P4Verified

CVE-2026-110746: TotalAV 0 through 7.1.17

CVE-2026-110746. CVSS 3.1 base score 7.8 (HIGH, Source advisory).

Affected technology

TotalAV · 0 through 7.1.17
TotalSecurity

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

An unprivileged local user can forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM. Source advisory’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high.

Published 15-Oct-2026 18:54 UTC

CWE: CWE-22, CWE-23
CCR priority: 31.2 /100 (P4)
CVSS 3.1: 7.8 /10 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · Source advisory
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-15 18:59:14.583303+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-15 18:53:01.928580+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-110746.html