CVE-2025-66266
The RupsMon.exe service executable in UPSilon 2000 has insecure permissions, allowing the 'Everyone' group Full Control. A local attacker ca
CVSS
—
No CVSS
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Published: Nov 26, 2025 · Last modified: Oct 18, 2026 · CWE-269
0.1%EPSS · 30 days0.1%
2026-09-282026-10-26
The RupsMon.exe service executable in UPSilon 2000 has insecure permissions, allowing the 'Everyone' group Full Control. A local attacker can replace the executable with a malicious binary to execute code with SYSTEM privileges or simply change the config path of the service to a command; starting and stopping the service to immediately achieve code execution and privilege escalation
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-771725.3 MED—
———App passwords were allowed to bypass password confirmation on sensitive endpoints.2hCVE-2026-1115847.3 HIG—
———A race condition in the installation
process of TeamViewer Remote Management - Patch Management for Windows prior to
version 26.9.1 allows a local authenticated attacker with low privileges to
execute arbitrary code with elevated privileges by replacing the service
executable in an insufficiently protected temporary directory during Patch
Management activation.3hCVE-2026-1115837.3 HIG—
———Improper access control in the installer
staging directory used by TeamViewer Full Client and Host prior to version
15.82 for Windows during installation of Advanced Asset Management allows a
local authenticated user with low privileges to execute arbitrary commands as
SYSTEM. An attacker can place a crafted installer options file that is
processed by the Advanced Asset Management installer during service activation.3hCVE-2026-1115827.3 HIG—
———A DLL loading vulnerability in the
TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1
allows a local authenticated attacker with low privileges to execute arbitrary
code with elevated privileges. Exploitation requires user interaction.3hCVE-2026-1180088.8 HIG—
———Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159.4hCVE-2026-907296.7 MED—
———Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.4h