CVE-2026-110359
Quick assessment
Affected
Hyland Desktop Host
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Hyland Desktop Host for Windows 在 25.1.1 版本之前存在本地权限提升漏洞。该漏洞是由于位于 文件夹下的特权服务具有较弱的权限设置所致。本地用户可利用此漏洞实现权限提升。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Hyland | Desktop Host | < 25.1.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110359
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
缺省权限不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Hyland | Desktop Host | 0 ~ 25.1.1 | - |
|
II. Public POCs for CVE-2026-110359
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110359
请登录查看更多情报信息。
Other References for CVE-2026-110359 (1)
IV. Related Vulnerabilities
Same vendor: Hyland
-
CVE-2026-58127
PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remo -
CVE-2026-58126
PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoti -
CVE-2026-26339
Hyland Alfresco Transformation Service Argument Injection RC -
CVE-2026-26338
Hyland Alfresco Transformation Service SSRF -
CVE-2026-26337
Hyland Alfresco Transformation Service Absolute Path Travers
Same weakness: CWE-276
-
CVE-2026-108072
Insecure Permissions on Shared Startup Scripts Allow Cross-U -
CVE-2026-105009
Windows Server Update Service Elevation of Privilege Vulnera -
CVE-2026-108503
Unauthorized information acquisition vulnerability in ZTE Z8 -
CVE-2026-107332
Insecure Default File Permissions on Cached Credentials in A -
CVE-2026-107573
Incorrect Default Permissions in hMailServer
V. Comments for CVE-2026-110359
No comments yet