CVE Watch16 de out. de 2026

CVE-2026-110359

Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running fr

CVSS

7.8

Alta

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 14 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-276

EPSS · 30d

0.1%EPSS · 30 dias0.1%

2026-10-142026-11-06

Descrição técnica

Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges.

Referências oficiais

github.comhttps://github.com/JNDataRT/Vulns/blob/main/Advisories/2026/1.md

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-448757.8 ALT

2.8%

——1In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM potentially allows elevated access by a local unprivileged user.1d CVE-2026-94460—

8.1%

——2IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, which could allow an unauthenticated attacker to gain unauthorised access to privileged application functionality.3d CVE-2026-163057.8 ALT

17.7%

——5Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.14h CVE-2026-918957.1 ALT

1.6%

——0Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering.4d CVE-2026-1070527.5 ALT

29.3%

——9Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.8d CVE-2026-1141487.8 ALT

29.3%

——9Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.8d