CVE-2026-56857
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory
CVSS
9.8
Crítica
EPSS
0.6%
p46
KEV
—
Exploit Today
14
0-100
Publicado: 8 de out. de 2026 · Última mod.: 9 de out. de 2026 · CWE-1386
0.2%EPSS · 30 dias0.6%
2026-10-092026-11-05
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2025-64394—1.2%
——0A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.1dCVE-2025-64391—1.6%
——0This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it.17dCVE-2026-411166.3 MÉD0.3%
——0Dell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary File Write.106dCVE-2023-236974.7 MÉD7.3%
——2Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticated malicious user may potentially exploit this vulnerability leading to arbitrary folder deletion.
8d