CCleaner LPE to SYSTEM Bug: Patch Now, Maximum Risk on Shared Endpoints

On August 13, 2026, the TrendAI Zero Day Initiative vulnerability coordination program published advisory ZDI-26-565, documenting a privilege escalation flaw in the Uninstaller component of Gen Digital's CCleaner. The vulnerability, cataloged as CVE-2026-12410 with a CVSS score of 7.8, allows an attacker with local access and standard user privileges to escalate to SYSTEM, the highest level in the Windows operating system. The report to the vendor dates back to February 12, 2026: 182 days passed before coordinated release.

CCleaner is installed on millions of consumer and enterprise endpoints. A bug in the uninstallation mechanism, an apparently mundane function, therefore exposes shared workstations, terminal servers, and multi-user environments to total compromise, where any local account can become an attack vector.

The Mechanism: How a Junction Compromises SYSTEM

The specific defect lies in the handling of symbolic links and junction points during the uninstallation operation. The CCleaner Uninstaller component, executed with elevated privileges, follows the resolved path without verifying the link's actual destination. According to the ZDI advisory, an attacker creates a junction that redirects the application data folder deletion operation toward arbitrary system files. The subsequent race condition allows abusing the service to delete critical files and ultimately execute code in the context of SYSTEM.

The CWE-59 classification — Improper Link Resolution Before File Access — confirms the structural nature of the defect: the software fails to properly resolve links before accessing the file, a recurring bug category in components operating with higher privileges than the caller. In this case, the mismatch between the Uninstaller process integrity level and the standard user's ability to manipulate the filesystem structure creates the attack condition.

"The specific flaw exists within the Uninstaller functionality. By creating a junction, an attacker can abuse the service to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM."

The Timeline: 182 Days Between Report and Coordinated Disclosure

The temporal details of the case show a typical coordination cycle for the ZDI program. The vulnerability was reported to the vendor on February 12, 2026. Coordinated publication occurred on August 13, 2026, with a six-month window for fix development and release. Gen Digital confirmed the release of an update through the same ZDI channel, although the advisory does not specify whether distribution occurs via automatic update or requires manual user intervention.

The researcher remains anonymous, credited as "Anonymous working with TrendAI Zero Day Initiative." This practice, common in the ZDI program, does not affect the technical verifiability of the report, which includes mechanism description, patch confirmation, and reproducibility of the vulnerable behavior.

Real Risk: Who Is Exposed and Why

The operational impact focuses on environments where CCleaner is deployed as a standard maintenance utility and where multiple users share the same machine. Terminal servers, shared workstations in production departments, and corporate endpoints with local accounts for guests or vendors represent the maximum risk profile. First-stage malware, even with minimal privileges, can exploit this flaw to gain total system persistence.

The vector requires no user interaction (UI:N in the CVSS vector) nor complex network conditions: the attacker only needs to execute low-privileged code on the target machine. This significantly lowers the barrier to entry. The severity is further amplified by the nature of the software: CCleaner is a system "cleanup" tool, perceived as benign and often exempt from the strictest whitelisting policies.

What to Do Now

• Verify the installed version: open CCleaner and check that the build is 7.10.1464 or later, as indicated in the official CVE record.
• If the version is earlier, download the update directly from the Gen Digital portal; the dossier does not confirm whether automatic update distributes the patch, so a manual check is prudent.
• In enterprise environments, verify the inventory of CCleaner installations through endpoint management tools and schedule the update with priority on terminal servers and multi-user workstations.
• Limit exposure: where CCleaner is not an essential tool, evaluate removal on endpoints with high risk of access from non-privileged accounts, pending patch deployment.

The Paradox of Maintenance Utilities

The lesson of the CCleaner case is not solely technical. Software designed to "clean" the system, removing temporary files and optimizing the registry, becomes a vector for total contamination precisely through the uninstallation function. The component that should remove unwanted traces instead exposes the system to arbitrary file deletion and complete compromise.

This pattern repeats in legacy maintenance tools that incorporate components with implicit privilege elevation. The user installs CCleaner to free up space; the attacker exploits it to conquer SYSTEM. The discrepancy between risk perception and real impact is what makes this vulnerability particularly insidious for IT departments managing heterogeneous fleets.

FAQ

Is the vulnerability remotely exploitable?

No. The CVSS vector indicates AV:L (Attack Vector: Local). The attacker must already have the ability to execute code on the target machine with standard user privileges.

Is CCleaner on macOS or Linux vulnerable?

No. The CVE record explicitly specifies "CCleaner prior to 7.10.1464 on Windows." No evidence of impact on other platforms emerges.

Is there evidence of active exploitation in the wild?

The dossier does not document active exploitation. The ZDI program proceeded with coordinated disclosure with a patch available, but it is not specified whether the vulnerability was observed in real-world attacks prior to publication.

Information has been verified against cited sources and updated at the time of publication.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-565/
• http://www.zerodayinitiative.com/advisories/published/
• https://www.cve.org/CVERecord?id=CVE-2026-12410
• http://www.zerodayinitiative.com/advisories/upcoming/
• https://www.trendmicro.com/
• https://www.trendmicro.com/en_us/business/products/one-platform.html