Pyrus Sync for Windows lets local users gain elevated privileges
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from CNA.
Summary
Pyrus Sync for Windows before 1.8.745.0 contains a local privilege escalation flaw. Missing authorization controls in the PyrusSyncService Windows service let an attacker with unprivileged access create files through the ISyncService contract.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Update Pyrus Sync to version 1.8.745.0, which fixes this flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA Pyrus Sync (Pyrus) Fixed in 1.8.745.0
Vendor assessments
Timeline
- 2026-10-26 Threatist record created from CVE-2026-116596
- 2026-10-27 Alias added: GHSA-24wx-f8xj-7p3w
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Sources
- CVE-2026-116596 · CVE Program
- CVE-2026-116596 · NVD
- FIRST EPSS
- GHSA-24wx-f8xj-7p3w · GitHub Advisory Database · CC BY 4.0
- CVE-2026-116596 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences