Loading story…
A high-severity local privilege-escalation vulnerability, CVE-2026-50610, affects Acer's System Monitor engine used by NitroSense and PredatorSense on Windows laptops. Vulnerable AcerSysHardwareService.exe versions 1.0.1018.13 and 1.0.1019.0, associated with the NitroSense 5.1.361 engine, run as LocalSystem while exposing named pipes that authenticated standard users can access without adequate authorization or client impersonation checks.
The service's pipe protocol permits arbitrary registry operations as SYSTEM, including writes under HKLM. A proof of concept registers cmd.exe as the debugger for utilman.exe, allowing an attacker with local standard-user access to obtain a pre-login NT AUTHORITY\SYSTEM shell through Windows accessibility functionality. The issue was privately reported to Acer in May 2026; the available reports do not identify a patch, mitigation, or confirmed exploitation in the wild.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Intrinsec privately reported CVE-2026-50610 to Acer under coordinated disclosure. The flaw affects AcerSysHardwareService.exe, used by NitroSense and PredatorSense, and permits local privilege escalation to NT AUTHORITY\SYSTEM through unauthorized named-pipe registry operations.
A Reddit r/netsec post shared Intrinsec's disclosure of CVE-2026-50610, reporting that a standard Windows user on affected Acer laptops could obtain SYSTEM privileges.
Intrinsec published technical details of high-severity CVE-2026-50610, identifying affected AcerSysHardwareService.exe versions 1.0.1018.13 and 1.0.1019.0. A proof of concept writes an IFEO debugger value for utilman.exe, allowing a local standard user to obtain a pre-login SYSTEM command shell.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
STAR Labs disclosed two high-severity local privilege escalation vulnerabilities in **Razer CentralService** affecting **Razer Central 7.11.0.558 and earlier**. The bugs, tracked as `CVE-2023-3513` and `CVE-2023-3514`, allow a low-privileged Windows user to execute code as **SYSTEM** through insecure service design in `RazerCentralService.exe`. One flaw stems from unsafe deserialization of `ConnectedAccounts.bin`, which is decrypted with a hardcoded AES-CBC key and processed with `BinaryFormatter`; the other involves unsafe handling of commands received over a broadly accessible named pipe. According to the advisory, attackers can abuse user-writable paths under `C:\ProgramData\Razer\Razer Central\Accounts` and the service's permissive named pipe access to trigger privileged functionality. STAR Labs said the exposed `UpdateManager` interface includes commands such as `AddModule` and `UninstallModules`, which can be manipulated with malicious XML to create a fake module and launch an attacker-controlled binary as SYSTEM. The researchers reported exploitation can be triggered during login, restart, or directly through the named pipe, and recommended removing `BinaryFormatter`, tightening named pipe permissions, sanitizing untrusted input, and correcting directory permissions.
Jun 29, 2026
Researchers disclosed **CVE-2026-20817**, a local privilege escalation flaw in the Windows Error Reporting (**WER**) service that allows a low-privileged user to obtain **SYSTEM** privileges by sending a crafted **ALPC** message to `\WindowsErrorReportingServicePort`. The bug resides in `WerSvc.dll` and affects the `SvcElevatedLaunch` code path, where user-controlled data from a file-mapping-backed buffer can be passed as command-line arguments when the service launches `WerFault.exe` with `CreateProcessAsUserW` under SYSTEM context. Patch analysis showed Microsoft mitigated the issue by effectively disabling the vulnerable `SvcElevatedLaunch` feature rather than rewriting the logic, with the patched path returning `0x80004005` (`E_FAIL`). Researchers produced a proof of concept demonstrating SYSTEM-context `WerFault.exe` execution with attacker-controlled arguments, although full arbitrary code execution would require additional Windows internals techniques; they also noted operational constraints such as the WER service needing to be running and possible Microsoft Defender detection because the behavior resembles parent process ID spoofing. Reports further warned that fake and potentially malicious GitHub proof-of-concept repositories for **CVE-2026-20817** are already circulating.
Jun 29, 2026
A public proof-of-concept exploit dubbed **MiniPlasma** has been released for a Windows local privilege escalation flaw that can grant attackers **SYSTEM** access on fully patched machines. The exploit targets `cldflt.sys`, the Windows Cloud Files Mini Filter Driver used by cloud sync features such as OneDrive, and specifically abuses the `HsmOsBlockPlaceholderAccess` routine. Researchers said the bug appears tied to **`CVE-2020-17103`**, a vulnerability originally reported by Google Project Zero's James Forshaw in 2020 and believed to have been fixed by Microsoft, but the original exploit path reportedly still works. The exploit abuses missing access checks and a race condition during token switching to create arbitrary registry keys in the `.DEFAULT` user hive and ultimately spawn a SYSTEM shell. Researcher Chaotic Eclipse, also referenced as Nightmare-Eclipse, published the code on GitHub, while Will Dormann reported that it works reliably on Windows 11 systems with the May 2026 updates, though not on the latest Insider Preview Canary builds. Because the affected driver is broadly deployed across Windows environments, the release of reliable public exploit code sharply raises near-term risk while organizations await clarification or a fix from Microsoft.
Jul 1, 2026