NVD HIGH: CVE-2026-107782 — System Informer before 4.0.26241.138 contains an incorrect authorization vulnera...

Thursday, October 8, 2026 at 09:17 PM UTC·Source: NIST NVD

Updated: Thursday, October 8, 2026 at 10:00 PM UTC

Executive Summary

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-107782

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

PHP Announces Critical Security Release for Two Vulnerabilities

On October 20, 2026, the PHP security team announced an upcoming security release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. The release is scheduled for October 21, 2026, at 14:00 UTC. PHP has indicated that the updates may be released earlier if vulnerability details become public or evidence of active exploitation emerges. Public […]

2h agoQualys Blog

MEDIUMVulnerability

Stolen UpdraftCentral keys used to backdoor WordPress sites

A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. [...]

3h agoBleepingComputer

MEDIUMVulnerability

Mozilla, Google, Apple block compromised eMudhra CA certificates

Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. [...]

4h agoBleepingComputer