Read the docs
TI-2024-00320 Aliases CVE-2024-0353GHSA-8m6h-q36w-xvg7

Local privilege escalation in Windows products

Priority LOW 37CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00551 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ESET, spol. s r.o.ESET NOD32 Antivirusup to 16.2.15.0—No fix listedCNA
ESET, spol. s r.o.ESET Internet Securityup to 16.2.15.0—No fix listedCNA
ESET, spol. s r.o.ESET Smart Security Premiumup to 16.2.15.0—No fix listedCNA
ESET, spol. s r.o.ESET Security Ultimateup to 16.2.15.0—No fix listedCNA
ESET, spol. s r.o.ESET Endpoint Antivirus for Windowsup to 10.1.2058.0; up to 10.0.2049.0; up to 9.1.2066.0; up to 8.1.2052.0—No fix listedCNA
ESET, spol. s r.o.ESET Endpoint Security for Windowsup to 10.1.2058.0; up to 10.0.2049.0; up to 9.1.2066.0; up to 8.1.2052.0—No fix listedCNA
ESET, spol. s r.o.ESET Server Security for Windows Serverup to 10.0.12014.0; up to 9.0.12018.0; up to 8.0.12015.0; up to 7.3.12011.0—No fix listedCNA
ESET, spol. s r.o.ESET Mail Security for Microsoft Exchange Serverup to 10.1.10010.0; up to 10.0.10017.0; up to 9.0.10011.0; up to 8.0.10022.0; up to 7.3.10014.0—No fix listedCNA
ESET, spol. s r.o.ESET Mail Security for IBM Dominoup to 10.0.14006.0; up to 9.0.14007.0; up to 8.0.14010.0; up to 7.3.14004.0—No fix listedCNA
ESET, spol. s r.o.ESET Security for Microsoft SharePoint Serverup to 10.0.15004.0; up to 9.0.15005.0; up to 8.0.15011.0; up to 7.3.15004.0—No fix listedCNA
ESET, spol. s r.o.ESET File Security for Microsoft Azureup to all versions—No fix listedCNA
  • ESET NOD32 Antivirus VendorESET, spol. s r.o. Affected up to 16.2.15.0 Fixed in — No fix listed CNA
  • ESET Internet Security VendorESET, spol. s r.o. Affected up to 16.2.15.0 Fixed in — No fix listed CNA
  • ESET Smart Security Premium VendorESET, spol. s r.o. Affected up to 16.2.15.0 Fixed in — No fix listed CNA
  • ESET Security Ultimate VendorESET, spol. s r.o. Affected up to 16.2.15.0 Fixed in — No fix listed CNA
  • ESET Endpoint Antivirus for Windows VendorESET, spol. s r.o. Affected up to 10.1.2058.0; up to 10.0.2049.0; up to 9.1.2066.0; up to 8.1.2052.0 Fixed in — No fix listed CNA
  • ESET Endpoint Security for Windows VendorESET, spol. s r.o. Affected up to 10.1.2058.0; up to 10.0.2049.0; up to 9.1.2066.0; up to 8.1.2052.0 Fixed in — No fix listed CNA
  • ESET Server Security for Windows Server VendorESET, spol. s r.o. Affected up to 10.0.12014.0; up to 9.0.12018.0; up to 8.0.12015.0; up to 7.3.12011.0 Fixed in — No fix listed CNA
  • ESET Mail Security for Microsoft Exchange Server VendorESET, spol. s r.o. Affected up to 10.1.10010.0; up to 10.0.10017.0; up to 9.0.10011.0; up to 8.0.10022.0; up to 7.3.10014.0 Fixed in — No fix listed CNA
  • ESET Mail Security for IBM Domino VendorESET, spol. s r.o. Affected up to 10.0.14006.0; up to 9.0.14007.0; up to 8.0.14010.0; up to 7.3.14004.0 Fixed in — No fix listed CNA
  • ESET Security for Microsoft SharePoint Server VendorESET, spol. s r.o. Affected up to 10.0.15004.0; up to 9.0.15005.0; up to 8.0.15011.0; up to 7.3.15004.0 Fixed in — No fix listed CNA
  • ESET File Security for Microsoft Azure VendorESET, spol. s r.o. Affected up to all versions Fixed in — No fix listed CNA

