Hyland Desktop Host: Local privilege escalation via weak folder permissions
Summary
Hyland Desktop Host for Windows before 25.1.1 runs a privileged Gateway service from a folder that non-privileged users can write to. A local user with a valid account can place a malicious DLL named cryptbase.dll in this folder, which the service loads and executes with LOCAL SERVICE rights on later system boots. The flaw cannot be exploited remotely and requires local logon, but it gives an attacker full control over the affected host's confidentiality, integrity and availability.
Affected
- Hyland Desktop Host for Windows, versions before 25.1.1
- Component: Hyland Desktop Host Gateway service (Hyland.DesktopHost.Gateway.exe)
Fixed in
- Version 25.1.1 (according to the CNA record; not yet confirmed against Hyland's advisory)
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept known so far.
- EPSS 0.00119 (very low).
Our recommendation
- Inventory Windows hosts with Hyland Desktop Host and record the installed versions.
- Obtain Hyland's advisory and confirm the fixed version, then update to 25.1.1 or later as specified by Hyland.
- Until patched, restrict local logon on affected hosts, especially shared terminals, RDS/Citrix hosts and kiosks.
- Check whether non-admin users have write permissions on the Hyland DesktopHost bin folder and restrict them.
- Monitor for an updated advisory or a public proof of concept.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub advisory JNDataRT/Vulns Advisories/2026/1.md github.com
- Vulners CVE-2026-110359 vulners.com
- threatint CVE-2026-110359 cve.threatint.com
- OffSeq radar CVE-2026-110359 radar.offseq.com
- Strix CVE-2026-110359 www.strix.ai
- EUVD-2026-100760 vulners.com
- The Hacker Wire CVE-2026-110359 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:01.
Original description (NVD)
Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.