CVE-2026-8069CWE-22CWE-269CWE-284CWE-732path-traversalbroken-access-controlprivilege-escalation

CVE-2026-8069

High · published May 8, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
5.4
In the wild
Unconfirmed
What it is

PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY\SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an attacker can execute arbitrary code on the target system with elevated privileges.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00165 · 5.4th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-269 · Improper Privilege Management; CWE-284 · Improper Access Control; CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-05-08T11:16Z
Affected products (2)
ProductVersionsFixed in
acer/nitrosense≥ 3.00.0000, < 3.01.30563.01.3056
acer/predatorsense≥ 3.00.0000, < 3.00.31983.00.3198
References (1)
EPSS history
Timeline
  • 08 MAY 05:57Z
    PredatorSense V3: Local Privilege Escalation (LPE) vulnerability
    cvelistv5