CVE-2026-7169

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7169", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "state": "PUBLISHED", "assignerShortName": "INCIBE", "dateReserved": "2026-04-27T07:40:53.476Z", "datePublished": "2026-09-24T10:59:44.292Z", "dateUpdated": "2026-09-24T12:11:48.604Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2026-09-24T10:59:44.292Z"}, "title": "Uncontrolled Search Path Element in Evope Collector", "datePublic": "2026-09-24T10:53:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE - 427 Uncontrolled Search Path Element"}]}], "affected": [{"vendor": "Evope Collector", "product": "Evope Collector", "versions": [{"status": "affected", "version": "1.1.6.9.0"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:evope_collector:evope_collector:1.1.6.9.0:*:*:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en", "value": "a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a \u2018wtsapi32.dll\u2019 file in the \u2018C:\\ProgramData\\Evope\\\u2019 directory. The \u2018Evope.Service.exe\u2019 component, which runs with \u2018NT AUTHORITY\\SYSTEM\u2019 privileges, loads this DLL without properly verifying its integrity or origin. Successful exploitation could allow code execution with SYSTEM privileges and result in local privilege escalation.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a \u2018wtsapi32.dll\u2019 file in the \u2018C:\\ProgramData\\Evope\\\u2019 directory. The \u2018Evope.Service.exe\u2019 component, which runs with \u2018NT AUTHORITY\\SYSTEM\u2019 privileges, loads this DLL without properly verifying its integrity or origin. Successful exploitation could allow code execution with SYSTEM privileges and result in local privilege escalation."}]}], "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/uncontrolled-search-path-element-evope-collector", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "The vulnerability has been fixed by Evope team in version 1.1.7.13.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The vulnerability has been fixed by Evope team in version 1.1.7.13."}]}], "credits": [{"lang": "en", "value": "Javier Sanz Mart\u00edn", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-24T12:05:07.092305Z", "id": "CVE-2026-7169", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-24T12:11:48.604Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7169", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-24T12:05:07.092305Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-24T12:11:37.385Z"}}], "cna": {"title": "Uncontrolled Search Path Element in Evope Collector", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Javier Sanz Mart\u00edn"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Evope Collector", "product": "Evope Collector", "versions": [{"status": "affected", "version": "1.1.6.9.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The vulnerability has been fixed by Evope team in version 1.1.7.13.", "supportingMedia": [{"type": "text/html", "value": "The vulnerability has been fixed by Evope team in version 1.1.7.13.", "base64": false}]}], "datePublic": "2026-09-24T10:53:00.000Z", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/uncontrolled-search-path-element-evope-collector", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a \u2018wtsapi32.dll\u2019 file in the \u2018C:\\ProgramData\\Evope\\\u2019 directory. The \u2018Evope.Service.exe\u2019 component, which runs with \u2018NT AUTHORITY\\SYSTEM\u2019 privileges, loads this DLL without properly verifying its integrity or origin. Successful exploitation could allow code execution with SYSTEM privileges and result in local privilege escalation.", "supportingMedia": [{"type": "text/html", "value": "a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a \u2018wtsapi32.dll\u2019 file in the \u2018C:\\ProgramData\\Evope\\\u2019 directory. The \u2018Evope.Service.exe\u2019 component, which runs with \u2018NT AUTHORITY\\SYSTEM\u2019 privileges, loads this DLL without properly verifying its integrity or origin. Successful exploitation could allow code execution with SYSTEM privileges and result in local privilege escalation.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE - 427 Uncontrolled Search Path Element"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:evope_collector:evope_collector:1.1.6.9.0:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2026-09-24T10:59:44.292Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7169", "state": "PUBLISHED", "dateUpdated": "2026-09-24T12:11:48.604Z", "dateReserved": "2026-04-27T07:40:53.476Z", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "datePublished": "2026-09-24T10:59:44.292Z", "assignerShortName": "INCIBE"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Evope Collector", "vendor": "Evope Collector", "versions": [{"status": "affected", "version": "1.1.6.9.0"}]}], "source": "cve-coordination@incibe.es"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a \u2018wtsapi32.dll\u2019 file in the \u2018C:\\ProgramData\\Evope\\\u2019 directory. The \u2018Evope.Service.exe\u2019 component, which runs with \u2018NT AUTHORITY\\SYSTEM\u2019 privileges, loads this DLL without properly verifying its integrity or origin. Successful exploitation could allow code execution with SYSTEM privileges and result in local privilege escalation."}], "id": "CVE-2026-7169", "lastModified": "2026-09-24T14:45:22.827", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve-coordination@incibe.es", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7169", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-24T12:05:07.092305Z", "version": "2.0.3"}}]}, "published": "2026-09-24T12:17:12.973", "references": [{"source": "cve-coordination@incibe.es", "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/uncontrolled-search-path-element-evope-collector"}], "sourceIdentifier": "cve-coordination@incibe.es", "vulnStatus": "Deferred"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.1.6.9.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Evope Collector", "source": "cna", "vendor": "Evope Collector"}, "product": "evope_collector", "vendor": "evope_collector"}], "created": "2026-09-24T13:00:14.483809+00:00", "updated": "2026-09-25T14:17:51.988105+00:00", "vendors": ["evope_collector", "evope_collector$PRODUCT$evope_collector"], "weaknesses": ["CWE-1135"]}