Privilege Escalation Vulnerability in ESET AV Remover

The French National Cybersecurity Agency (ANSSI) has published an advisory regarding a security vulnerability found in ESET AV Remover, an ESET utility used for uninstalling antivirus software. The vulnerability, tracked as CVE-2026-12858, permits an attacker with local access to the system to escalate privileges. This flaw resides in versions of AV Remover prior to 1.6.17.0. Security teams should prioritize patching this utility, as successful exploitation enables an attacker to move from a lower-privileged user context to higher-level access, potentially resulting in full system compromise. The issue was disclosed by ESET in their security bulletin ca9000 on September 9, 2026.

Impact

Successful exploitation of CVE-2026-12858 allows an attacker to achieve privilege escalation on a compromised machine. This grants the attacker the ability to execute code with elevated rights, bypass standard security controls, and perform unauthorized modifications to the operating system or installed applications.

Recommendation

Update all instances of ESET AV Remover to version 1.6.17.0 or later immediately to mitigate CVE-2026-12858. Consult the ESET security bulletin ca9000 for specific deployment procedures regarding the patch.