CVE-2026-38766 Overview
CVE-2026-38766 is a local privilege escalation vulnerability affecting Unistal Systems Pvt. Ltd. Protegent 360 version 2.0.0.4. The flaw resides in the sub_186f4 function within the product's kernel-mode component. A local attacker with the ability to execute code on an affected host can leverage the function to elevate privileges on the system.
Protegent 360 is a consumer and small-business endpoint security suite that ships a kernel driver to support its anti-virus features. Vulnerabilities in signed anti-virus drivers are attractive to attackers because successful exploitation grants SYSTEM or kernel-level execution from an unprivileged context.
Critical Impact
A local, low-privileged user can escalate to elevated privileges through the affected kernel routine in Protegent 360 v2.0.0.4.
Affected Products
- Unistal Systems Pvt. Ltd. Protegent 360 v2.0.0.4
- Kernel driver component exposing the sub_186f4 function
- Windows endpoints running the affected Protegent 360 build
Discovery Timeline
- 2026-07-22 - CVE-2026-38766 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-38766
Vulnerability Analysis
The vulnerability is a local privilege escalation issue triggered through the sub_186f4 function in Protegent 360 v2.0.0.4. The function name (sub_186f4) is a reverse-engineering artifact assigned by disassemblers such as IDA Pro when a routine has no exported symbol, indicating the flaw was identified through binary analysis of the product's kernel driver.
An attacker with local code execution on a system running the affected Protegent 360 build can interact with the driver interface and reach the vulnerable routine. Successful exploitation results in elevated privileges, enabling actions such as disabling security controls, installing persistent implants, or accessing protected data.
Additional technical detail is available in the Dreadsec vulnerability report on Protegent kernel anti-virus vulnerabilities.
Root Cause
The root cause is improper validation or access control within the sub_186f4 routine of the Protegent 360 kernel component. Kernel drivers typically expose functionality through I/O Control (IOCTL) handlers, and insufficient checks on caller privileges, input buffers, or requested operations allow untrusted user-mode code to invoke privileged behavior.
Attack Vector
The attack vector is local. An attacker must already be able to run code on the target system as a standard user. From that position, the attacker issues crafted requests to the vulnerable driver interface exposed by Protegent 360, reaching the sub_186f4 function and obtaining elevated privileges. Public advisory content describes the finding in the Dreadsec write-up and the associated researcher's GitHub profile. No verified public exploit code has been catalogued in the enriched data.
No verified exploit code is provided in the CVE record. Refer to the linked advisory for technical specifics on the vulnerable routine.
Detection Methods for CVE-2026-38766
Indicators of Compromise
- Unexpected process creation by low-privilege users that subsequently runs with SYSTEM or elevated tokens on hosts running Protegent 360 v2.0.0.4.
- Anomalous DeviceIoControl calls from non-administrative processes to the Protegent kernel driver device object.
- Loading of the affected Protegent 360 driver on endpoints where the software is not officially deployed.
Detection Strategies
- Inventory endpoints for Protegent 360 v2.0.0.4 and flag any host still running the vulnerable build.
- Alert on token manipulation, parent-child mismatches, and integrity level changes for processes running in the context of Protegent components.
- Correlate driver load events (Windows Event ID 6 in Sysmon) with subsequent privileged process launches by non-administrative users.
Monitoring Recommendations
- Enable kernel driver load auditing and forward events to a centralized log platform for review.
- Monitor for user-mode processes opening handles to Protegent driver device paths outside of the vendor's own service processes.
- Track privilege escalation telemetry, including SeDebugPrivilege acquisition and access token duplication tied to non-administrator users.
How to Mitigate CVE-2026-38766
Immediate Actions Required
- Identify all systems running Unistal Protegent 360 v2.0.0.4 and prioritize them for remediation.
- Restrict local logon and code execution on affected hosts to trusted administrative users until a fix is available.
- Contact Unistal Systems support for guidance on a patched build or updated driver.
Patch Information
No vendor advisory URL or patched version is listed in the enriched CVE data at the time of publication. Administrators should consult Unistal Systems directly and monitor the Dreadsec vulnerability report for updates on a corrected release.
Workarounds
- Remove or disable Protegent 360 v2.0.0.4 on affected endpoints where an equivalent, up-to-date endpoint protection product can be deployed.
- Apply the Microsoft Vulnerable Driver Blocklist and Windows Defender Application Control policies to prevent loading of the vulnerable driver if it is not required.
- Limit local interactive access and enforce least-privilege on user accounts to reduce the population of principals able to reach the local attack surface.
# Example: query installed Protegent 360 version on Windows endpoints
wmic product where "Name like 'Protegent%%'" get Name,Version
# Example: list loaded drivers to confirm presence of the affected component
driverquery /v /fo csv | findstr /i "protegent unistal"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
