CVE-2026-110359

7.8High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.8High

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-276

Impact

Local unprivileged users can gain full SYSTEM privileges on Windows hosts running this service. Exploitation requires existing local shell or desktop access to the machine.

Root cause

The application runs a privileged service out of a ProgramData directory configured with insecure folder permissions, allowing standard users to modify executable binaries.

Affected systems

Hyland Desktop Host for Windows versions prior to 25.1.1

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Hyland Desktop Host to version 25.1.1 or later. As an interim workaround, restrict NTFS permissions on "%PROGRAMDATA%\Hyland\DesktopHost\bin" to allow write access only to Administrators and SYSTEM.

shell

$ icacls "%PROGRAMDATA%\Hyland\DesktopHost\bin" /inheritance:r /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F /grant:r Users:(OI)(CI)RX

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges.

References

https://github.com/JNDataRT/Vulns/blob/main/Advisories/2026/1.md

Source: nvd.nist.gov/vuln/detail/CVE-2026-110359