TotalAV: Local privilege escalation to SYSTEM via forgeable IPC token
Summary
TotalAV up to version 7.1.17 contains a local privilege escalation flaw. A local user without administrative rights can forge the gRPC IPC authentication token, because it is derived from a static secret stored in the product's own DLL, and then abuse the SYSTEM service to execute arbitrary code as NT AUTHORITY\SYSTEM. A public proof of concept exists, and the attack requires only an existing local account on the machine.
Affected
- TotalSecurity TotalAV, versions 0 to 7.1.17 (CNA data; the vendor range is not confirmed)
- Possibly earlier versions, as one mirror of the CVE record states "any version affected"
Fixed in
Unknown. No vendor advisory or fixed version was found.
Workaround
- Restrict local logon to trusted users and keep users on standard accounts.
- Reported option (not verified by the vendor): use AppLocker or Software Restriction Policies to prevent local users from loading IPC.dll from the TotalAV directory. Test before rollout.
- Monitor the TotalAV installation directory for unexpected files or changes.
Exploitation
- Public proof of concept available on GitHub (CISA SSVC: exploitation "poc").
- Not listed in CISA KEV; no reports of exploitation in the wild found.
- Automatable: no (CISA SSVC). EPSS 0.00212.
Our recommendation
- Inventory all TotalAV installations now, especially on shared, unmanaged or multi-user machines, and treat them as high priority.
- Contact TotalAV support to obtain a fixed version and advisory; do not assume any version is patched.
- Until a fix is confirmed, apply the restrictions above or remove TotalAV, and monitor the machines for signs of privilege escalation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-110746 PoC repository (TotalAV-7.1.17-LPE) github.com
- TotalAV vendor website www.totalav.com
- VulDB entry 420657 vuldb.com
- Strix AI CVE record CVE-2026-110746 www.strix.ai
- OpenCVE CVE-2026-110746 app.opencve.io
- Vulnrichment CVE-2026-110746 (SSVC, EPSS) vulners.com
- threatint CVE-2026-110746 cve.threatint.com
- Positive Technologies PT-2026-114946 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:56.
Original description (NVD)
A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.