System Informer: Incorrect authorization in phsvc allows local privilege escalation
Summary
System Informer before 4.0.26241.138 contains an incorrect authorization flaw in its phsvc helper. The privileged API port accepts connections from any Authenticode-signed process, so a local user or malware can reach privileged functions. According to the CVE record, an attacker can load code into a Microsoft-signed host and call the service creation API to run code as SYSTEM. The attacker needs local access and low privileges, and no user interaction is required.
Affected
- System Informer versions 0 to before 4.0.26241.138
Fixed in
- System Informer 4.0.26241.138 or later
Workaround
- No workaround is named in the sources. Upgrading is the fix.
- If System Informer is not needed on an endpoint, uninstall it or remove its service component (recommendation of the research, not stated by a source).
Exploitation
- No known exploitation (RedPacket Security reports no exploitation known; Strix lists KEV as No).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found in the research. The attack path is described publicly by the reporter.
Our recommendation
- Check endpoints for System Informer and the phsvc service.
- Upgrade to 4.0.26241.138 or later where it is installed.
- Prioritise medium for endpoints with System Informer, especially where users have standard accounts.
- Remove the tool where it is not required.
- Monitor for unexpected service creation and unusual processes loading code into signed hosts such as rundll32.exe.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record advisory by VulnCheck www.vulncheck.com
- System Informer release 4.0.26241.138 github.com
- Fix commit ce451a264a424f6f386b1615df651f8364aaeb9f github.com
- Vulnerable code reference svcapiport.c (v3.2.25011.2103) github.com
- System Informer project repository github.com
- RedPacket Security CVE alert www.redpacketsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:06.
Original description (NVD)
System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.
NVD references (5)
- https://github.com/winsiderss/systeminformer
- https://github.com/winsiderss/systeminformer/blob/v3.2.25011.2103/SystemInformer/phsvc/svcapiport.c#L196-L230
- https://github.com/winsiderss/systeminformer/commit/ce451a264a424f6f386b1615df651f8364aaeb9f
- https://github.com/winsiderss/systeminformer/releases/tag/v4.0.26241.138
- https://www.vulncheck.com/advisories/system-informer-before-4.0.26241.138-incorrect-authorization-in-phsvc-al…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.