Exposure of resource to wrong sphere in Kaspersky Secure Connection, Kaspersky Internet…
Priority LOW 31CWE-668Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud prior to version 2020 patch E have bug that allows a local user to execute arbitrary code via execution compromised file placed by an attacker with administrator rights. No privilege escalation. Possible whitelisting bypass some of the security products
Why it matters now
EPSS 0.00766 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kaspersky | Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud | prior to version 2020 patch E | — | No fix listed | CNA |
- Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud VendorKaspersky Affected prior to version 2020 patch E Fixed in — No fix listed CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kaspersky:kaspersky_internet_security:2019:-:*:*:*:*:*:* | 2019 | Vulnerable | Kaspersky |
| cpe:2.3:a:kaspersky:kaspersky_internet_security:2019:patch_f:*:*:*:*:*:* | 2019 patch_f | Vulnerable | Kaspersky |
| cpe:2.3:a:kaspersky:kaspersky_internet_security:2019:patch_i:*:*:*:*:*:* | 2019 patch_i | Vulnerable | Kaspersky |
| cpe:2.3:a:kaspersky:kaspersky_internet_security:2019:patch_j:*:*:*:*:*:* | 2019 patch_j | Vulnerable | Kaspersky |
| cpe:2.3:a:kaspersky:secure_connection:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Kaspersky |
| cpe:2.3:a:kaspersky:secure_connection:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Kaspersky |
| cpe:2.3:a:kaspersky:security_cloud:2019:-:*:*:*:*:*:* | 2019 | Vulnerable | Kaspersky |
| cpe:2.3:a:kaspersky:security_cloud:2019:patch_i:*:*:*:*:*:* | 2019 patch_i | Vulnerable | Kaspersky |
| cpe:2.3:a:kaspersky:security_cloud:2019:patch_j:*:*:*:*:*:* | 2019 patch_j | Vulnerable | Kaspersky |
| cpe:2.3:a:kaspersky:security_cloud:2020:-:*:*:*:*:*:* | 2020 | Vulnerable | Kaspersky |
- cpe:2.3:a:kaspersky:kaspersky_internet_security:2019:-:*:*:*:*:*:* Versions 2019 Vulnerable ·Kaspersky
- cpe:2.3:a:kaspersky:kaspersky_internet_security:2019:patch_f:*:*:*:*:*:* Versions 2019 patch_f Vulnerable ·Kaspersky
- cpe:2.3:a:kaspersky:kaspersky_internet_security:2019:patch_i:*:*:*:*:*:* Versions 2019 patch_i Vulnerable ·Kaspersky
- cpe:2.3:a:kaspersky:kaspersky_internet_security:2019:patch_j:*:*:*:*:*:* Versions 2019 patch_j Vulnerable ·Kaspersky
- cpe:2.3:a:kaspersky:secure_connection:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Kaspersky
- cpe:2.3:a:kaspersky:secure_connection:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Kaspersky
- cpe:2.3:a:kaspersky:security_cloud:2019:-:*:*:*:*:*:* Versions 2019 Vulnerable ·Kaspersky
- cpe:2.3:a:kaspersky:security_cloud:2019:patch_i:*:*:*:*:*:* Versions 2019 patch_i Vulnerable ·Kaspersky
- cpe:2.3:a:kaspersky:security_cloud:2019:patch_j:*:*:*:*:*:* Versions 2019 patch_j Vulnerable ·Kaspersky
- cpe:2.3:a:kaspersky:security_cloud:2020:-:*:*:*:*:*:* Versions 2020 Vulnerable ·Kaspersky
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kaspersky:total_security:2019:-:*:*:*:*:*:* | 2019 | Vulnerable | Kaspersky |
| cpe:2.3:a:kaspersky:total_security:2019:patch_f:*:*:*:*:*:* | 2019 patch_f | Vulnerable | Kaspersky |
| cpe:2.3:a:kaspersky:total_security:2019:patch_i:*:*:*:*:*:* | 2019 patch_i | Vulnerable | Kaspersky |
| cpe:2.3:a:kaspersky:total_security:2019:patch_j:*:*:*:*:*:* | 2019 patch_j | Vulnerable | Kaspersky |
| cpe:2.3:a:kaspersky:total_security:2020:*:*:*:*:*:*:* | 2020 | Vulnerable | Kaspersky |
- cpe:2.3:a:kaspersky:total_security:2019:-:*:*:*:*:*:* Versions 2019 Vulnerable ·Kaspersky
- cpe:2.3:a:kaspersky:total_security:2019:patch_f:*:*:*:*:*:* Versions 2019 patch_f Vulnerable ·Kaspersky
- cpe:2.3:a:kaspersky:total_security:2019:patch_i:*:*:*:*:*:* Versions 2019 patch_i Vulnerable ·Kaspersky
- cpe:2.3:a:kaspersky:total_security:2019:patch_j:*:*:*:*:*:* Versions 2019 patch_j Vulnerable ·Kaspersky
- cpe:2.3:a:kaspersky:total_security:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·Kaspersky
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-15689
- 2026-10-03 Alias added: GHSA-6gm8-22cp-c564
References
More Kaspersky Internet Security vulnerabilities
- TI-2006-02977 klif.sys in Kaspersky Internet Security 6.0 and 7.0, Kaspersky Anti-Virus (KAV) 6.0 and… CVSS 2.0MEDIUM 5.0
- TI-2009-02825 avp.exe in Kaspersky Internet Security 9.0.0.459 and Anti-Virus 9.0.0.463 allows remote… CVSS 2.0MEDIUM 4.3
- TI-2009-02529 Unspecified vulnerability in Kaspersky Anti-Virus 2010 and Kaspersky Internet Security… CVSS 2.0MEDIUM 5.0
- TI-2014-04608 The Kaspersky Internet Security (aka com.kms.free) application 11.4.4.232 for Android… CVSS 2.0MEDIUM 5.4
Sources
- CVE-2019-15689 · CVE Program
- CVE-2019-15689 · NVD
- FIRST EPSS
- GHSA-6gm8-22cp-c564 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences