🔐 CVE Alert

CVE-2026-107707

HIGH 7.8

Intego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Junction

CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th

Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.

CWE CWE-59
Vendor intego
Product intego antivirus
Published Oct 8, 2026
Stay Ahead of the Next One

Get instant alerts for intego intego antivirus

Be the first to know when new high vulnerabilities affecting intego intego antivirus are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected Versions

Intego / Intego Antivirus
0 ≤ 3.0.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗
blog.quarkslab.com: https://blog.quarkslab.com/milking-the-last-drop-of-intego-time-for-windows-to-get-its-lpe.html intego.com: https://www.intego.com/ vulncheck.com: https://www.vulncheck.com/advisories/intego-antivirus-through-3.0.0.1-local-privilege-escalation-via-optimization-module-junction

Credits

Lucas Laise of Quarkslab