CVE-2026-110746

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110746", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-10-14T16:22:00.651Z", "datePublished": "2026-10-15T14:08:27.445Z", "dateUpdated": "2026-10-15T15:17:16.739Z"}, "containers": {"cna": {"title": "CVE-2026-110746", "descriptions": [{"lang": "en", "value": "A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\\SYSTEM."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "TotalSecurity", "product": "TotalAV", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "7.1.17", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "description": "CWE-273: Improper Check for Dropped Privileges"}]}], "references": [{"url": "https://www.totalav.com/"}, {"url": "https://github.com/lukehebe/Vulnerability-Disclosures/tree/main/TotalAV-7.1.17-LPE"}], "x_generator": {"engine": "VINCE 3.0.50", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-110746"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-10-15T14:08:27.445Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}, {"type": "CWE", "cweId": "CWE-23", "lang": "en", "description": "CWE-23 Relative Path Traversal"}]}], "references": [{"url": "https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/TotalAV-7.1.17-LPE/TotalAV_LPE.c", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-15T15:15:59.338352Z", "id": "CVE-2026-110746", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T15:17:16.739Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110746", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-10-14T16:22:00.651Z", "datePublished": "2026-10-15T14:08:27.445Z", "dateUpdated": "2026-10-15T15:17:16.739Z"}, "containers": {"cna": {"title": "CVE-2026-110746", "descriptions": [{"lang": "en", "value": "A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\\SYSTEM."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "TotalSecurity", "product": "TotalAV", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "7.1.17", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "description": "CWE-273: Improper Check for Dropped Privileges"}]}], "references": [{"url": "https://www.totalav.com/"}, {"url": "https://github.com/lukehebe/Vulnerability-Disclosures/tree/main/TotalAV-7.1.17-LPE"}], "x_generator": {"engine": "VINCE 3.0.50", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-110746"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-10-15T14:08:27.445Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-110746", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T15:15:59.338352Z"}}}], "references": [{"url": "https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/TotalAV-7.1.17-LPE/TotalAV_LPE.c", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}, {"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "CWE-23 Relative Path Traversal"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T15:16:30.318Z"}}]}}

{"affected": [{"affectedData": [{"product": "TotalAV", "vendor": "TotalSecurity", "versions": [{"lessThanOrEqual": "7.1.17", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cret@cert.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\\SYSTEM."}], "id": "CVE-2026-110746", "lastModified": "2026-10-16T16:00:33.533", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-110746", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T15:15:59.338352Z", "version": "2.0.3"}}]}, "published": "2026-10-15T15:17:28.487", "references": [{"source": "cret@cert.org", "url": "https://github.com/lukehebe/Vulnerability-Disclosures/tree/main/TotalAV-7.1.17-LPE"}, {"source": "cret@cert.org", "url": "https://www.totalav.com/"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/TotalAV-7.1.17-LPE/TotalAV_LPE.c"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-23"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.1.17]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "TotalAV", "source": "cna", "vendor": "TotalSecurity"}, "product": "totalav", "vendor": "totalsecurity"}], "created": "2026-10-16T21:15:14.694230+00:00", "title": "Local Privilege Escalation via gRPC IPC Authentication Token Forgery in TotalAV", "updated": "2026-10-19T13:06:48.645893+00:00", "vendors": ["totalsecurity", "totalsecurity$PRODUCT$totalav"]}