The vulnerability CVE-2026-41030 affects Ascensio ONLYOFFICE DesktopEditors prior to version 9.3.0. It arises from the update service permitting unauthorized actions on files with SYSTEM-level privileges, which constitutes an incorrect resource transfer between security spheres (CWE-669). The CVSS 3.1 score is 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating a medium severity vulnerability that can cause denial of service or disruption of availability without compromising confidentiality or integrity. No patch or official remediation level has been disclosed by the vendor as of the published date. The vulnerability is local attack vector, does not require privileges or user interaction, and no known exploits have been reported.

An attacker with local access can leverage the update service to perform actions on files with SYSTEM privileges, potentially leading to denial of service or disruption of availability on the affected system. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for vendor updates and avoid running untrusted code locally. No cloud service is involved, so vendor-managed remediation does not apply.