ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “cwe-250”

4 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 3Advisory 1
SeverityAllcritical 1high 1medium 1low 1info 0

[0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path without credential override (7.2)

0day Rubbish Research Team disclosed a CVSS 7.2 local privilege escalation (CWE-250) in Royal Server 5.04.50529.0 to LocalSystem.

Researchers publicly disclosed a local privilege escalation vulnerability in Royal Server 5.04.50529.0, classified as CWE-250 (execution with unnecessary privileges) with a CVSS score of 7.2. The flaw allows escalation to LocalSystem on the execution path without credential override. The disclosure was posted to the Full Disclosure mailing list on September 8, 2026; no patch or CVE id was mentioned in the notice.

Full Disclosure · 7d agoVulnerability

[0day-rubbish] SmarterMail 100.0.9693 (Build 9693) Antivirus command-line configuration executing as NT AUTHORITY\SYSTEM (7.2)

SmarterMail 100.0.9693 executes its antivirus command-line configuration as NT AUTHORITY\SYSTEM, a CWE-250 flaw rated CVSS 7.2.

0day Rubbish Research Team disclosed that SmarterMail 100.0.9693 (build 9693) runs its antivirus command-line configuration with NT AUTHORITY\SYSTEM privileges, classified as CWE-250 (deployment of executable with unnecessary privileges) and rated CVSS 7.2. Control over that configuration could yield SYSTEM-level code execution on the mail server. The disclosure does not report exploitation in the wild.

Full Disclosure · 7d agoVulnerability

OPCFoundation OPC UA LocalDiscoveryServer (LDS)

CISA warns CVE-2026-77477 (CVSS 4.6) lets local attackers hijack a privileged console during OPC UA LDS installation below version 1.04.420.

CISA published ICSA-26-246-01 for CVE-2026-77477, CWE-250 execution with unnecessary privileges in OPC Foundation UA-LDS-Installers below 1.04.420. An attacker able to launch the installer with elevated privileges and access the keyboard and display can intercept a high-privilege console window during installation and run arbitrary commands. CVSS 3.1 score is 4.6, the issue is not remotely exploitable, and no public exploitation has been reported. Lukas Schumaker of Rockwell Automation reported the flaw to OPC Foundation.

CISA Advisories · 13d agoAdvisoryCVE-2026-77477