{"id":"CVE-2026-116596","aliases":["EUVD-2026-109978","GHSA-24wx-f8xj-7p3w"],"status":"published","title":"CVE-2026-116596","description":"Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract.","epss":{"day":"2026-11-11","score":0.00131,"percentile":0.02787,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-10-26T16:17:29Z","modified":"2026-10-26T18:41:21Z","products":[{"vendor":"pyrus","product":"pyrus sync"}],"references":[{"url":"https://pyrus.com/en/pyrus-sync"},{"url":"https://medium.com/@alisaifeldin/cve-2026-116596-local-privilege-escalation-in-pyrus-sync-for-windows-0fe2417dc8cf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116596"},{"url":"https://github.com/advisories/GHSA-24wx-f8xj-7p3w"}],"sources":{"cve":[{"id":"CVE-2026-116596","title":"CVE-2026-116596","description":"Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract.","status":"published","published":"2026-10-26T16:17:29.178Z","modified":"2026-10-26T16:17:29.178Z","updated_at":"2026-11-02T14:20:03.827373Z"}],"euvd":[{"id":"EUVD-2026-109978","description":"Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract.","status":"published","published":"2026-10-26T16:17:29Z","modified":"2026-10-26T16:17:29Z","updated_at":"2026-11-02T16:59:29.132426Z"}],"ghsa":[{"id":"GHSA-24wx-f8xj-7p3w","title":"Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing...","description":"Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract.","status":"published","published":"2026-10-26T18:33:00Z","modified":"2026-10-26T18:33:10Z","updated_at":"2026-11-02T15:14:24.666824Z"}],"nvd":[{"id":"CVE-2026-116596","description":"Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract.","status":"published","published":"2026-10-26T17:17:27.427Z","modified":"2026-10-26T18:41:21.45Z","updated_at":"2026-11-02T14:13:03.452847Z"}]}}