CVE-2026-11858: Quanos SCHEMA ST4 Privilege Escalation

CVE-2026-11858 Overview

CVE-2026-11858 is a local privilege escalation vulnerability in the Quanos SCHEMA ST4 on-premises Client Update Service. The service runs as NT AUTHORITY\SYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient access controls or authorization checks. A local authenticated low-privileged user can connect to the interface and invoke privileged methods such as Update(). Successful exploitation grants arbitrary file write and delete operations with SYSTEM privileges, enabling full local privilege escalation. The flaw is tracked as a Missing Authorization weakness [CWE-862].

Critical Impact
Any local low-privileged user on a host running the SCHEMA ST4 Client Update Service can escalate to SYSTEM through unauthenticated .NET Remoting calls over a named pipe.

Affected Products

Quanos SCHEMA ST4 (on-premises deployment)
SCHEMA ST4 Client Update Service component
Systems running the vulnerable named pipe .NET Remoting interface

Discovery Timeline

2026-06-17 - CVE-2026-11858 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-11858

Vulnerability Analysis

The Quanos SCHEMA ST4 Client Update Service hosts a .NET Remoting endpoint over a Windows named pipe. The service process runs under the NT AUTHORITY\SYSTEM account to perform software updates. The named pipe is accessible to local users, but the remoting interface does not enforce authorization on the methods it exposes.

Any local authenticated user can attach to the pipe and invoke server-side methods such as Update(). These methods perform file operations on behalf of the SYSTEM process, including writing and deleting files in protected locations. An attacker can use this primitive to plant a malicious binary, overwrite a trusted executable, or delete critical files to coerce SYSTEM-level execution.

Root Cause

The root cause is a Missing Authorization weakness [CWE-862]. The .NET Remoting server accepts calls from any authenticated principal on the local system and does not validate whether the caller is permitted to invoke privileged update functions. Combined with the elevated service context, the design directly exposes SYSTEM-level file primitives to standard users.

Attack Vector

Exploitation requires only local low-privileged access. The attacker connects to the named pipe channel exposed by the Client Update Service and issues remoting calls that map to the privileged Update() method. By controlling the file paths and content passed to these methods, the attacker achieves arbitrary file write and delete as SYSTEM. Common follow-on techniques include DLL hijacking against a SYSTEM process, replacing a service binary, or staging payloads in protected directories. Technical details are documented in the SEC Consult Quanos Analysis.

Detection Methods for CVE-2026-11858

Indicators of Compromise

Unexpected child processes spawned by the SCHEMA ST4 Client Update Service running as SYSTEM
File creation, modification, or deletion events in protected paths attributed to the update service process
Named pipe connections to the SCHEMA ST4 update service from non-administrative user sessions

Detection Strategies

Monitor named pipe CreateFile and ConnectNamedPipe events targeting the SCHEMA ST4 update service from low-integrity processes.
Alert on .NET Remoting traffic patterns originating from interactive user sessions to the update service.
Correlate SYSTEM-context file writes in sensitive directories with the parent process identity of the Client Update Service.

Monitoring Recommendations

Enable Windows Sysmon Event IDs 17 and 18 to capture named pipe creation and connection activity on hosts running SCHEMA ST4.
Audit file system writes to C:\Windows, C:\Program Files, and service binary paths performed by the update service.
Track creation of new scheduled tasks, services, or autoruns immediately after Client Update Service activity.

How to Mitigate CVE-2026-11858

Immediate Actions Required

Inventory all hosts running Quanos SCHEMA ST4 on-premises and identify those exposing the Client Update Service.
Restrict local logon to trusted administrative users on systems where the update service cannot be disabled.
Apply the vendor patch from Quanos as soon as it is available for your SCHEMA ST4 version.

Patch Information

Refer to the SEC Consult Quanos Analysis for vendor coordination details and patch availability. Customers should contact Quanos directly to obtain the fixed version of SCHEMA ST4 that adds authorization checks to the Client Update Service remoting interface.

Workarounds

Stop and disable the SCHEMA ST4 Client Update Service on hosts where automatic updates are not required.
Restrict access to the named pipe used by the update service through Windows ACLs so only administrators can connect.
Limit interactive and remote logon rights on SCHEMA ST4 servers to reduce the population of users who can exploit the local interface.

bash

# Configuration example: disable the vulnerable service until patched
sc.exe stop "SCHEMA ST4 Client Update Service"
sc.exe config "SCHEMA ST4 Client Update Service" start= disabled