Description
a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a ‘wtsapi32.dll’ file in the ‘C:\ProgramData\Evope\’ directory. The ‘Evope.Service.exe’ component, which runs with ‘NT AUTHORITY\SYSTEM’ privileges, loads this DLL without properly verifying its integrity or origin. Successful exploitation could allow code execution with SYSTEM privileges and result in local privilege escalation.
Published: 2026-09-24
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Local Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

A flaw in Evope Collector that allows a local attacker with no elevated rights to place an arbitrary DLL in the software’s data directory. The Evope.Service.exe service runs under the SYSTEM account and loads this DLL without validating its origin or integrity. This results in code execution with SYSTEM privileges, enabling malicious actors to modify, delete, or steal data and to persist on the system. The weakness is an uncontrolled search path element (CWE‑1135).

Affected Systems

The vulnerability affects Evope Collector releases prior to 1.1.7.13, specifically version 1.1.6.9.0 and earlier. The affected component is the Evope.Service.exe Windows service that operates with NT AUTHORITY\SYSTEM privileges.

Risk and Exploitability

The high severity CVSS score of 7.5 classifies this as a significant local privilege escalation. EPSS data is unavailable, so the exact likelihood of exploitation is unknown, but the flaw requires only local access and no special privileges. The vulnerability is not listed in CISA’s KEV catalog. An attacker who can drop a DLL into the designated folder can achieve SYSTEM level code execution with minimal effort, making the issue highly actionable.

Generated by OpenCVE AI on September 24, 2026 at 12:50 UTC.

Remediation

Vendor Solution

The vulnerability has been fixed by Evope team in version 1.1.7.13.

OpenCVE Recommended Actions

  • Upgrade Evope Collector to version 1.1.7.13, which implements the proper DLL load validation.
  • Remove any malicious or suspicious DLLs, such as wtsapi32.dll, from C:\ProgramData\Evope\ prior to applying the patch to eliminate the attack surface.
  • Restrict write permissions on the C:\ProgramData\Evope\ directory so that only the SYSTEM account or trusted administrators can place files there, preventing non‑privileged users from dropping malicious DLLs.
  • Perform a malware scan of the host to detect and remove any injected DLLs or malicious code that may have been introduced before remediation.

Generated by OpenCVE AI on September 24, 2026 at 12:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1135

Thu, 24 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Description a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a ‘wtsapi32.dll’ file in the ‘C:\ProgramData\Evope\’ directory. The ‘Evope.Service.exe’ component, which runs with ‘NT AUTHORITY\SYSTEM’ privileges, loads this DLL without properly verifying its integrity or origin. Successful exploitation could allow code execution with SYSTEM privileges and result in local privilege escalation.
Title Uncontrolled Search Path Element in Evope Collector
First Time appeared Evope Collector
Evope Collector evope Collector
CPEs cpe:2.3:a:evope_collector:evope_collector:1.1.6.9.0:*:*:*:*:*:*:*
Vendors & Products Evope Collector
Evope Collector evope Collector
References
Metrics cvssV4_0

{'score': 7.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Evope Collector Evope Collector
cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published:

Updated: 2026-09-24T12:11:48.604Z

Reserved: 2026-04-27T07:40:53.476Z

Link: CVE-2026-7169

cve-icon Vulnrichment

Updated: 2026-09-24T12:11:37.385Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T12:17:12.973

Modified: 2026-09-24T14:45:22.827

Link: CVE-2026-7169

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T13:00:14Z

Weaknesses