{"id":"CVE-2026-107707","published":"2026-10-08T20:17:35.690","lastModified":"2026-10-09T15:17:08.810","description":"Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-59"],"vendors":[],"products":[],"references":[{"url":"https://blog.quarkslab.com/milking-the-last-drop-of-intego-time-for-windows-to-get-its-lpe.html","tags":[]},{"url":"https://www.intego.com/","tags":[]},{"url":"https://www.vulncheck.com/advisories/intego-antivirus-through-3.0.0.1-local-privilege-escalation-via-optimization-module-junction","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A local unprivileged user can exploit a link following vulnerability in Intego Antivirus's optimization module to delete arbitrary folders as SYSTEM by replacing a scanned file's directory with a junction to C:\\Config.msi and leveraging Windows Installer rollback functionality.","exploitability":"Exploitation requires local access and involves creating a junction point that triggers Windows Installer rollback, making it moderately difficult but possible for attackers with low privileges.","blast_radius":"If exploited, this vulnerability could allow attackers to delete critical system folders and potentially execute arbitrary code as SYSTEM, affecting all Windows systems running Intego Antivirus 3.0.0.1 or earlier.","remediation":"Upgrade to version 3.0.0.2 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","windows","file-deletion","installer"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:21:46.506Z"}}