Horizon DataSys - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/horizon-datasys/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 07:44:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHorizon DataSys Reboot Restore: Local privilege escalation in shield.sys (CVE-2026-120232)https://feed.craftedsignal.io/briefs/2026-11-cve-2026-120232-horizon-datasys/Thu, 05 Nov 2026 07:44:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-120232-horizon-datasys/A proof-of-concept exploit for CVE-2026-120232 has been published, allowing unprivileged local users to escalate privileges to SYSTEM via the shield.sys driver in Horizon DataSys Reboot Restore.A proof-of-concept (PoC) exploit has been released for CVE-2026-120232, a local privilege escalation (LPE) vulnerability in the shield.sys driver used by Horizon DataSys Reboot Restore. The vulnerability affects version 13.2 and earlier. An unprivileged local attacker can leverage this flaw to gain SYSTEM level access on affected Windows systems. The exploit is written in Rust and utilizes Windows APIs to interact with the vulnerable driver.

Impact

Successful exploitation allows a local user with low privileges to execute code with SYSTEM privileges, granting full control over the compromised host.

Recommendation

  • Inventory all systems running Horizon DataSys Reboot Restore version 13.2 or earlier.
  • Apply patches provided by the vendor immediately upon release.
  • Implement strict access controls for local user accounts to prevent unauthorized execution of custom binaries.
  • Monitor for unusual file execution in temp directories or user-writable locations that attempt to interact with system drivers.
]]>highadvisory