{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ahorizon_datasysreboot_restore/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:horizon_datasys:reboot_restore:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-120232"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Reboot Restore (\u003c= 13.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Horizon DataSys"],"content_html":"\u003cp\u003eA proof-of-concept (PoC) exploit has been released for CVE-2026-120232, a local privilege escalation (LPE) vulnerability in the \u003ccode\u003eshield.sys\u003c/code\u003e driver used by Horizon DataSys Reboot Restore. The vulnerability affects version 13.2 and earlier. An unprivileged local attacker can leverage this flaw to gain \u003ccode\u003eSYSTEM\u003c/code\u003e level access on affected Windows systems. The exploit is written in Rust and utilizes Windows APIs to interact with the vulnerable driver.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a local user with low privileges to execute code with \u003ccode\u003eSYSTEM\u003c/code\u003e privileges, granting full control over the compromised host.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all systems running Horizon DataSys Reboot Restore version 13.2 or earlier.\u003c/li\u003e\n\u003cli\u003eApply patches provided by the vendor immediately upon release.\u003c/li\u003e\n\u003cli\u003eImplement strict access controls for local user accounts to prevent unauthorized execution of custom binaries.\u003c/li\u003e\n\u003cli\u003eMonitor for unusual file execution in temp directories or user-writable locations that attempt to interact with system drivers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T07:44:05Z","date_published":"2026-11-05T07:44:05Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-120232-horizon-datasys/","summary":"A proof-of-concept exploit for CVE-2026-120232 has been published, allowing unprivileged local users to escalate privileges to SYSTEM via the shield.sys driver in Horizon DataSys Reboot Restore.","title":"Horizon DataSys Reboot Restore: Local privilege escalation in shield.sys (CVE-2026-120232)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-120232-horizon-datasys/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:horizon_datasys:reboot_restore:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}