CVE-2026-12858: ESET AV Remover Privilege Escalation Flaw

CVE-2026-12858 Overview

CVE-2026-12858 is an Improper Privilege Management vulnerability [CWE-269] in the standalone ESET AV Remover utility. A local authenticated attacker can send a crafted Remote Procedure Call (RPC) message to the tool and elevate privileges on the affected host. ESET has published a customer advisory confirming the flaw and shipping a fixed build.

The issue is classified as local privilege escalation. Exploitation requires prior code execution on the endpoint with low privileges, but no user interaction. Successful exploitation grants high impact to confidentiality, integrity, and availability of the local system.

Critical Impact
A local user can abuse the AV Remover RPC interface to execute code with elevated privileges, providing a reliable path from a standard account to full system compromise.

Affected Products

ESET AV Remover (standalone utility)
Deployments where the AV Remover tool was executed and left resident on Windows endpoints
Refer to the ESET Customer Advisory for the specific fixed build

Discovery Timeline

2026-09-09 - CVE CVE-2026-12858 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-12858

Vulnerability Analysis

ESET AV Remover is a standalone Windows utility that uninstalls third-party antivirus products. To perform system-level uninstall operations, the tool exposes a privileged service component that accepts requests through an RPC interface. The vulnerability lies in how this interface authorizes and validates inbound calls from local clients.

Because the privileged component does not adequately restrict which callers may invoke sensitive operations, a low-privileged local user can craft an RPC message that the service processes in its elevated security context. The result is arbitrary action taken as SYSTEM, including file operations and process launches that lead to full local privilege escalation.

The weakness maps to CWE-269 (Improper Privilege Management). It matches a common pattern in security tooling: a helper service that trusts its RPC clients more than it should, effectively turning an administrative utility into a local escalation primitive.

Root Cause

The root cause is missing or insufficient caller authorization on the RPC endpoint exposed by the AV Remover service. Sensitive methods intended for the installer workflow are reachable from any local session, allowing a standard user to instruct the privileged process to act on their behalf.

Attack Vector

The attack vector is local. An attacker who already holds a low-privileged shell on a Windows host where the vulnerable AV Remover component is present connects to the exposed RPC interface, submits a crafted request that invokes privileged functionality, and gains code execution as SYSTEM. No user interaction is required, and the attack complexity is low.

A public proof-of-concept is not listed in the NVD record. Refer to the vendor advisory for technical specifics.

Detection Methods for CVE-2026-12858

Indicators of Compromise

Presence of the ESET AV Remover binary on endpoints that are not actively being remediated, particularly on standard user workstations
Child processes spawned by the AV Remover service running as NT AUTHORITY\SYSTEM with parent contexts tied to non-administrative user sessions
Unexpected file writes or service installations occurring shortly after an AV Remover process starts under a low-privileged user account

Detection Strategies

Hunt for local RPC connections from non-administrative users to the AV Remover service endpoint, correlated with subsequent SYSTEM-level process creation
Alert on process lineage anomalies where a privileged uninstall helper spawns interactive shells such as cmd.exe, powershell.exe, or LOLBins
Baseline the legitimate use of AV Remover in your environment; treat any execution outside of sanctioned IT workflows as suspicious

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging and forward events to a centralized analytics platform
Monitor Sysmon Event IDs 1 (process create), 7 (image load), and 11 (file create) around the AV Remover installation path
Track privilege assignment events (Event IDs 4672, 4673) originating from standard user sessions on hosts where the tool is present

How to Mitigate CVE-2026-12858

Immediate Actions Required

Inventory all endpoints for the ESET AV Remover binary and remove copies that are no longer needed for active migrations
Download and run the fixed build of AV Remover from the vendor before any further use
Restrict local logon on servers and shared workstations to reduce the pool of accounts that could stage a local escalation

Patch Information

ESET has released a fixed version of the standalone AV Remover utility. See the ESET Customer Advisory for the corrected build and installation guidance. Because AV Remover is a standalone tool rather than a persistently installed product, remediation typically consists of deleting any resident copies and replacing them with the patched executable when needed.

Workarounds

Do not leave the AV Remover binary on endpoints after a migration completes; treat it as a single-use tool
Block execution of older AV Remover versions using application control policies such as Windows Defender Application Control or AppLocker
Limit the tool to administrator-supervised sessions on isolated maintenance workstations rather than general-purpose endpoints

bash

# Example AppLocker publisher rule concept to block unpatched AV Remover versions
# Replace the version threshold with the fixed build published in the ESET advisory
New-AppLockerPolicy -RuleType Publisher `
  -User Everyone `
  -Action Deny `
  -FilePath 'C:\\Path\\To\\ESETAVRemover.exe' `
  -BinaryVersionRange @{ LowSection = '0.0.0.0'; HighSection = '<fixed-version>' }