High severity7.8NVD Advisory· Published Oct 8, 2026· Updated Oct 8, 2026

CVE-2026-107707

Description

Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.

Affected products

Intego/Antivirus for Windowsllm-fuzzy
Range: <=3.0.0.1

Patches

Vulnerability mechanics

References

blog.quarkslab.com/milking-the-last-drop-of-intego-time-for-windows-to-get-its-lpe.htmlnvd
www.intego.comnvd
www.vulncheck.com/advisories/intego-antivirus-through-3.0.0.1-local-privilege-escalation-via-optimization-module-junctionnvd

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000