Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for ESET Endpoint Encryption by ESET spol. s.r.o.

    CVE-2026-75882 (GCVE-0-2026-75882)

    Vulnerability from nvd – Published: 2026-10-30 12:40 – Updated: 2026-10-30 15:22
    VLAI
    Title
    Improper access control vulnerability in ESET Encryption products for Windows
    Summary
    An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests.
    Severity
    8.5 (High)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-30 15:22 UTC
    CWE
    • CWE-284 - Improper access control
    Assigner
    ESET CNA under the ENISA root
    CNA scorecard – unranked: 7 records in the last 180 days, 10 needed details
    References
    Impacted products
    Date Public
    2026-10-29 14:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T15:22:37.244525Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T15:22:56.675Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "ESET Endpoint Encryption",
          "vendor": "ESET spol. s.r.o.",
          "versions": [
            {
              "changes": [
                {
                  "at": "5.4.29.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.4.23.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "ESET Full Disk Encryption",
          "vendor": "ESET spol. s.r.o.",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.4.8.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.4.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-10-29T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow\u0026nbsp;attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests."
            }
          ],
          "value": "An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow\u00a0attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper access control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:40:44.859Z",
        "orgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
        "shortName": "ESET"
      },
      "references": [
        {
          "url": "https://support.eset.com/en/ca9033-eset-customer-advisory-improper-access-control-vulnerability-in-eset-encryption-products-for-windows-fixed"
        }
      ],
      "source": {
        "advisory": "ca9033",
        "discovery": "UNKNOWN"
      },
      "title": "Improper access control vulnerability in ESET Encryption products for Windows",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
    "assignerShortName": "ESET",
    "cveId": "CVE-2026-75882",
    "datePublished": "2026-10-30T12:40:44.859Z",
    "dateReserved": "2026-08-18T13:09:15.899Z",
    "dateUpdated": "2026-10-30T15:22:56.675Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75882 (GCVE-0-2026-75882)

    Vulnerability from cvelistv5 – Published: 2026-10-30 12:40 – Updated: 2026-10-30 15:22
    VLAI
    Title
    Improper access control vulnerability in ESET Encryption products for Windows
    Summary
    An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests.
    Severity
    8.5 (High)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-30 15:22 UTC
    CWE
    • CWE-284 - Improper access control
    Assigner
    ESET CNA under the ENISA root
    CNA scorecard – unranked: 7 records in the last 180 days, 10 needed details
    References
    Impacted products
    Date Public
    2026-10-29 14:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T15:22:37.244525Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T15:22:56.675Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "ESET Endpoint Encryption",
          "vendor": "ESET spol. s.r.o.",
          "versions": [
            {
              "changes": [
                {
                  "at": "5.4.29.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.4.23.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "ESET Full Disk Encryption",
          "vendor": "ESET spol. s.r.o.",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.4.8.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.4.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-10-29T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow\u0026nbsp;attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests."
            }
          ],
          "value": "An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow\u00a0attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper access control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:40:44.859Z",
        "orgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
        "shortName": "ESET"
      },
      "references": [
        {
          "url": "https://support.eset.com/en/ca9033-eset-customer-advisory-improper-access-control-vulnerability-in-eset-encryption-products-for-windows-fixed"
        }
      ],
      "source": {
        "advisory": "ca9033",
        "discovery": "UNKNOWN"
      },
      "title": "Improper access control vulnerability in ESET Encryption products for Windows",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
    "assignerShortName": "ESET",
    "cveId": "CVE-2026-75882",
    "datePublished": "2026-10-30T12:40:44.859Z",
    "dateReserved": "2026-08-18T13:09:15.899Z",
    "dateUpdated": "2026-10-30T15:22:56.675Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}