SWUpdate prior to the 2026.05 release contains a TOCTOU race condition that allows a local, unprivileged user to trigger the installation of a signed update. By exploiting this race, the attacker can have arbitrary scripts executed during the update process or even gain root privileges. The flaw is documented as CWE‑367, a classic race condition that manipulates timing between checking a condition and using its result.

The vulnerability affects all installations of SWUpdate from its earliest releases up to, but not including, version 2026.05. This includes any vendor that relies on the open‑source SWUpdate package, as the flaw resides in the core update logic rather than in a single product variant.

The CVSS score of 7.3 indicates a high severity, while the EPSS score is not available, suggesting limited data on exploitation likelihood. The vulnerability is not yet listed in the CISA KEV catalog. Attackers must have local, unprivileged access to the host, but the race condition permits escalation to root once the attacker manipulates the signed update sequence. Because the exploit targets signed updates, an attacker can also introduce untrusted content that the system believes originates from a trusted source.