Read the docs
TI-2026-69739 Aliases CVE-2026-107707

Link following in Intego Antivirus enables local privilege escalation

Priority HIGH 72CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Intego Antivirus for Windows through 3.0.0.1 contains a link following flaw in its optimization module. A local unprivileged user can delete arbitrary folders as SYSTEM and abuse Windows Installer rollback to execute code as SYSTEM (CWE-59). A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00144 3rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IntegoIntego Antivirusup to 3.0.0.1—No fix listedCNA
  • Intego Antivirus VendorIntego Affected up to 3.0.0.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Intego Antivirus.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107707
  2. 2026-10-10 CISA SSVC decision points changed
  3. 2026-10-10 Priority changed: MEDIUM → HIGH

References

Exploit 1

Other 1

  • TI-2026-21216 Intego Personal Backup Task File Privilege Escalation CVSS 4.0HIGH 8.5
  • TI-2026-21215 Intego Log Reporter TOCTOU Local Privilege Escalation CVSS 4.0HIGH 8.5
  • TI-2006-05699 Intego VirusBarrier X4 allows context-dependent attackers to bypass virus protection by… CVSS 2.0MEDIUM 5.0
  • TI-2001-01119 Intego FileGuard 4.0 uses weak encryption to store user information and passwords, which… CVSS 2.0MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences