Read the docs
TI-2026-73863 Aliases CVE-2026-110359GHSA-j757-w85c-pwhp

Local privilege escalation in Hyland Desktop Host for Windows

Priority LOW 35CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Hyland Desktop Host for Windows before 25.1.1 contains a local privilege escalation flaw. A privileged service runs from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions, which is classified as CWE-276 (Incorrect Default Permissions). A local user with low privileges can exploit this to escalate privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00119 1st percentileScored 2026-11-07
Fix Fixed Desktop Host (Hyland): 25.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HylandDesktop Hostbefore 25.1.125.1.1Patch availableCNA
  • Desktop Host VendorHyland Affected before 25.1.1 Fixed in 25.1.1 Patch available CNA

Remediation

Update Hyland Desktop Host for Windows to version 25.1.1.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Desktop Host (Hyland) Fixed in 25.1.1

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110359
  2. 2026-10-14 Alias added: GHSA-j757-w85c-pwhp
  3. 2026-10-14 CISA SSVC decision points changed
  4. 2026-10-14 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2025-24307 Hyland OnBase < 17.0.2.87 .NET Remoting TCP Channel Unauthenticated RCE CVSS 4.0CRITICAL 10.0
  • TI-2026-41859 PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service CVSS 4.0CRITICAL 9.3
  • TI-2026-41858 PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service CVSS 4.0CRITICAL 9.3
  • TI-2023-27323 An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. CVSS 3.1HIGH 8.8
  • TI-2024-26898 A reflected cross-site scripting (XSS) vulnerability in Hyland Alfresco Platform… CVSS 3.1MEDIUM 6.1
  • TI-2021-12493 Regular expression Denial of Service in MooTools CVSS 3.1MEDIUM 6.1
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences