CVE-2026-116596
CVE-2026-116596
Published Oct 26, 2026
CVSS n/a
EPSS < 1%
KEV · Not listed
Description
Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract.
Affected Products
-
CVE record
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Pyrus | Pyrus Sync | affected |
|
No data.
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Pyrus | Pyrus Sync |
|
Remediation
Tracking
Advisories
Metrics
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.131% probability within 30 days)
Key SSVC decision points have not yet been added.
References
History
Oct 26, 2026 7:15 PM
First appearance in the feed. Affected vendors updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Pyrus
Pyrus pyrus Sync |
|
| Vendors & Products |
Pyrus
Pyrus pyrus Sync |
Oct 26, 2026 5:45 PM
Weaknesses updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 |
Oct 26, 2026 4:30 PM
Description updated. Title updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract. | |
| Title | CVE-2026-116596 | |
| References |
|
Subscriptions
Weaknesses
