in 1.0.8; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Unauthenticated account takeover in the Easy Form Builder by WhiteStudio WordPress plugin (versions up to and including 4.0.11) lets remote attackers reset any user's password - including administrators - and gain full site control. The plugin's password recovery flow reuses a publicly scrapeable session identifier ('sid') as the reset token and exposes an unauthenticated nonce-refresh endpoint that hands valid REST nonces to any visitor, collapsing the entire reset gate. Rated CVSS 9.8; no public exploit has been identified at time of analysis, but the attack path is fully described and trivial to reconstruct.

Improper privilege enforcement in NextCRM 0.12.1 lets any authenticated low-privileged user create, modify, archive, or soft-delete entries in the organization-wide product catalog by calling MCP product tools at /api/mcp/mcp with a self-generated Bearer token. While the standard application server restricts these write operations to manager and admin roles, the MCP interface omits the role checks entirely, giving a vertical privilege escalation over shared business data. No public exploit identified at time of analysis; the issue is fixed in version 0.12.3.

Privilege escalation and information disclosure in Best Practical's Request Tracker (RT) 6.0.0-6.0.2 and versions before 5.0.10 lets a privileged but non-administrative user harvest other users' authentication credentials - including those of administrators - through the REST 2.0 API and replay them against RT's RSS/iCal feed endpoints to read data as those victims. Because the same credential-exposing request also rotates the tokens, exploitation is destructive: it silently invalidates every previously distributed feed URL across the instance. No public exploit has been identified at time of analysis; the flaw is fixed in RT 5.0.10 and 6.0.3.

Privilege escalation to remote code execution in dotCMS 21.02 through 26.06.22-03 lets a low-privileged authenticated backend user abuse improper authorization checks in the ToolGroupResource (REST) and RoleAjax (DWR) endpoints to self-assign the administrative layout and self-grant the CMS Administrator role, then upload a crafted OSGi bundle whose BundleActivator runs arbitrary shell commands on the host. The endpoints failed to verify the caller was an admin before honoring layout- and role-assignment requests, so any backend account could bootstrap itself to full administrator. There is no public exploit identified at time of analysis, but an upstream fix (PR #36344) is available and the vendor-supplied CVSS 4.0 score is 9.4 (Critical).

Privilege escalation in Extreme Networks ExtremeXOS (Switch Engine) EXOS shell allows a low-privileged CLI user to abuse the built-in mv, cp, and rm utilities to escape their authorized filesystem scope and tamper with security-critical files. Because these utilities follow symbolic links without safely canonicalizing paths, an attacker can plant a symlink to a privileged location and, under certain conditions, escalate to root and persistently modify the device software stack. Reported by Extreme Networks with a CVSS 4.0 score of 8.7 (High); no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Privilege escalation in Extreme Networks ExtremeXOS (EXOS / Switch Engine) lets an attacker reach the privileged debug-mode function because its challenge-response authorization derives the challenge from an insufficiently random source (CWE-338), making the expected response predictable under certain conditions. An attacker holding a valid low-privilege account (remote) or physical serial console access (local) can bypass debug-mode authorization and, depending on device model and firmware, escalate to root and persistently modify the device software stack. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the vendor (Extreme Networks) self-reported the issue.

Stored cross-site scripting in HeyForm's form builder (all versions prior to 3.0.0-rc.7) lets a low-privileged team member persist malicious JavaScript that fires in the browser of a team owner who later views the affected form, yielding full account takeover through privilege escalation. The flaw stems from insufficient sanitization of rich-text/HTML block content, allowing event-handler attributes and dangerous URL protocols to survive serialization. No public exploit has been identified at time of analysis, but the underlying commit (cc97d27) and GHSA advisory clearly document the injection vector, and the CVSS 9.0 rating reflects the high blast radius of hijacking an owner session.

Privilege escalation in HCL Commerce (versions 7 through 9.1.19) allows an authenticated low-privileged user to elevate their rights and perform unauthorized administrative operations, disclose other users' personal data, and cause denial of service. The flaw is network-reachable with low attack complexity and requires only existing low-level credentials, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis; the issue was self-reported by HCL and is not listed in CISA KEV.

Privilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Roles via a single REST API call, effectively promoting a low-privileged or newly self-registered account to administrator. It affects deployments running the all-Java user workflow adapter, or the Flowable adapter with a BPMN definition that does not require admin approval for self-registration or self-update, across versions 3.0.0-M0-3.0.16, 4.0.0-M0-4.0.6, and 4.1.0-M0-4.1.1. The Apache-issued advisory rates it CVSS 9.8; no public exploit identified at time of analysis and it is not on CISA KEV.

Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g. the database editor role) plant futures, functions, or closures inside record fields that later execute in the security context of whoever reads or writes the record. When a root owner or namespace admin touches the poisoned field, the attacker's logic runs with elevated permissions, enabling creation of a root owner and full server takeover. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS score supplied, so risk assessment rests on the vendor advisory and CVSS 4.0 signals rather than observed exploitation.

Local privilege escalation in Bizerba _connect.BRAIN before version 5.06 stems from its setup routine invoking LogPathConfig.exe, which strips the existing ACL on %ProgramData% and grants the built-in Everyone group full control instead of scoping permissions to the Bizerba subfolders. Any local low-privileged user can then modify files under %ProgramData% that privileged components read or execute, enabling escalation to higher privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is resolved in 5.06, which no longer runs the tool.

Local privilege escalation in Bizerba BRAIN2 before version 3.09 stems from the setup routine invoking LogPathConfig.exe, which misapplies an overly broad ACL granting the Windows 'Everyone' group full control over the entire %ProgramData% directory rather than the intended %ProgramData%\Bizerba\BRAIN2\ subtree. Any local user can therefore read, modify, or plant files that other applications and services trust, enabling tampering and potential escalation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the flaw is fixed in 3.09, though the optional, soon-to-be-deprecated Bizerba ScriptService component reintroduces the misconfiguration.

Authentication bypass via OTP brute-force in the 'Social Login, Passkeys, Magic Link & Email OTP' WordPress plugin before 1.4.1 lets an unauthenticated attacker who knows a registered email address guess the passwordless one-time-password and log in as that user, including an administrator, resulting in full site takeover. The plugin fails to enforce rate limiting or a working lockout on OTP verification and stores the short numeric codes in plaintext, so codes can be exhausted rapidly. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.

Privilege escalation in VMware Avi Load Balancer exposes authenticated, network-accessible users to remote code execution across a wide version range spanning 22.1.x through 32.1.x. The CVSS 8.8 rating reflects low-complexity, low-privilege network exploitation yielding full confidentiality, integrity, and availability impact on affected systems. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.39% (31st percentile) confirms limited active exploitation pressure at time of analysis.

Local privilege escalation in VMware (Broadcom) Avi Load Balancer allows a user who already has local access to the appliance to elevate to root and run arbitrary code. It affects the 22.1.x, 30.x, 31.x and 32.1.x release lines, is CVSS 7.8, and was reported by the vendor. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege escalation and full site takeover affects the AI Copilot WordPress plugin before 1.5.4, which fails to bind OAuth access tokens to a specific WordPress user and treats any valid token as an administrator session. An unauthenticated attacker who completes the plugin's public OAuth flow can invoke privileged MCP (Model Context Protocol) tools as an administrator, creating new users and escalating roles. Publicly available exploit code exists and the flaw carries a CVSS 9.8; no active exploitation has been confirmed (not in CISA KEV).

Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.3 lets unauthenticated visitors self-assign an arbitrary published membership tier during public registration, gaining that tier's user role - including administrator where such a tier exists. The plugin never validates that the tier submitted in the registration form is one the form actually offers, so an attacker simply tampers with the submitted tier value. Publicly available exploit code exists (reported by WPScan), though active exploitation has not been confirmed.

