Description
QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges.
Published: 2026-09-16
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: SYSTEM‑level command execution via local named pipe access
Action: Immediate Patch
AI Analysis

Impact

QND suffers from an improper access control flaw in a named pipe that lets a local attacker with an active Windows session run arbitrary commands with SYSTEM privileges. This is a classic local privilege escalation scenario rooted in CWE-782. The attacker can gain full control of the machine and compromise all applications run on that system.

Affected Systems

The affected products are QualitySoft Corporation QND Advance, QND Premium, and QND Standard. Specific affected versions were not supplied, so any unpatched version within these families may be vulnerable.

Risk and Exploitability

The flaw carries a CVSS score of 8.7, indicating high severity. The EPSS score is 1%, suggesting a low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would require local access to the machine and would exploit the named pipe mechanism; upon success they could elevate privileges to SYSTEM, enabling full control over the system.

Generated by OpenCVE AI on September 18, 2026 at 10:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade QND to the latest vendor release that resolves the named pipe access control issue.
  • If a patch is not yet available, restrict ACLs on the vulnerable named pipe to the system account and remove access for other user accounts.
  • Continuously monitor for unauthorized process creation and enforce least‑privilege policies on accounts that have local login capability.

Generated by OpenCVE AI on September 18, 2026 at 10:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Qualitysoft
Qualitysoft qnd Advance
Qualitysoft qnd Premium
Qualitysoft qnd Standard
Vendors & Products Qualitysoft
Qualitysoft qnd Advance
Qualitysoft qnd Premium
Qualitysoft qnd Standard

Fri, 18 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
Title Improper Access Control in QND Named Pipe Enables SYSTEM‑level Command Execution

Wed, 16 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Title Improper Access Control in QND Named Pipe Enables SYSTEM‑level Command Execution

Wed, 16 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Description QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges.
Weaknesses CWE-782
References
Metrics cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Qualitysoft Qnd Advance Qnd Premium Qnd Standard
cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2026-09-16T14:56:14.956Z

Reserved: 2026-09-10T06:51:56.985Z

Link: CVE-2026-84408

cve-icon Vulnrichment

Updated: 2026-09-16T14:56:09.650Z

cve-icon NVD

Status : Deferred

Published: 2026-09-16T08:16:40.060

Modified: 2026-09-16T19:27:25.623

Link: CVE-2026-84408

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T21:51:58Z

Weaknesses
  • CWE-782

    Exposed IOCTL with Insufficient Access Control