CVE-2026-107782: Incorrect Authorization in winsiderss System Informer
Description
System Informer versions before 4.0.26241.138 contain an incorrect authorization vulnerability in the phsvc helper. This flaw allows local attackers to access privileged APIs by connecting from any Authenticode-signed process. Exploitation involves loading code into a Microsoft-signed host process such as rundll32.exe and invoking the PhSvcApiCreateService function to execute code with SYSTEM privileges.
CVSS v4.0
Score 8.5high
Affected software
winsiderss
System Informer
pkg:github/System InformerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-107782 is an incorrect authorization vulnerability in the phsvc helper component of System Informer prior to version 4.0.26241.138. The vulnerability permits local attackers with limited privileges to connect from any Authenticode-signed process to privileged APIs. By loading code into a Microsoft-signed host process like rundll32.exe and connecting to the SiSvcApiPort, attackers can call PhSvcApiCreateService to execute arbitrary code as SYSTEM, effectively escalating their privileges.
Potential Impact
Successful exploitation results in local privilege escalation to SYSTEM level, allowing attackers to execute arbitrary code with the highest system privileges. This can lead to full system compromise depending on the attacker's intent and environment.
Mitigation Recommendations
A fix is available in System Informer version 4.0.26241.138. Users should upgrade to this version or later to remediate the vulnerability. No additional mitigation guidance is provided in the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-08T20:02:31.398Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac7feea2cdf04f656318bdd
Added to database: 10/08/2026, 20:36:58 UTC
Last enriched: 10/08/2026, 21:18:30 UTC
Last updated: 10/08/2026, 21:18:30 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.