CVE-2026-6423: ESET Inspect Connector Privilege Escalation

CVE-2026-6423 Overview

CVE-2026-6423 is a local privilege escalation vulnerability in the ESET Inspect Connector for Windows. The flaw stems from improper authentication on an Advanced Local Procedure Call (ALPC) inter-process communication (IPC) channel. A local, low-privileged attacker can interact with the exposed IPC endpoint and escalate to the security context of the connector service. ESET has released a fixed version and published a customer advisory describing the issue and remediation guidance.

Critical Impact
Local low-privileged users can escalate privileges to a high-integrity service account by abusing an unauthenticated ALPC IPC channel exposed by ESET Inspect Connector on Windows.

Affected Products

ESET Inspect Connector for Windows (versions prior to the fixed release published in the ESET customer advisory)

Discovery Timeline

2026-07-16 - CVE-2026-6423 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-6423

Vulnerability Analysis

CVE-2026-6423 is classified under [CWE-269] Improper Privilege Management. The ESET Inspect Connector service exposes an ALPC-based IPC endpoint on Windows. The endpoint accepts requests without adequately authenticating the caller. Because the service runs at a higher privilege level than standard users, any local process able to reach the IPC endpoint can issue privileged operations through it. Exploitation requires local access and low privileges but no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the affected host.

Root Cause

The root cause is missing or insufficient authentication on the IPC channel used by the ESET Inspect Connector. ALPC ports are commonly used by Windows services for high-performance local communication. When a service fails to validate the identity and authorization of the connecting client, low-privileged callers can invoke privileged handlers exposed by the service. This design flaw allows abuse of trust between the client and the higher-privileged endpoint.

Attack Vector

An attacker must first obtain code execution on the host as a low-privileged local user. The attacker then connects to the ALPC port exposed by the ESET Inspect Connector service and issues crafted messages to the unauthenticated handlers. Because the service processes the messages under its own privileged context, the attacker gains code execution or influence at that elevated privilege level. Remote exploitation is not possible; the attack requires prior local access.

No public proof-of-concept exploit code is available. Refer to the ESET Customer Advisory on Privilege Escalation for vendor-supplied technical detail.

Detection Methods for CVE-2026-6423

Indicators of Compromise

Unexpected child processes spawned by the ESET Inspect Connector service (EIConnector.exe or associated service binary) running under NT AUTHORITY\SYSTEM.
Non-administrative local user sessions initiating ALPC connections to the ESET Inspect Connector service port.
New or modified privileged files, services, or scheduled tasks created shortly after low-privileged process activity on the host.

Detection Strategies

Monitor process creation events (Windows Event ID 4688 or Sysmon Event ID 1) where a low-integrity parent triggers privileged actions through the connector service.
Correlate service-account process launches with preceding local logon events from non-administrative users.
Baseline expected client processes that legitimately communicate with ESET Inspect Connector and alert on deviations.

Monitoring Recommendations

Enable detailed process and command-line auditing on hosts running ESET Inspect Connector.
Ingest Windows security and Sysmon telemetry into a centralized analytics platform for correlation across endpoints.
Track version and patch level of ESET Inspect Connector across the fleet and alert on hosts still running vulnerable builds.

How to Mitigate CVE-2026-6423

Immediate Actions Required

Upgrade ESET Inspect Connector for Windows to the fixed version identified in the ESET customer advisory.
Inventory all Windows endpoints running ESET Inspect Connector and prioritize patch deployment on multi-user and high-value systems.
Restrict local logon and code execution rights on hosts running the connector to reduce the pool of potential attackers.

Patch Information

ESET has released a fixed version of ESET Inspect Connector for Windows that corrects the authentication logic on the affected IPC channel. Consult the ESET Customer Advisory on Privilege Escalation for exact fixed version numbers and upgrade instructions.

Workarounds

No official workaround replaces patching; apply the vendor update as the primary remediation.
Limit interactive and remote local access on affected hosts to trusted administrators until the patch is deployed.
Enforce application allowlisting to block untrusted binaries from executing and reaching the IPC endpoint on unpatched systems.

bash

# Verify ESET Inspect Connector version on Windows (PowerShell)
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*ESET Inspect Connector*" } | Select-Object Name, Version