CVE-2026-11858

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11858", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2026-06-10T09:08:26.174Z", "datePublished": "2026-06-17T11:50:47.666Z", "dateUpdated": "2026-06-17T14:56:22.560Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2026-06-17T11:50:47.666Z"}, "title": "Missing authorization in Quanos SCHEMA ST4 Client Update Service allows arbitrary file overwrite as SYSTEM", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"vendor": "Quanos Solutions GmbH", "product": "SCHEMA ST4", "versions": [{"status": "affected", "version": "SCHEMA ST4 on-premises, all versions"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\\SYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient access controls or authorization. A local authenticated low-privileged user can connect to the interface and invoke privileged update methods such as Update(). This allows arbitrary file write and delete operations with SYSTEM privileges and can be used to achieve local privilege escalation.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\\SYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient access controls or authorization. A local authenticated low-privileged user can connect to the interface and invoke privileged update methods such as Update(). This allows arbitrary file write and delete operations with SYSTEM privileges and can be used to achieve local privilege escalation."}]}], "references": [{"url": "https://r.sec-consult.com/quanos", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "workarounds": [{"lang": "en", "value": "Disable the Client Update Service until a fix is provided. Restrict local interactive access to systems running SCHEMA ST4 on-premises. Apply the principle of least privilege to local user accounts and prevent untrusted users from obtaining local sessions on affected hosts. Ensure that only trusted administrators can perform client updates manually.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Disable the Client Update Service until a fix is provided. Restrict local interactive access to systems running SCHEMA ST4 on-premises. Apply the principle of least privilege to local user accounts and prevent untrusted users from obtaining local sessions on affected hosts. Ensure that only trusted administrators can perform client updates manually."}]}], "solutions": [{"lang": "en", "value": "The vendor does not provide a patch. The vendor recommends disabling the affected Client Update Service. Updating the client is then only possible manually with a privileged user account.\n\n\nQuanos confirms that exploitation requires local host access with an authenticated user session. In properly managed environments following the Least Privilege principle, the attack surface is significantly reduced. Quanos Cloud/SaaS deployments are not affected. Quanos considers the migration to the Cloud/SaaS architecture the strategic long-term solution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The vendor does not provide a patch. The vendor recommends disabling the affected Client Update Service. Updating the client is then only possible manually with a privileged user account.<div><br><div><p>Quanos confirms that exploitation requires local host access with an authenticated user session. In properly managed environments following the Least Privilege principle, the attack surface is significantly reduced. Quanos Cloud/SaaS deployments are not affected. Quanos considers the migration to the Cloud/SaaS architecture the strategic long-term solution.</p><p></p></div></div>"}]}], "credits": [{"lang": "en", "value": "Johannes Kruchem, SEC Consult Vulnerability Lab", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-17T14:56:14.233126Z", "id": "CVE-2026-11858", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T14:56:22.560Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11858", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-17T14:56:14.233126Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T14:56:18.581Z"}}], "cna": {"title": "Missing authorization in Quanos SCHEMA ST4 Client Update Service allows arbitrary file overwrite as SYSTEM", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Johannes Kruchem, SEC Consult Vulnerability Lab"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Quanos Solutions GmbH", "product": "SCHEMA ST4", "versions": [{"status": "affected", "version": "SCHEMA ST4 on-premises, all versions"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "The vendor does not provide a patch. The vendor recommends disabling the affected Client Update Service. Updating the client is then only possible manually with a privileged user account.\n\n\nQuanos confirms that exploitation requires local host access with an authenticated user session. In properly managed environments following the Least Privilege principle, the attack surface is significantly reduced. Quanos Cloud/SaaS deployments are not affected. Quanos considers the migration to the Cloud/SaaS architecture the strategic long-term solution.", "supportingMedia": [{"type": "text/html", "value": "The vendor does not provide a patch. The vendor recommends disabling the affected Client Update Service. Updating the client is then only possible manually with a privileged user account.<div><br><div><p>Quanos confirms that exploitation requires local host access with an authenticated user session. In properly managed environments following the Least Privilege principle, the attack surface is significantly reduced. Quanos Cloud/SaaS deployments are not affected. Quanos considers the migration to the Cloud/SaaS architecture the strategic long-term solution.</p><p></p></div></div>", "base64": false}]}], "references": [{"url": "https://r.sec-consult.com/quanos", "tags": ["third-party-advisory"]}], "workarounds": [{"lang": "en", "value": "Disable the Client Update Service until a fix is provided. Restrict local interactive access to systems running SCHEMA ST4 on-premises. Apply the principle of least privilege to local user accounts and prevent untrusted users from obtaining local sessions on affected hosts. Ensure that only trusted administrators can perform client updates manually.", "supportingMedia": [{"type": "text/html", "value": "Disable the Client Update Service until a fix is provided. Restrict local interactive access to systems running SCHEMA ST4 on-premises. Apply the principle of least privilege to local user accounts and prevent untrusted users from obtaining local sessions on affected hosts. Ensure that only trusted administrators can perform client updates manually.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\\SYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient access controls or authorization. A local authenticated low-privileged user can connect to the interface and invoke privileged update methods such as Update(). This allows arbitrary file write and delete operations with SYSTEM privileges and can be used to achieve local privilege escalation.", "supportingMedia": [{"type": "text/html", "value": "Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\\SYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient access controls or authorization. A local authenticated low-privileged user can connect to the interface and invoke privileged update methods such as Update(). This allows arbitrary file write and delete operations with SYSTEM privileges and can be used to achieve local privilege escalation.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2026-06-17T11:50:47.666Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11858", "state": "PUBLISHED", "dateUpdated": "2026-06-17T14:56:22.560Z", "dateReserved": "2026-06-10T09:08:26.174Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2026-06-17T11:50:47.666Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "SCHEMA ST4", "vendor": "Quanos Solutions GmbH", "versions": [{"status": "affected", "version": "SCHEMA ST4 on-premises, all versions"}]}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\\SYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient access controls or authorization. A local authenticated low-privileged user can connect to the interface and invoke privileged update methods such as Update(). This allows arbitrary file write and delete operations with SYSTEM privileges and can be used to achieve local privilege escalation."}, {"lang": "es", "value": "Quanos SCHEMA ST4 local contiene una vulnerabilidad de escalada de privilegios local en el Servicio de Actualizaci\u00f3n del Cliente. El servicio de actualizaci\u00f3n se ejecuta como NT AUTHORITY\\SYSTEM y expone una interfaz .NET Remoting a trav\u00e9s de una tuber\u00eda con nombre sin controles de acceso o autorizaci\u00f3n suficientes. Un usuario local autenticado con bajos privilegios puede conectarse a la interfaz e invocar m\u00e9todos de actualizaci\u00f3n privilegiados como Update(). Esto permite operaciones arbitrarias de escritura y eliminaci\u00f3n de archivos con privilegios de SYSTEM y puede utilizarse para lograr la escalada de privilegios local."}], "id": "CVE-2026-11858", "lastModified": "2026-10-26T12:10:00.130", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11858", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-17T14:56:14.233126Z", "version": "2.0.3"}}]}, "published": "2026-06-17T13:19:33.807", "references": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://r.sec-consult.com/quanos"}], "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "SCHEMA ST4", "source": "cna", "vendor": "Quanos Solutions GmbH"}, "product": "schema_st4", "vendor": "quanos_solutions"}], "created": "2026-06-18T12:00:16.849391+00:00", "updated": "2026-06-20T23:03:27.782295+00:00", "vendors": ["quanos_solutions", "quanos_solutions$PRODUCT$schema_st4"]}