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:windows:*:*before 8.1.2062.0; 9.0 to before 9.1.2071.0; 10.0 to before 10.0.2052.0; 10.1 to before 10.1.2063.0; 11.0 to before 11.0.2032.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:windows:*:*before 8.1.2062.0; 9.0 to before 9.1.2071.0; 10.0 to before 10.0.2052.0; 10.1 to before 10.1.2063.0; 11.0 to before 11.0.2032.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:file_security:*:*:*:*:*:azure:*:*all versionsVulnerableESET, spol. s r.o.
cpe:2.3:a:eset:internet_security:*:*:*:*:*:*:*:*before 17.0.10.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:*before 7.3.10018.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:mail_security:*:*:*:*:*:domino:*:*before 7.3.14006.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:*8.0 to before 8.0.10024.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:mail_security:*:*:*:*:*:domino:*:*8.0 to before 8.0.14014.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:*9.0 to before 9.0.10012.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:mail_security:*:*:*:*:*:domino:*:*9.0 to before 9.0.14008.0VulnerableESET, spol. s r.o.
  • cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:windows:*:* Versions before 8.1.2062.0; 9.0 to before 9.1.2071.0; 10.0 to before 10.0.2052.0; 10.1 to before 10.1.2063.0; 11.0 to before 11.0.2032.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:endpoint_security:*:*:*:*:*:windows:*:* Versions before 8.1.2062.0; 9.0 to before 9.1.2071.0; 10.0 to before 10.0.2052.0; 10.1 to before 10.1.2063.0; 11.0 to before 11.0.2032.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:file_security:*:*:*:*:*:azure:*:* Versions all versions Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:internet_security:*:*:*:*:*:*:*:* Versions before 17.0.10.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:* Versions before 7.3.10018.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:mail_security:*:*:*:*:*:domino:*:* Versions before 7.3.14006.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:* Versions 8.0 to before 8.0.10024.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:mail_security:*:*:*:*:*:domino:*:* Versions 8.0 to before 8.0.14014.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:* Versions 9.0 to before 9.0.10012.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:mail_security:*:*:*:*:*:domino:*:* Versions 9.0 to before 9.0.14008.0 Vulnerable ·ESET, spol. s r.o.
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:*10.0 to before 10.0.10018.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:mail_security:*:*:*:*:*:domino:*:*10.0 to before 10.0.14007.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:*10.1 to before 10.1.10014.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:*:*:*before 17.0.10.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:security:*:*:*:*:*:sharepoint_server:*:*before 7.3.15006.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:security:*:*:*:*:ultimate:*:*:*before 17.0.10.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:security:*:*:*:*:*:sharepoint_server:*:*8.0 to before 8.0.15012.0; 9.0 to before 9.0.15006.0; 10.0 to before 10.0.15005.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:server_security:*:*:*:*:*:windows_server:*:*before 7.3.12013.0; 8.0 to before 8.0.12016.0; 9.0 to before 9.0.12019.0; 10.0 to before 10.0.12015.0VulnerableESET, spol. s r.o.
cpe:2.3:a:eset:smart_security:*:*:*:*:premium:*:*:*before 17.0.10.0VulnerableESET, spol. s r.o.
  • cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:* Versions 10.0 to before 10.0.10018.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:mail_security:*:*:*:*:*:domino:*:* Versions 10.0 to before 10.0.14007.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:mail_security:*:*:*:*:*:exchange_server:*:* Versions 10.1 to before 10.1.10014.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:*:*:* Versions before 17.0.10.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:security:*:*:*:*:*:sharepoint_server:*:* Versions before 7.3.15006.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:security:*:*:*:*:ultimate:*:*:* Versions before 17.0.10.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:security:*:*:*:*:*:sharepoint_server:*:* Versions 8.0 to before 8.0.15012.0; 9.0 to before 9.0.15006.0; 10.0 to before 10.0.15005.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:server_security:*:*:*:*:*:windows_server:*:* Versions before 7.3.12013.0; 8.0 to before 8.0.12016.0; 9.0 to before 9.0.12019.0; 10.0 to before 10.0.12015.0 Vulnerable ·ESET, spol. s r.o.
  • cpe:2.3:a:eset:smart_security:*:*:*:*:premium:*:*:* Versions before 17.0.10.0 Vulnerable ·ESET, spol. s r.o.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-0353
  2. 2026-10-03 Alias added: GHSA-8m6h-q36w-xvg7

References

Advisory 1

  • TI-2023-05150 Improper following of a certificate's chain of trust in ESET security products CVSS 3.1HIGH 8.6
  • TI-2023-02960 Local privilege escalation in security products for Windows CVSS 3.1HIGH 7.8
  • TI-2023-02668 Local privilege escalation in ESET products for Linux and MacOS CVSS 3.1HIGH 7.8
  • TI-2021-15659 LPE in ESET products for Windows CVSS 3.1HIGH 7.8
  • TI-2022-00532 Use-after-free vulnerability in ESET products for Linux CVSS 3.1HIGH 7.5
  • TI-2020-09185 ESET Antivirus and Antispyware Module module 1553 through 1560 allows a user with limited… CVSS 3.1HIGH 7.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences