CVE-2026-110746
7.8HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-22, CWE-23
Impact
Local unprivileged users can execute arbitrary code as NT AUTHORITY\SYSTEM. An attacker needs local access and existing credentials on the target Windows host.
Root cause
Improper path handling and weak IPC authentication allow local users to load IPC.dll and forge gRPC authentication tokens accepted by the privileged background service.
Affected systems
TotalAV 7.1.17 (exact additional version ranges not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade TotalAV to a version newer than 7.1.17 once released by the vendor; if patching is delayed, stop and disable the TotalAV SYSTEM background services on affected hosts.
$ Get-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object { $_.DisplayName -like '*TotalAV*' } | Select-Object DisplayName, DisplayVersionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM.