CVE-2026-38765 Overview
CVE-2026-38765 is a local privilege escalation vulnerability in Unistal Systems Pvt. Ltd. Protegent 360 version 2.0.0.4. The flaw resides in the kernel driver pgsecdl.sys, which ships as part of the Protegent 360 security suite. A local attacker with an unprivileged account can abuse the driver to elevate to SYSTEM on affected Windows hosts. Because the vulnerable component is a signed kernel-mode driver, successful exploitation grants ring-0 execution and full control over the operating system.
Critical Impact
Local attackers can escalate to SYSTEM-level privileges through the pgsecdl.sys kernel driver, undermining endpoint integrity and enabling further post-exploitation actions.
Affected Products
- Unistal Systems Pvt. Ltd. Protegent 360 v2.0.0.4
- Kernel driver component: pgsecdl.sys
- Windows endpoints running the affected Protegent 360 build
Discovery Timeline
- 2026-07-22 - CVE-2026-38765 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-38765
Vulnerability Analysis
CVE-2026-38765 affects pgsecdl.sys, a kernel-mode driver bundled with Protegent 360. Kernel drivers execute at the highest privilege level of the operating system. Any exposure of privileged functionality to unprivileged callers can be abused for local privilege escalation [CWE-269].
The DreadSec Vulnerability Report documents multiple issues in the Protegent kernel anti-virus components. The advisory describes weaknesses in how the driver exposes its device interface and validates requests originating from user mode.
Root Cause
The root cause lies in insufficient access control and input validation on the pgsecdl.sys device interface. The driver accepts IOCTL requests from unprivileged callers and performs privileged operations without validating caller identity or the trustworthiness of supplied parameters. See the DreadSec Vulnerability Report for the technical breakdown.
Attack Vector
Exploitation requires local access with a standard user account. The attacker opens a handle to the driver device object and issues crafted I/O control requests to trigger the privileged code path. The result is arbitrary code execution or memory manipulation in kernel context, allowing the attacker to modify the current process token and gain SYSTEM privileges.
Refer to the DreadSec Vulnerability Report and the researcher's GitHub Repository Overview for additional context.
Detection Methods for CVE-2026-38765
Indicators of Compromise
- Unexpected handle opens to the pgsecdl.sys device object from non-Protegent processes.
- User-mode processes issuing IOCTLs to the Protegent driver outside normal product workflows.
- Standard user processes suddenly running with SYSTEM or elevated tokens after interacting with pgsecdl.sys.
Detection Strategies
- Monitor for driver load events for pgsecdl.sys on hosts that are not authorized to run Protegent 360.
- Alert on token manipulation patterns following interactions with the Protegent device interface.
- Correlate process integrity level changes with prior IOCTL activity against known-vulnerable driver names.
Monitoring Recommendations
- Enable kernel driver load auditing and forward events to a centralized log store.
- Track parent-child process relationships to catch privilege escalation chains launched from unprivileged users.
- Deploy application control policies that log and block untrusted binaries interacting with the affected driver.
How to Mitigate CVE-2026-38765
Immediate Actions Required
- Inventory endpoints running Protegent 360 v2.0.0.4 and identify systems exposing pgsecdl.sys.
- Restrict local logon on systems where the driver is present until a vendor patch is applied.
- Contact Unistal Systems for a fixed build or removal guidance before continuing production use.
Patch Information
At the time of NVD publication on 2026-07-22, no vendor advisory URL or fixed version is listed in the CVE record. Administrators should consult Unistal Systems Pvt. Ltd. directly and monitor the DreadSec Vulnerability Report for updates.
Workarounds
- Uninstall Protegent 360 v2.0.0.4 on hosts where the product is not strictly required.
- Block loading of pgsecdl.sys using Windows Defender Application Control (WDAC) or a driver blocklist policy.
- Limit interactive and remote logon rights to trusted administrators to reduce local attack surface.
# Example: query for the vulnerable driver on Windows endpoints
sc.exe query type= driver | findstr /I "pgsecdl"
driverquery /v | findstr /I "pgsecdl.sys"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
