CVE-2026-11858

Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\SYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient access controls or authorization. A local authenticated low-privileged user can connect to the interface and invoke privileged update methods such as Update(). This allows arbitrary file write and delete operations with SYSTEM privileges and can be used to achieve local privilege escalation.

CVSS

No CVSS.

References

Link	Resource
https://r.sec-consult.com/quanos

Configurations

No configuration.

History

26 Oct 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) Quanos SCHEMA ST4 local contiene una vulnerabilidad de escalada de privilegios local en el Servicio de Actualización del Cliente. El servicio de actualización se ejecuta como NT AUTHORITY\SYSTEM y expone una interfaz .NET Remoting a través de una tubería con nombre sin controles de acceso o autorización suficientes. Un usuario local autenticado con bajos privilegios puede conectarse a la interfaz e invocar métodos de actualización privilegiados como Update(). Esto permite operaciones arbitrarias de escritura y eliminación de archivos con privilegios de SYSTEM y puede utilizarse para lograr la escalada de privilegios local.

Information

Published : 2026-06-17 13:19

Updated : 2026-10-26 12:10

NVD link : CVE-2026-11858

Mitre link : CVE-2026-11858

CVE.ORG link : CVE-2026-11858

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-11858", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11858", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-17T14:56:14.233126Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "affectedData": [{"vendor": "Quanos Solutions GmbH", "product": "SCHEMA ST4", "versions": [{"status": "affected", "version": "SCHEMA ST4 on-premises, all versions"}], "defaultStatus": "affected"}]}], "published": "2026-06-17T13:19:33.807", "references": [{"url": "https://r.sec-consult.com/quanos", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\\SYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient access controls or authorization. A local authenticated low-privileged user can connect to the interface and invoke privileged update methods such as Update(). This allows arbitrary file write and delete operations with SYSTEM privileges and can be used to achieve local privilege escalation."}, {"lang": "es", "value": "Quanos SCHEMA ST4 local contiene una vulnerabilidad de escalada de privilegios local en el Servicio de Actualizaci\u00f3n del Cliente. El servicio de actualizaci\u00f3n se ejecuta como NT AUTHORITY\\SYSTEM y expone una interfaz .NET Remoting a trav\u00e9s de una tuber\u00eda con nombre sin controles de acceso o autorizaci\u00f3n suficientes. Un usuario local autenticado con bajos privilegios puede conectarse a la interfaz e invocar m\u00e9todos de actualizaci\u00f3n privilegiados como Update(). Esto permite operaciones arbitrarias de escritura y eliminaci\u00f3n de archivos con privilegios de SYSTEM y puede utilizarse para lograr la escalada de privilegios local."}], "lastModified": "2026-10-26T12:10:00.130", "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}