CVE-2026-73027

HighCVSS 7.8/10Last modified Oct 17, 2026

Description

External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-15

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 17, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-730288.8Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-730296.5Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-73033.7A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xxl-job-admin/src/mainCVE-2026-730308.1unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to nCVE-2026-730318.7telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victimsCVE-2026-730329.6PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returningCVE-2026-730336.5Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in srCVE-2026-730349.8DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any locationCVE-2026-730354.3npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attackCVE-2026-730364.4Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allowsCVE-2026-730376.1Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolatedCVE-2026-730386.1NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and
CVE-2026-73027: High severity, CVSS 7.8 | Vulnix