CVE-2026-105009
Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
CVSS
7.5
Alta
EPSS
0.3%
p25
KEV
—
Exploit Today
8
0-100
Publicado: 13 de out. de 2026 · Última mod.: 26 de out. de 2026 · CWE-276
0.3%EPSS · 30 dias0.3%
2026-10-142026-11-06
Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-448757.8 ALT2.8%
——1In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM potentially allows elevated access by a local unprivileged user.1dCVE-2026-94460—8.1%
——2IRISPowerscan contain an insecure default
configuration where the built-in installation account is assigned elevated
privileges with a predictable password, which could allow an unauthenticated
attacker to gain unauthorised access to privileged application functionality.3dCVE-2026-163057.8 ALT17.7%
——5Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.10hCVE-2026-918957.1 ALT1.6%
——0Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering.4dCVE-2026-1070527.5 ALT29.3%
——9Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.7dCVE-2026-1141487.8 ALT29.3%
——9Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.8d