CVE-2026-28700: EquiTriton Privilege Escalation Flaw

CVE-2026-28700 Overview

CVE-2026-28700 is an uncontrolled search path vulnerability [CWE-427] affecting EquiTriton versions prior to commit f5ddbb5. The flaw resides in Ring 3 user-mode application logic and allows a local unprivileged attacker to escalate privileges when a privileged user is present. Exploitation requires local access and passive user interaction, but attack complexity is low. Successful exploitation compromises the confidentiality, integrity, and availability of the vulnerable system. Intel published the issue in Security Advisory SA-01473.

Critical Impact
A local attacker can plant a malicious binary or library along an uncontrolled search path, causing a privileged EquiTriton process to load attacker-controlled code and execute it with elevated privileges.

Affected Products

EquiTriton versions before commit f5ddbb5
Ring 3 (user-mode) application components of EquiTriton
Systems where EquiTriton is invoked by a privileged user

Discovery Timeline

2026-08-11 - CVE-2026-28700 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-28700

Vulnerability Analysis

The vulnerability is classified under [CWE-427: Uncontrolled Search Path Element]. EquiTriton loads external resources, such as libraries or executables, using a search path that includes locations writable by unprivileged users. When a privileged user runs the affected component, the process resolves dependencies through this uncontrolled search order.

An adversary with local access can drop a malicious file into a directory that is searched before the legitimate location. The privileged EquiTriton process then loads the attacker's file and executes its code within the elevated security context. The attack falls in the Ring 3 user-application boundary, meaning kernel privileges are not directly abused, but user-context privilege elevation is achieved.

Exploitation requires passive user interaction, such as the privileged user launching or interacting with the affected application. This makes the flaw a viable persistence and escalation primitive on multi-user endpoints, developer workstations, and shared analysis systems.

Root Cause

The root cause is improper control of the resource resolution path used by EquiTriton at load time. The application does not enforce absolute paths, does not validate the integrity or origin of loaded modules, and does not restrict the search order to trusted, non-writable directories. This allows path-based hijacking through DLL search order abuse on Windows or LD_LIBRARY_PATH and PATH abuse on Linux-style environments.

Attack Vector

The attack vector is local. An unprivileged attacker plants a malicious library or executable in a directory that appears earlier in the search order than the legitimate resource. When a privileged user runs EquiTriton, the loader resolves the attacker's file first and executes it with the privileged user's rights. No network access is required, and no special internal knowledge of the application is needed to stage the attack.

Refer to the Intel Security Advisory SA-01473 for vendor-specific technical detail and fixed commit information.

Detection Methods for CVE-2026-28700

Indicators of Compromise

Unexpected DLL, shared object, or executable files appearing in directories writable by non-privileged users but referenced in EquiTriton's search path
EquiTriton processes loading modules from user-writable directories such as user profile folders or temporary paths
New or modified files with names matching legitimate EquiTriton dependencies located outside the official install directory

Detection Strategies

Enumerate EquiTriton install locations and audit the effective library and executable search order for user-writable directories
Monitor process image and module load events for EquiTriton binaries resolving dependencies outside expected trusted paths
Correlate elevated child-process creation from EquiTriton with recent file-write activity from unprivileged accounts

Monitoring Recommendations

Enable module load telemetry (Sysmon Event ID 7 or equivalent EDR sensor) filtered on EquiTriton process names
Alert on privileged process executions that load modules from %TEMP%, %APPDATA%, or user home directories
Baseline the expected dependency set for EquiTriton and flag deviations in module hash or load path

How to Mitigate CVE-2026-28700

Immediate Actions Required

Upgrade EquiTriton to a build that includes commit f5ddbb5 or later as referenced in Intel Security Advisory SA-01473
Restrict execution of EquiTriton to trusted directories that are not writable by unprivileged users
Audit and remove any suspicious binaries in directories referenced by the EquiTriton search path

Patch Information

The vulnerability is remediated in EquiTriton builds that include commit f5ddbb5. Reference the Intel Security Advisory SA-01473 for the authoritative fix reference and any additional configuration guidance from the vendor.

Workarounds

Remove user-writable directories from system and per-process PATH and library search environment variables where EquiTriton runs
Enforce least privilege so that the accounts invoking EquiTriton do not double as targets for local unprivileged users to influence
Apply application allowlisting to prevent unsigned or unexpected modules from loading into privileged EquiTriton processes

bash

# Configuration example: verify EquiTriton search path does not include user-writable directories
# Linux
ldd /path/to/equitriton/binary
echo "$LD_LIBRARY_PATH" | tr ':' '\n' | while read d; do
  [ -w "$d" ] && echo "WARNING: writable search dir: $d"
done

# Windows (PowerShell) - inspect DLL search order for user-writable entries
$env:PATH.Split(';') | ForEach-Object {
  if (Test-Path $_ -PathType Container) {
    try {
      $acl = Get-Acl $_
      if ($acl.Access | Where-Object { $_.IdentityReference -match 'Users' -and $_.FileSystemRights -match 'Write' }) {
        Write-Warning "User-writable PATH entry: $_"
      }
    } catch {}
  }
}