CVE-2026-15684 Overview
CVE-2026-15684 is a link following local privilege escalation vulnerability in Glarysoft Glary Utilities. The flaw resides in the Disk Clean functionality, which fails to validate filesystem junctions before performing file deletion operations. A local attacker with the ability to execute low-privileged code can abuse the service to delete arbitrary files on the target system. Successful exploitation allows an attacker to escalate privileges and execute arbitrary code in the context of SYSTEM. The issue was reported through the Zero Day Initiative as ZDI-CAN-27004 and tracked publicly as ZDI-26-402.
Critical Impact
Local attackers can escalate from low-privileged user to SYSTEM by abusing Glary Utilities Disk Clean to delete arbitrary files via junction abuse.
Affected Products
- Glarysoft Glary Utilities (Disk Clean component)
- Windows installations running the vulnerable Glary Utilities service
- Refer to the ZDI advisory for specific affected versions
Discovery Timeline
- 2026-07-13 - CVE-2026-15684 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-15684
Vulnerability Analysis
The vulnerability is a link following flaw [CWE-59] within the Disk Clean feature of Glarysoft Glary Utilities. The privileged service performs file deletion operations on paths that a low-privileged user can influence. Because the service does not verify whether target paths are filesystem junctions or symbolic links before acting, an attacker can redirect deletion operations to files outside the intended cleanup scope.
By planting a junction that points from an attacker-controlled directory to a sensitive system location, the attacker causes the SYSTEM-level service to delete files it should not touch. Arbitrary file deletion on Windows is a well-known primitive for full privilege escalation, typically chained with techniques that abuse the Windows Installer rollback process or DLL planting to gain code execution as SYSTEM.
Root Cause
The root cause is improper resolution of filesystem links before performing privileged file operations. The Disk Clean routine trusts path metadata provided in a directory that a standard user can modify. It does not canonicalize the target, check reparse point attributes, or impersonate the requesting user during the delete operation.
Attack Vector
Exploitation requires local access and the ability to execute code as a low-privileged user. User interaction is also required, since the attacker must trigger the Disk Clean workflow against a directory that they have staged. The attacker first stages files and then replaces a subdirectory with an NTFS junction pointing to a protected location, such as a directory containing files owned by SYSTEM. When the service processes the cleanup task, it follows the junction and deletes the redirected files, enabling a follow-on privilege escalation chain.
No verified public exploit code is available. Technical details are described in the Zero Day Initiative advisory ZDI-26-402.
Detection Methods for CVE-2026-15684
Indicators of Compromise
- Creation of NTFS junctions or reparse points within directories processed by Glary Utilities Disk Clean
- Unexpected deletion of files in protected system directories such as C:\Windows\System32 or C:\Program Files
- Glary Utilities service processes performing file operations on paths outside the standard cleanup scope
Detection Strategies
- Monitor for SetReparsePoint and CreateFile operations with FILE_FLAG_OPEN_REPARSE_POINT originating from non-administrative processes in user-writable temp directories
- Alert on file deletion events performed by Glary Utilities service processes against paths outside typical user profile or temp locations
- Correlate low-privileged process activity with subsequent SYSTEM-level file operations targeting the same paths
Monitoring Recommendations
- Enable Windows Sysmon Event ID 11 (FileCreate) and Event ID 23 (FileDelete) with rules covering junction creation patterns
- Audit privileged file deletions by third-party utility services and forward events to a centralized SIEM
- Track child processes and file handle activity of the Glary Utilities service for anomalous cross-directory access
How to Mitigate CVE-2026-15684
Immediate Actions Required
- Restrict use of Glary Utilities Disk Clean on multi-user systems until a patched build is installed
- Remove or disable the Glary Utilities service on shared workstations and terminal servers where low-privileged users have interactive access
- Review the ZDI-26-402 advisory and apply vendor updates as soon as they become available
Patch Information
At the time of publication, refer to Glarysoft for an official fixed version. The Zero Day Initiative advisory ZDI-26-402 tracks vendor coordination status and should be consulted for patch availability.
Workarounds
- Limit local logon rights so untrusted users cannot execute code on hosts running Glary Utilities
- Configure application control policies (Windows Defender Application Control or AppLocker) to block execution of Glary Utilities on sensitive systems
- Remove writable subdirectories that Disk Clean processes from paths accessible to standard users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
