CVE-2018-10722 - In Cylance CylancePROTECT before 1470, an unprivileged local user can obtain SYSTEM privileges because users have Modify access to the %PROGRAMFILES%\Cylance\Desktop\log folder, the CyUpdate process grants users Modify access to new files created in this folder, and a new file can be a symlink chain to a pathname of an arbitrary DLL that CyUpdate uses

Back Back to CVE browser

HIGH

In Cylance CylancePROTECT before 1470, an unprivileged local user can obtain SYSTEM privileges because users have Modify access to the %PROGRAMFILES%\Cylance\Desktop\log folder, the CyUpdate process grants users Modify access to new files created in this folder, and a new file can be a symlink chain to a pathname of an arbitrary DLL that CyUpdate uses

Published May 4, 2018

7.8

HIGH

CVSS 3.0

EPSS 0.54%

Description

In Cylance CylancePROTECT before 1470, an unprivileged local user can obtain SYSTEM privileges because users have Modify access to the %PROGRAMFILES%\Cylance\Desktop\log folder, the CyUpdate process grants users Modify access to new files created in this folder, and a new file can be a symlink chain to a pathname of an arbitrary DLL that CyUpdate uses.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-59

References (1)

https://www.atredis.com/blog/cylance-privilege-escalation-vulnerability
x_refsource_MISCExploitTechnical DescriptionThird Party Advisory

Link	Providers	Tags
https://www.atredis.com/blog/cylance-privilege-escalation-vulnerability		x_refsource_MISCExploitTechnical DescriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published May 4, 2018

Updated Aug 5, 2024

Reserved May 3, 2018

Link CVE-2018-10722

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-10722

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-10722