CVE-2026-12858

CVE-2026-12858 is an improper privilege management flaw (CWE-269) in the standalone edition of ESET AV Remover, a free utility used to uninstall third-party antivirus products. An attacker with low-privilege local access can trigger it by sending a specially crafted RPC call to the tool while it runs with elevated privileges. Successful exploitation results in privilege escalation with high impact on the confidentiality, integrity and availability of the local system (CVSS 4.0 score 8.5), effectively giving the attacker full control of the affected machine. Only users who have downloaded or deployed the standalone AV Remover are affected; it is a standalone cleanup utility, not ESET's core endpoint protection product. There are no reports of exploitation in the wild, no known public proof-of-concept, and the issue is not listed in CISA's KEV catalog.

What to do: Check whether the standalone ESET AV Remover is present on endpoints (including copies downloaded by IT staff) and update to the latest build published in ESET's advisory, since exact fixed version numbers are not included in the available data. Because the attack requires local low-privileged access, prioritize multi-user or shared machines and consider removing the utility after one-time use. Monitor ESET's advisory for updated versions and remediation details.