CVE-2026-11857: Quanos SCHEMA ST4 Privilege Escalation

CVE-2026-11857 Overview

CVE-2026-11857 is a local privilege escalation vulnerability in the Quanos SCHEMA ST4 on-premises Client Update Service. The service exposes a .NET Remoting endpoint over a local named pipe configured with TypeFilterLevel.Full. A local authenticated attacker can connect to the named pipe, obtain the .NET Remoting endpoint, and submit crafted serialized objects. Successful exploitation yields arbitrary code execution as NT AUTHORITY\SYSTEM. The flaw is classified under CWE-502 Deserialization of Untrusted Data. Network-only exploitation is not possible because access requires an authenticated local session on the affected host.

Critical Impact
Any authenticated local user can escalate to SYSTEM by sending malicious serialized objects to the Client Update Service named pipe.

Affected Products

Quanos SCHEMA ST4 (on-premises)
SCHEMA ST4 Client Update Service component
Deployments using the bundled .NET Remoting update channel

Discovery Timeline

2026-06-17 - CVE-2026-11857 published to NVD
2026-06-17 - Last updated in NVD database
Reference - Technical analysis published by SEC Consult

Technical Details for CVE-2026-11857

Vulnerability Analysis

The Client Update Service in Quanos SCHEMA ST4 hosts a .NET Remoting server bound to a local named pipe. .NET Remoting uses BinaryFormatter-based serialization to transport objects between client and server. When the server is configured with TypeFilterLevel.Full, it permits deserialization of arbitrary object graphs, including types that execute code during reconstruction. Known gadget chains such as TextFormattingRunProperties, ObjectDataProvider, and WindowsIdentity can be chained to invoke arbitrary methods. Because the update service runs as NT AUTHORITY\SYSTEM, deserialized payloads execute at the highest local privilege level. The named pipe binding restricts the attack surface to local callers but does not authenticate or filter object types.

Root Cause

The root cause is unsafe deserialization of attacker-controlled input by a privileged .NET Remoting endpoint. Setting TypeFilterLevel to Full disables the framework's restrictive type filter and permits low-trust callers to send any serializable type. Microsoft has long deprecated .NET Remoting and explicitly warns against using TypeFilterLevel.Full on endpoints reachable by lower-privileged principals.

Attack Vector

Exploitation requires an interactive or service-level logon on the host running SCHEMA ST4. The attacker enumerates local named pipes, identifies the update service endpoint, and obtains a remoting proxy. The attacker then transmits a serialized gadget chain generated with a tool such as ysoserial.net using the BinaryFormatter formatter and a TypeConfuseDelegate or TextFormattingRunProperties payload. Upon deserialization, the gadget triggers process or command execution within the SYSTEM-context update service. No user interaction is required, and the bound named pipe does not enforce caller privilege checks sufficient to block the attack.

No public proof-of-concept code is referenced in the advisory. Refer to the SEC Consult Quanos Analysis for technical details on the gadget chain and endpoint discovery.

Detection Methods for CVE-2026-11857

Indicators of Compromise

Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by the SCHEMA ST4 Client Update Service executable running as SYSTEM.
Unexpected outbound network connections initiated by the update service process following local user activity.
New scheduled tasks, services, or local administrator accounts created shortly after a non-admin user session opens a handle to the update service named pipe.

Detection Strategies

Monitor process creation events where the parent is the SCHEMA ST4 update service and the child is an interactive shell or scripting host.
Hunt for named pipe creation and connection events targeting the SCHEMA ST4 update pipe from non-administrative user contexts.
Inspect Windows event logs for service crashes, unhandled SerializationException entries, or .NET runtime errors originating from the update service.

Monitoring Recommendations

Enable command-line and parent-process logging via Sysmon Event IDs 1, 17, and 18 to capture pipe and process activity.
Forward endpoint telemetry to a centralized analytics platform and alert on SYSTEM-context child processes of update services.
Baseline legitimate Client Update Service behavior and flag deviations in pipe clients, child processes, and loaded modules.

How to Mitigate CVE-2026-11857

Immediate Actions Required

Restrict interactive and remote desktop logon rights on hosts running SCHEMA ST4 to trusted administrators only.
Apply vendor updates from Quanos addressing the .NET Remoting deserialization flaw as soon as they are available.
Audit accounts with local logon rights on SCHEMA ST4 servers and remove unnecessary standard user access.

Patch Information

Review the SEC Consult advisory and Quanos vendor communications for fixed versions of SCHEMA ST4. The remediation removes the insecure .NET Remoting endpoint or replaces TypeFilterLevel.Full with restricted type filtering and caller authorization. No specific fixed version is published in the NVD record at this time.

Workarounds

Disable the Client Update Service on hosts where automated updates are not required, and update manually under administrative control.
Apply a host-based access control list to the named pipe so only LocalSystem and trusted administrators can open it.
Limit which users can establish local sessions on SCHEMA ST4 servers using Group Policy Deny log on locally and Deny log on through Remote Desktop Services.

bash

# Example: restrict interactive logon to administrators via Group Policy (secedit)
# Export current policy
secedit /export /cfg C:\policy\current.inf

# In the exported INF, set:
# [Privilege Rights]
# SeDenyInteractiveLogonRight = *S-1-5-32-545   ; Users group
# SeInteractiveLogonRight     = *S-1-5-32-544   ; Administrators only

# Re-apply the modified policy
secedit /configure /db C:\policy\hardened.sdb /cfg C:\policy\hardened.inf /overwrite