CVE-2026-1680: Local Admin Service Privilege Escalation

CVE-2026-1680 Overview

CVE-2026-1680 is a local privilege escalation vulnerability affecting the Edgemo (now owned by Danoffice IT) Local Admin Service version 1.2.7.23180 on Windows systems. The vulnerability stems from improper access control in the Windows Communication Foundation (WCF) endpoint, allowing a local user with limited privileges to escalate to local administrator by directly communicating with the LocalAdminService.exe named pipe. This attack bypasses client-side group membership restrictions that were intended to prevent unauthorized privilege elevation.

Critical Impact

Local users can escalate to full administrator privileges on affected Windows systems, potentially leading to complete system compromise and lateral movement within enterprise environments.

Affected Products

• Edgemo Local Admin Service version 1.2.7.23180
• Danoffice IT Local Admin Service (formerly Edgemo)
• Windows systems running the vulnerable Local Admin Service component

Discovery Timeline

• 2026-01-30 - CVE CVE-2026-1680 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-1680

Vulnerability Analysis

This vulnerability is classified under CWE-250 (Execution with Unnecessary Privileges), indicating that the Local Admin Service grants excessive privileges during its operation. The core issue lies in the WCF endpoint implementation within LocalAdminService.exe, which fails to properly validate the privileges of connecting clients before processing requests.

The service exposes a named pipe communication channel that is intended to facilitate local administration tasks. However, the access control mechanism implemented is purely client-side, meaning it relies on the connecting application to enforce group membership checks rather than validating permissions server-side within the service itself.

Root Cause

The root cause of this vulnerability is the improper implementation of access control on the WCF named pipe endpoint. The Local Admin Service trusts the client application to verify that the user belongs to an appropriate administrative group before allowing privileged operations. Since these checks occur client-side, a malicious local user can craft their own client or directly interact with the named pipe to bypass these restrictions entirely. The service processes requests without performing independent server-side authorization validation.

Attack Vector

The attack requires local access to the affected Windows system. An attacker with low-privilege user access can exploit this vulnerability by:

1. Identifying the named pipe endpoint exposed by LocalAdminService.exe
2. Establishing direct communication with the WCF endpoint, bypassing the legitimate client application
3. Sending crafted requests to the service that would normally require administrative group membership
4. The service processes these requests without proper authorization checks, granting the attacker administrative privileges

The attack does not require user interaction and can be executed programmatically by any authenticated local user on the system. For detailed technical analysis and proof-of-concept methodology, refer to the Retest Local Privilege Escalation Analysis.

Detection Methods for CVE-2026-1680

Indicators of Compromise

• Unexpected connections to the LocalAdminService.exe named pipe from non-standard processes
• User accounts gaining local administrator privileges without corresponding IT administrative actions
• Unusual process creation patterns where low-privilege processes spawn elevated processes after communicating with the Local Admin Service
• Event log entries showing privilege changes that cannot be attributed to legitimate administrative tools

Detection Strategies

• Monitor named pipe connections to LocalAdminService.exe for connections from unexpected source processes
• Implement endpoint detection rules that alert on privilege escalation patterns involving the Local Admin Service
• Deploy SentinelOne agents configured to detect local privilege escalation techniques and suspicious inter-process communication
• Audit Windows Security Event logs (Event ID 4672, 4624) for anomalous privilege assignments correlated with Local Admin Service activity

Monitoring Recommendations

• Enable detailed logging for WCF service endpoints and named pipe communications where possible
• Configure SentinelOne Singularity platform to monitor for behavioral indicators of privilege escalation attempts
• Establish baseline behavior for the Local Admin Service and alert on deviations from normal operation patterns
• Implement file integrity monitoring on the LocalAdminService.exe binary and related configuration files

How to Mitigate CVE-2026-1680

Immediate Actions Required

• Identify all systems running Edgemo/Danoffice IT Local Admin Service version 1.2.7.23180 in your environment
• Restrict local access to affected systems to only trusted users until patches are applied
• Consider temporarily disabling the Local Admin Service if it is not business-critical
• Deploy enhanced monitoring using SentinelOne to detect exploitation attempts
• Contact Danoffice IT for updated software versions that address this vulnerability

Patch Information

Organizations should consult with Danoffice IT (the current owner of the formerly Edgemo Local Admin Service) for official patch availability and remediation guidance. Visit the DanOfficeIT Workplace Management page for product information and support contacts. Until an official patch is available, implement the workarounds and monitoring recommendations described in this advisory.

Workarounds

• Implement Windows Firewall rules to restrict which processes can communicate with the LocalAdminService.exe named pipe
• Apply the principle of least privilege to limit which users have local access to systems running the vulnerable service
• Use Windows AppLocker or Software Restriction Policies to control which applications can execute on affected systems
• Deploy network segmentation to limit lateral movement potential if a system is compromised

# Example: Audit local users with potential access to exploit this vulnerability
# Run in PowerShell on affected Windows systems
Get-LocalUser | Where-Object { $_.Enabled -eq $true } | Select-Object Name, Enabled, LastLogon
Get-LocalGroupMember -Group "Users" | Select-Object Name, ObjectClass