PT-2026-35707 · Empia Technology · Avacast

Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7280

Mitre

CVSS v3.1

6.7

Medium

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AVACAST developed by eMPIA Technology has a Unquoted Service Path vulnerability, allowing privileged local attackers to place a malicious executable file in a specific directory, resulting in arbitrary code execution with system privileges when the AVACAST service starts.

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2026-7280

Affected Products

Avacast

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-7280 · Security Note
• https://twcert.org.tw/en/cp-139-10885-02d83-2.html · Note
• https://twcert.org.tw/tw/cp-132-10884-f9c21-1.html · Note