Privilege escalation in the Aimogen Pro (Aiomatic) all-in-one AI toolkit plugin for WordPress affects all versions through 2.8.4 and lets unauthenticated attackers create administrator accounts. The 'aiomatic_call_google_ai_function' AJAX handler lacks a capability check, allowing the 'aimogen_wp_god_mode' tool to clear function blacklists and invoke arbitrary PHP functions. No public exploit identified at time of analysis, but the pre-auth nature and 9.8 CVSS make this a full-site-takeover risk.

Unauthenticated privilege escalation in the Bricksforge WordPress plugin (versions ≤ 3.1.8.6) lets remote attackers create a new administrator account by abusing the Pro Forms User Registration action. The plugin fails to validate the fieldIds parameter, so attacker-supplied field IDs are injected into the trusted form-field whitelist, enabling mass-assignment of a privileged role. No public exploit has been identified at time of analysis, but the flaw is trivially exploitable (CVSS 9.8) on any site exposing a Pro Forms registration element.

Privilege escalation in OpenClaw's isolated cron job feature (versions 2026.6.1 through 2026.6.8) lets a lower-trust authenticated caller reclaim execution tools that authorization policy had explicitly denied, enabling actions and persistence beyond their intended trust level. The flaw is an incorrect-authorization (CWE-863) issue rooted in misconfigured input path handling within the cron subsystem, and carries a CVSS 4.0 score of 7.7. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local privilege escalation and silent denial-of-service in the Wazuh Windows agent (versions 4.6.0 through 4.14.4) arise from a heap-based buffer overflow in the syscheck registry-monitoring component. Because wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, a low-privileged local user who creates a 255-character registry subkey under a monitored wildcard path can trigger an out-of-bounds heap write, either blinding the agent or potentially executing code as SYSTEM. Proof-of-concept exploit code exists (SSVC: poc), but it is not in CISA KEV and EPSS is very low (0.09%, 1st percentile), consistent with the local-only, non-automatable attack profile.

Local privilege escalation in certain Zoom Clients for Windows lets an authenticated local user exploit a time-of-check to time-of-use (TOCTOU) race during install/uninstall to gain higher privileges (likely SYSTEM). The flaw was reported by Zoom's own security team and is documented in bulletin ZSB-26012; no public exploit identified at time of analysis and it is not on CISA KEV. The high-complexity race window and local-access requirement temper an otherwise high-impact (C:H/I:H/A:H) issue.

Local privilege escalation in Zoom Rooms for Windows before version 7.1.0 allows an authenticated low-privileged user to elevate to higher privileges via local access, with high impact to confidentiality, integrity, and availability (CVSS 7.8). Zoom's own security team (security@zoom.us) reported the flaw, classified as improper privilege management. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Privilege escalation in Zoom Workplace VDI Plugin for Windows (all versions prior to 6.6.14) is achievable by an authenticated local user exploiting a TOCTOU race condition during the product's installation or uninstallation process. The attack targets the narrow window between the installer's security check and its subsequent resource use, allowing a local attacker to substitute a controlled file or symlink and have it processed under elevated installer privileges. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 4th percentile signals very low real-world exploitation probability, though SSVC rates the technical impact as total if the race is won.

Privilege escalation in SALTO ProAccess Space access-control software allows an authenticated tenant user to break out of their assigned logical partition and reach any space managed by the platform. The flaw exists specifically when the multi-tenancy / logical partition feature is in use, letting a low-privileged authorized user manipulate an object reference to act on resources belonging to other tenants. Reported through CISA ICS-CERT (ICSA-26-197-07); no public exploit identified at time of analysis and no EPSS or KEV signal is provided in the input.

Local privilege escalation in AutomationDirect Productivity Suite programming software stems from an out-of-bounds write (CWE-787) reachable through a crafted IOCTL request to a privileged kernel-mode component, corrupting kernel memory. An authenticated local attacker on an engineering workstation running the software can leverage the corruption to escalate to SYSTEM/kernel privileges or crash the host. No public exploit identified at time of analysis; the flaw is documented in CISA ICS advisory ICSA-26-197-04 (reported by ICS-CERT) but is not listed in CISA KEV, and no EPSS score was supplied.

Local privilege escalation in AutomationDirect Productivity Suite lets an authenticated local attacker corrupt kernel memory by issuing a crafted IOCTL request to an out-of-bounds write flaw (CWE-787). Successful exploitation can elevate privileges to SYSTEM/kernel level or crash the host running this engineering workstation software for AutomationDirect Productivity-series PLCs. Reported through CISA ICS-CERT (ICSA-26-197-04); no public exploit identified at time of analysis and no KEV/EPSS signal is present.

Build-time remote code execution in Nuclio (serverless/FaaS platform) versions <= 1.15.27 lets remote attackers run arbitrary OS commands as root inside the function-builder container. The Java runtime renders user-supplied runtimeAttributes.repositories values into a Groovy build.gradle file via Go's text/template using the non-escaping {{ . }} action, so an attacker can inject a closing brace to break out of the repositories {} block and append Groovy that Gradle executes during its configuration phase. Because the Dashboard API defaults to NOP (no) authentication, exploitation needs no credentials; a dynamically-verified proof-of-concept is published in the vendor advisory, though there is no public exploit identified as being used in active attacks.

Local privilege escalation to arbitrary code execution affects Lenovo App Store, a software-distribution client shipped exclusively on Lenovo devices in the Chinese market. A local authenticated user who can interact with the application can leverage its excessive privileges (CWE-250) to run arbitrary code at an elevated privilege level, with high confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.

Privilege escalation in the WPFunnels (Funnel Builder for WooCommerce) plugin for WordPress lets authenticated users holding the wpf_manage_funnels capability — typically the plugin's Funnel Manager custom role — rewrite the global wp_user_roles option and grant their own role full administrator capabilities. All versions up to and including 3.12.8 are affected, and Wordfence rates it CVSS 8.8 (High). No public exploit has been identified at time of analysis, but the root cause is trivial (an unvalidated option name reaching update_option()), making reliable weaponization straightforward for a low-privileged insider.

Privilege escalation in the Digits WordPress Mobile Number Signup and Login plugin (all versions through 9.1.0.5) lets authenticated Subscriber-level users promote themselves to Administrator by submitting a forged digits_reg_userrole value during a profile update. The flaw stems from the dig_update_wpwc_custom_fields() function failing to validate the caller's authorization or the requested role. There is no public exploit identified at time of analysis, but the low barrier (any registered user on an affected site with the DIGITS User Role field configured) and full-administrator outcome make this a high-priority patching item.

Local privilege escalation in ESET Inspect Connector for Windows lets a low-privileged local user escalate to elevated (SYSTEM-level) privileges by abusing an improperly authenticated ALPC (Asynchronous Local Procedure Call) IPC channel. The affected component is the endpoint agent that links ESET Inspect (EDR) to protected Windows hosts; a non-privileged process can issue unauthenticated requests to a privileged service endpoint that fails to verify the caller. The issue was reported and fixed by ESET, is not listed in CISA KEV, and has no public exploit identified at time of analysis.

Privilege escalation in the Redux Framework WordPress plugin before 4.5.13 allows authenticated Subscriber-level users to become Administrators by writing arbitrary user meta keys through the plugin's custom profile fields, on sites where the Users extension (user-profile feature) is enabled. Because the plugin does not restrict which user meta keys are written when saving custom profile fields, an attacker can inject the wp_capabilities meta to grant themselves the administrator role. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.14% and there is no evidence of active exploitation.

Privilege escalation in Wekan (self-hosted Meteor kanban) before 9.32 lets any authenticated user directly invoke OIDC-only Meteor methods that lack the admin authorization checks applied to their non-OIDC counterparts. By calling setCreateOrgFromOidc, setOrgAllFieldsFromOidc, setCreateTeamFromOidc, setTeamAllFieldsFromOidc, boardRoutineOnLogin, or groupRoutineOnLogin over DDP, a low-privileged user can create or modify organizations and teams, and - when PROPAGATE_OIDC_DATA is enabled - groupRoutineOnLogin can grant that user global admin. No public exploit identified at time of analysis; the vendor fix (v9.32) is confirmed and the flaw carries a CVSS 4.0 base score of 7.6.

Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-privileged local user to gain Administrator rights when the software is installed to a non-default directory, due to an insecure installer permission configuration. Absolute (formerly NetMotion) assigns this a CVSS 4.0 base score of 8.5 (High), reflecting full local compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local credential theft in the garminconnect Python library (versions <= 0.3.4) stems from writing its OAuth token store to disk without an explicit file mode, so under the default umask 022 the file garmin_tokens.json - containing the DI refresh token - is created world-readable (0o644). Any unprivileged co-tenant on a shared Linux or macOS host can read the token and exchange it at Garmin's OAuth endpoint for fresh access tokens, gaining persistent access to the victim's Garmin Connect account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the fix in 0.3.5 is confirmed and the issue is trivially reproducible under default configuration.

Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to register an attacker-controlled OIDC or SAML identity provider for the organization, bypassing the admin role check. This can be exploited to inject a malicious IdP and, through downstream SSO callback provisioning, add users to the target organization, potentially with elevated privileges if the default role is admin. The vulnerability is fixed in version 1.6.11; no active exploitation is currently reported but a public exploit is possible given the clear advisory details.

Local privilege escalation in Pegatron's Tdelo64.sys kernel driver allows any unprivileged user to perform arbitrary hardware I/O port reads and writes through the \\.\TdeIo device. The driver's TDE_IOCTL_INDEXIO_READ and TDE_IOCTL_INDEXIO_WRITE handlers lack authorization checks, letting a local attacker manipulate hardware registers to gain kernel-level control, tamper with firmware interfaces, or establish persistent low-level compromise. Reported by CERT/CC; no public exploit identified at time of analysis, and EPSS is low at 0.20% (10th percentile).

Local privilege escalation to MySQL root in the NixOS services.mysql module (Nixpkgs, before the 25.11 and 26.05 channel fixes) lets any unprivileged local account - including web, CGI, or other service processes on the same host - authenticate as the database root@localhost user with no password when the module is deployed with the mysql or percona-server package. Because the module initialized root@localhost without socket or password authentication, the DBMS trusted any local connection as root, granting full read/write control over all databases. No public exploit code has been identified at time of analysis and it is not in CISA KEV, but exploitation is trivial for any local process meeting the precondition.

Privilege escalation in phpMyFAQ before 4.1.5 lets a delegated administrator holding USER_ADD/EDIT/DELETE rights mint a full SuperAdmin account through the POST /admin/api/user/add endpoint, resulting in complete instance takeover. The flaw stems from a missing SuperAdmin authorization guard, allowing a lower-privileged operator to submit isSuperAdmin: true with attacker-chosen credentials and then log in as that account. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Predictable default credentials in Ciena's Navigator Network Control Suite (NCS), Manage Control Plane (MCP), and Planner Plus OnPrem expose hidden system accounts used for internal software operations to remote attackers. These accounts carry limited permissions in isolation, but their known default passwords give an attacker a foothold that can be chained with other weaknesses to escalate privilege on the management system. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, so exploitation remains theoretical rather than demonstrated.

Privilege escalation in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) allows an adjacent-network attacker to bypass authorization checks and gain unauthorized read and write access without any user interaction. Because the CVSS scope is changed, a successful exploit can affect resources beyond the vulnerable component. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the CWE-863 root cause and 9.3 base score make it a high-priority patch for internet-adjacent ColdFusion servers.

Privilege escalation in Woodpecker CI (v1.0.0 through v3.15.0) using the Kubernetes backend allows any user with Push permission on a connected repository to set the pipeline pod's serviceAccountName to an arbitrary ServiceAccount in the pipeline namespace, inheriting that account's RBAC rights. Because the backend_options.kubernetes.serviceAccountName value was written straight into the pod spec with no admin gating, a low-privileged pipeline author can reach a privileged ServiceAccount to exfiltrate secrets (DB credentials, API keys, TLS certs) and potentially take over the cluster. No public exploit identified at time of analysis; not in CISA KEV.

