Local Privilege Escalation (CVE‑2026‑12410) in Gen Digital CCleaner Enables SYSTEM‑Level Code Execution
What It Is — A flaw in the CCleaner uninstaller lets a low‑privileged attacker create a junction that the service follows, causing arbitrary file deletion and privilege escalation to SYSTEM.
Exploitability — Requires local code execution; no public exploit code yet, but the vulnerability is rated CVSS 7.8 (High) with low attack complexity.
Affected Products — Gen Digital CCleaner (all versions prior to the August 2026 update).
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC6.1 (Logical Access Control) requires that privileged actions be limited to authorized accounts; this flaw shows a gap in “least‑privilege” enforcement.
- Continuous control monitoring must capture changes to system‑level binaries and uninstaller permissions to provide audit‑ready evidence.
- Demonstrating timely patch management and evidence of remediation is a core component of a defensible SOC 2 audit trail, especially for enterprise customers.
Recommended Actions
- Deploy Gen Digital’s August 2026 patch immediately on all endpoints.
- Verify the installed CCleaner version and confirm the uninstaller binary’s ACLs restrict write/delete rights to administrators only.
- Map the vulnerability to SOC 2 CC6.1 and CC7.1 controls; capture patch‑deployment logs as evidence for auditors.
- Add the uninstaller path to your endpoint‑monitoring baselines to detect unauthorized junction creation.
- Review your privileged‑access policy to ensure “least privilege” for local accounts that could run untrusted code.