Intego Antivirus for Windows: Local privilege escalation via optimization module
Summary
Intego Antivirus for Windows through 3.0.0.1 contains a link-following flaw in its optimization module. A local user with low privileges can abuse a junction to delete arbitrary folders and, by abusing Windows Installer rollback, execute code as SYSTEM. The attack requires a local account and no user interaction; the product is not reachable from the internet.
Affected
- Intego Antivirus for Windows through 3.0.0.1
- Default configuration: versions after 3.0.0.1 are not affected according to the CVE record
Fixed in
- Unknown. No vendor advisory or fixed build found.
- A third-party source recommends updating to a version later than 3.0.0.1; no specific build is named.
Workaround
- No vendor workaround known.
Exploitation
- CISA SSVC: exploitation PoC, not automatable, total technical impact.
- Not listed in CISA KEV.
- No known exploitation according to RedPacket Security.
- A detailed public technical write-up by Quarkslab exists.
Our recommendation
- Check whether Intego Antivirus for Windows is installed on any endpoint; if not, no action is needed.
- Restrict local interactive logon on shared machines and limit local accounts.
- Ask Intego in writing for a patch date and update as soon as a fixed version is released.
- If no fix becomes available, evaluate replacing the product.
- Monitor endpoints for unusual folder deletions or Windows Installer rollback activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Quarkslab: Milking the last drop of Intego blog.quarkslab.com
- VulnCheck advisory www.vulncheck.com
- VulDB CVE-2026-107707 vuldb.com
- Strix CVE-2026-107707 www.strix.ai
- Intego www.intego.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:07.
Original description (NVD)
Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.