TI-2026-83068 Aliases CVE-2026-75882 GHSA-wj23-j8cg-4p86

Improper access control in ESET Encryption products for Windows

LOW 37CWE-284Published 2026-10-30 · Updated 2026-10-30

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

ESET Endpoint Encryption through 5.4.23.0 and ESET Full Disk Encryption through 2.4.4.0 for Windows contain an improper access control flaw (CWE-284). A local user with standard permissions can access a device interface of a privileged kernel driver and send specially crafted requests. The flaw has high impact on confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00097 0th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ESET, spol. s r.o.	ESET Endpoint Encryption	up to 5.4.23.0	—	No fix listed	CNA
ESET, spol. s r.o.	ESET Full Disk Encryption	up to 2.4.4.0	—	No fix listed	CNA

ESET Endpoint Encryption VendorESET, spol. s r.o. Affected up to 5.4.23.0 Fixed in — No fix listed CNA
ESET Full Disk Encryption VendorESET, spol. s r.o. Affected up to 2.4.4.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for ESET Endpoint Encryption or ESET Full Disk Encryption.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Timeline

2026-10-30 Threatist record created from CVE-2026-75882
2026-10-30 CISA SSVC decision points changed
2026-10-30 Priority changed: MEDIUM → LOW
2026-10-30 Alias added: GHSA-wj23-j8cg-4p86

References

Other 1

https://support.eset.com/en/ca9033-eset-customer-advisory-improper-access-control-vulnerability-in-eset-encryption-products-for-windows-fixed

TI-2012-01283 The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus… CVSS 2.0MEDIUM 4.3
TI-2012-01281 The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir… CVSS 2.0MEDIUM 4.3
TI-2012-01279 The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!… CVSS 2.0MEDIUM 4.3
TI-2012-01278 The TAR file parser in AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00… CVSS 2.0MEDIUM 4.3
TI-2012-01265 The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat… CVSS 2.0MEDIUM 4.3
TI-2012-01244 The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, NOD32 Antivirus 5795, Norman… CVSS 2.0MEDIUM 4.3

See all 60 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences