CVE-2026-8148: Navercorp Mybox Privilege Escalation Flaw

CVE-2026-8148 Overview

CVE-2026-8148 is a local privilege escalation vulnerability in NAVER MYBOX Explorer for Windows. Versions prior to 3.0.11.160 perform improper privilege checks when handling registry operations. A local attacker with low-privileged access can manipulate registry entries to elevate privileges to NT AUTHORITY\SYSTEM. The flaw is tracked under CWE-266: Incorrect Privilege Assignment.

Critical Impact

Successful exploitation grants full SYSTEM-level control over the host, allowing attackers to install software, modify protected files, and persist on the endpoint.

Affected Products

• NAVER MYBOX Explorer for Windows versions prior to 3.0.11.160
• Windows endpoints with NAVER MYBOX cloud storage client installed
• Korean enterprise and consumer deployments of navercorp:mybox

Discovery Timeline

• 2026-05-08 - CVE-2026-8148 published to NVD
• 2026-05-11 - Last updated in NVD database

Technical Details for CVE-2026-8148

Vulnerability Analysis

NAVER MYBOX Explorer is a Windows client for NAVER's cloud storage service. The application includes a component running with elevated privileges that interacts with the Windows registry on behalf of users. The vulnerable build fails to validate whether the calling user possesses the rights required to influence privileged registry operations.

A local attacker who already holds a standard user session can stage controlled values in registry keys consumed by the privileged service. When the service reads those entries without enforcing proper privilege checks, the attacker's input drives operations executed under the SYSTEM account.

Root Cause

The root cause is improper privilege assignment [CWE-266]. The MYBOX Explorer service trusts registry data that any local user can write or influence. Because the privileged process does not verify the origin or integrity of these values before acting on them, low-privileged input crosses a trust boundary into a SYSTEM context.

Attack Vector

Exploitation requires local access and low-level user privileges. No user interaction is needed beyond the attacker's own actions. The attacker writes attacker-controlled data into the registry locations referenced by the MYBOX privileged component, then triggers the operation that consumes those values. The component then performs file, process, or configuration actions as SYSTEM using attacker-influenced parameters.

For specific technical detail on the affected registry paths and corrected privilege checks, refer to the NAVER CVE-2026-8148 advisory.

Detection Methods for CVE-2026-8148

Indicators of Compromise

• Unexpected writes by non-administrative users to registry keys consumed by NAVER MYBOX Explorer services.
• Child processes spawned by MYBOX service binaries running as NT AUTHORITY\SYSTEM with command lines referencing user-writable paths.
• New scheduled tasks, services, or persistence mechanisms created by MYBOX processes shortly after standard-user activity.

Detection Strategies

• Inventory endpoints running NAVER MYBOX Explorer and flag any version earlier than 3.0.11.160.
• Monitor registry modification events (Sysmon Event ID 12/13) targeting MYBOX-related keys from non-privileged tokens.
• Correlate registry writes by low-privileged users with subsequent SYSTEM-context process creations originating from MYBOX binaries.

Monitoring Recommendations

• Forward Sysmon registry and process telemetry to a centralized analytics platform for cross-event correlation.
• Alert on integrity-level transitions where a MYBOX service spawns SYSTEM processes following standard-user registry activity.
• Track unexpected version regressions or reinstallations of the MYBOX client that could revert hosts to vulnerable builds.

How to Mitigate CVE-2026-8148

Immediate Actions Required

• Upgrade NAVER MYBOX Explorer for Windows to version 3.0.11.160 or later on all affected endpoints.
• Restrict local logon rights on systems where the client is installed to reduce the population of users who can exploit the flaw.
• Audit existing MYBOX-related registry entries for anomalous values placed by non-administrative accounts.

Patch Information

NAVER has released a fixed build addressing the improper privilege check. Administrators should deploy version 3.0.11.160 or newer. Refer to the NAVER CVE-2026-8148 advisory for the official remediation guidance and download instructions.

Workarounds

• Where patching is delayed, remove NAVER MYBOX Explorer from systems that do not require it.
• Apply registry permission hardening to block standard users from writing to keys consumed by privileged MYBOX components.
• Limit interactive logon on multi-user systems hosting the client until the patched version is deployed.

# Verify installed NAVER MYBOX Explorer version on Windows endpoints
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*MYBOX*" } |
  Select-Object DisplayName, DisplayVersion, Publisher