Description
A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM.
Published: 2026-10-15
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

A local privilege escalation vulnerability exists in TotalAV that allows a non‑privileged local user to forge the authentication token used by the gRPC IPC interface. By loading the IPC.dll file and abusing the SYSTEM service embedded within TotalAV, the attacker can execute arbitrary code with the SYSTEM account, granting complete control over the affected machine.

Affected Systems

The vulnerability affects the TotalSecurity:TotalAV product. Specific version numbers are not listed, so any installation that includes the gRPC IPC component and the SYSTEM service within TotalAV is potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity flaw. The EPSS score of less than 1% indicates a very low current exploitation probability, and the issue is not listed in the CISA KEV catalog. Exploitation requires a local user capable of loading DLLs; once the authentication token is forged, code can run as SYSTEM. The attack vector is local privilege escalation.

Generated by OpenCVE AI on October 16, 2026 at 21:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑provided patch or upgrade to a non‑vulnerable release of TotalAV.
  • Use AppLocker or Software Restriction Policies to prevent local users from loading IPC.dll from the TotalAV directory.
  • Enable auditing on the SYSTEM service and gRPC IPC calls to detect unauthorized DLL usage and limit non‑admin account access.

Generated by OpenCVE AI on October 16, 2026 at 21:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Totalsecurity
Totalsecurity totalav
Vendors & Products Totalsecurity
Totalsecurity totalav

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-22
CWE-23
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM.
Title CVE-2026-110746
References

Subscriptions

Totalsecurity Totalav
cve-icon MITRE

Status: PUBLISHED

Assigner: certcc

Published:

Updated: 2026-10-15T15:17:16.739Z

Reserved: 2026-10-14T16:22:00.651Z

Link: CVE-2026-110746

cve-icon Vulnrichment

Updated: 2026-10-15T15:16:30.318Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-15T15:17:28.487

Modified: 2026-10-16T16:00:33.533

Link: CVE-2026-110746

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T13:06:48Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-23

    Relative Path Traversal