CVE-2026-8069

PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY\SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an attacker can execute arbitrary code on the target system with elevated privileges.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://community.acer.com/en/kb/articles/19652	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:acer:nitrosense::::::::
	cpe:2.3:a:acer:predatorsense::::::::

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de PredatorSense 3.00.3136 a 3.00.3196 contienen una vulnerabilidad de escalada de privilegios local (LPE). El programa expone una Named Pipe de Windows que utiliza un protocolo personalizado para invocar funciones internas. Sin embargo, esta Named Pipe está mal configurada, permitiendo a cualquier usuario local autenticado ejecutar código arbitrario con privilegios de NT AUTHORITY\SYSTEM y eliminar archivos arbitrarios con privilegios de SYSTEM. Al aprovechar esto, un atacante puede ejecutar código arbitrario en el sistema objetivo con privilegios elevados.

Information

Published : 2026-05-08 07:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-8069

Mitre link : CVE-2026-8069

CVE.ORG link : CVE-2026-8069

JSON object : View

Products Affected

acer

nitrosense
predatorsense

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-269

Improper Privilege Management

CWE-284

Improper Access Control

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2026-8069", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8069", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-08T12:51:31.268398Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "8fc372e3-d9c5-46e4-9410-38469745c639", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "8fc372e3-d9c5-46e4-9410-38469745c639", "affectedData": [{"vendor": "Acer", "product": "PredatorSense V3", "versions": [{"status": "affected", "version": "3.00.3136", "versionType": "custom", "lessThanOrEqual": "3.00.3196"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-05-08T07:16:29.443", "references": [{"url": "https://community.acer.com/en/kb/articles/19652", "tags": ["Vendor Advisory"], "source": "8fc372e3-d9c5-46e4-9410-38469745c639"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "8fc372e3-d9c5-46e4-9410-38469745c639", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY\\SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an attacker can execute arbitrary code on the target system with elevated privileges."}, {"lang": "es", "value": "Las versiones de PredatorSense 3.00.3136 a 3.00.3196 contienen una vulnerabilidad de escalada de privilegios local (LPE). El programa expone una Named Pipe de Windows que utiliza un protocolo personalizado para invocar funciones internas. Sin embargo, esta Named Pipe est\u00e1 mal configurada, permitiendo a cualquier usuario local autenticado ejecutar c\u00f3digo arbitrario con privilegios de NT AUTHORITY\\SYSTEM y eliminar archivos arbitrarios con privilegios de SYSTEM. Al aprovechar esto, un atacante puede ejecutar c\u00f3digo arbitrario en el sistema objetivo con privilegios elevados."}], "lastModified": "2026-10-26T19:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:acer:nitrosense:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86E168E7-AEAA-4424-9A00-934100443DFA", "versionEndExcluding": "3.01.3056", "versionStartIncluding": "3.00.0000"}, {"criteria": "cpe:2.3:a:acer:predatorsense:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DFB5B43-8F0F-46C9-99A2-5750016BE9B0", "versionEndExcluding": "3.00.3198", "versionStartIncluding": "3.00.0000"}], "operator": "OR"}]}], "sourceIdentifier": "8fc372e3-d9c5-46e4-9410-38469745c639"}