Privilege Escalation in Panloader.exe
Priority LOW 38CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A Privilege Escalation vulnerability has been found in Panloader component v3.24.0.0 by Espiral MS Group. This vulnerability allows any user to override the file panLoad.exe that will be executed by SYSTEM user via a programmed task. This would allow an attacker to obtain administrator permissions to perform whatever activities he/she wants, shuch as accessing sensitive information, executing code remotely, and even causing a denial of service (DoS).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00158 4th percentileScored 2026-11-07
Fix Fixed Panloader.exe (Grupo Espiral MS): 3.16.0.0.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Grupo Espiral MS | Panloader.exe | before 3.16.0.0.0 | 3.16.0.0.0 | Patch available | CNA |
- Panloader.exe VendorGrupo Espiral MS Affected before 3.16.0.0.0 Fixed in 3.16.0.0.0 Patch available CNA
Remediation
- Fix · CNA Panloader.exe (Grupo Espiral MS) Fixed in 3.16.0.0.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-40672
- 2026-10-03 Alias added: GHSA-x3pq-44r4-6g4m
References
Sources
- CVE-2025-40672 · CVE Program
- CVE-2025-40672 · NVD
- FIRST EPSS
- GHSA-x3pq-44r4-6g4m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences