Search

Find a vulnerability

Search criteria

    2 vulnerabilities by Pyrus

    CVE-2026-116596 (GCVE-0-2026-116596)

    Vulnerability from nvd – Published: 2026-10-26 16:17 – Updated: 2026-10-26 16:17
    VLAI
    Title
    CVE-2026-116596
    Summary
    Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract.
    Severity
    No CVSS data available.
    CWE
    • CWE-266 - Incorrect Privilege Assignment
    Assigner
    certcc CNA under the mitre root
    CNA scorecard E 42/100 over 160 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Pyrus Pyrus Sync Affected: 0 , < 1.8.745.0 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Pyrus Sync",
          "vendor": "Pyrus",
          "versions": [
            {
              "lessThan": "1.8.745.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-266: Incorrect Privilege Assignment",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T16:17:29.178Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://pyrus.com/en/pyrus-sync"
        },
        {
          "url": "https://medium.com/@alisaifeldin/cve-2026-116596-local-privilege-escalation-in-pyrus-sync-for-windows-0fe2417dc8cf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-116596",
      "x_generator": {
        "engine": "VINCE 3.0.51",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-116596"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-116596",
    "datePublished": "2026-10-26T16:17:29.178Z",
    "dateReserved": "2026-10-26T15:18:49.651Z",
    "dateUpdated": "2026-10-26T16:17:29.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-116596 (GCVE-0-2026-116596)

    Vulnerability from cvelistv5 – Published: 2026-10-26 16:17 – Updated: 2026-10-26 16:17
    VLAI
    Title
    CVE-2026-116596
    Summary
    Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract.
    Severity
    No CVSS data available.
    CWE
    • CWE-266 - Incorrect Privilege Assignment
    Assigner
    certcc CNA under the mitre root
    CNA scorecard E 42/100 over 160 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Pyrus Pyrus Sync Affected: 0 , < 1.8.745.0 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Pyrus Sync",
          "vendor": "Pyrus",
          "versions": [
            {
              "lessThan": "1.8.745.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-266: Incorrect Privilege Assignment",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T16:17:29.178Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://pyrus.com/en/pyrus-sync"
        },
        {
          "url": "https://medium.com/@alisaifeldin/cve-2026-116596-local-privilege-escalation-in-pyrus-sync-for-windows-0fe2417dc8cf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-116596",
      "x_generator": {
        "engine": "VINCE 3.0.51",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-116596"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-116596",
    "datePublished": "2026-10-26T16:17:29.178Z",
    "dateReserved": "2026-10-26T15:18:49.651Z",
    "dateUpdated": "2026-10-26T16:17:29.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}