Stored cross-site scripting in EasyAdminBundle (Symfony admin generator) versions 5.0.0 through 5.0.12 allows a lower-privileged user with access to a form using FileField or ImageField to upload a browser-executable .html or .svg file that EasyAdmin then links to inline, executing attacker-controlled JavaScript in a viewing administrator's authenticated session. Impact includes session/CSRF-token theft and privilege escalation; it is explicitly NOT remote code execution because filenames come from Symfony's guessExtension(). There is no public exploit identified at time of analysis and it is not in CISA KEV; a vendor patch is available in 5.0.13.

Let me synthesize all data. CVE-2026-44300 — OpenCost /serviceKey unauthenticated file write. Product name: OpenCost CVSS 8.8 given, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/... CWE-20 (Improper Input Validation) but also CWE-306 mentioned in the description. Patch: Available from vendor; fixed in 1.119.1 per CPE data. Wait, the references mention releases v1.120.0 and v1.121.0, but the "Package" line says vulnerable: < 1.119.1 — fixed in: 1.119.1. Hmm, conflicting. I should note this in confidence_notes. Actually the fix commit introduces adminAuthMiddleware requiring ADMIN_TOKEN. The releases listed (v1.120.0, v1.121.0) are refs. The package data says fixed in 1.119.1. I'll present both and flag the discrepancy. Note the patch only adds auth when ADMIN_TOKEN is set; when unset it still allows unauthenticated writes with a warning. That's an important nuance — remediation must note that ADMIN_TOKEN must be configured. Let me write fields. prevalence: OpenCost is a widely used CNCF incubating project for Kubernetes cost monitoring — medium/high. It's popular in k8s cost monitoring but not ubiquitous. I'd say "medium" — common but not everywhere. Given it's a CNCF sandbox/incubating project with significant adoption in FinOps, "medium" seems right. assessed_cvss_vector: The vulnerability is network-reachable, no auth required (PR:N), low complexity (AC:L), no UI. Impact: VI:H (attacker can overwrite the key file — integrity), VA:H (service disruption). Confidentiality: description claims credential theft / data leakage but the direct impact per the vendor-ish analysis says C:N. Well, injecting attacker credentials could leak cost data to the attacker. Hmm. Original vector says VC:N. But actually credential theft — the attacker can't read the existing key file. So C:N. Let me go with: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H = 8.2? Let's compute: AV:N/AC:L/PR:N/UI:N = base 9.8-ish for C:H/I:H/A:H. With C:N, I:H, A:H → score. Let me compute:

Local privilege escalation in the Windows Group Policy component allows an already-authenticated user to elevate to higher privileges (up to SYSTEM) on affected Windows 10, Windows 11, and Windows Server 2012-2025 systems. The flaw stems from improper privilege management (CWE-269) and is reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. With CVSS 7.8 and full confidentiality, integrity, and availability impact, it is a strong candidate for the monthly patch cycle on endpoints and domain-joined servers.

Local privilege escalation in the Microsoft Install Service (Windows Installer) affects supported Windows 10, Windows 11, and Windows Server 2019-2025 builds, letting an already-authenticated local user with limited rights (PR:L) elevate to SYSTEM. The flaw stems from improper privilege management (CWE-269) in how the service handles operations, yielding full confidentiality, integrity, and availability impact. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Local privilege escalation in Microsoft Windows WalletService allows an authenticated low-privileged attacker to gain SYSTEM-level rights on the host, per CVSS:3.1 AV:L/AC:L/PR:L (7.8, High). The flaw stems from improper privilege management (CWE-269) in the WalletService component and affects a broad range of Windows client and server builds. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch from Microsoft is available.

Privilege escalation in Fortinet FortiSIEM Windows Agent 7.4.0 through 7.4.1 stems from an improper restriction of the agent's communication channel (CWE-923), letting an adjacent-network attacker interact with an endpoint that should be limited to trusted parties and thereby gain elevated privileges with full confidentiality, integrity, and availability impact. The flaw was disclosed by Fortinet PSIRT (FG-IR-26-155) and carries a CVSS 7.5 rating; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is gated by high attack complexity, which materially reduces real-world likelihood despite the unauthenticated vector.