PT-2026-8316 · Total Vpn+1 · Total Vpn+1

Cyber-Wo0Dy · Published 2026-02-16 · Updated 2026-02-21 · CVE-2026-2542

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Total VPN version 0.5.29.0

Description A security issue exists in Total VPN 0.5.29.0 on Windows related to an unquoted search path within the file C:Program FilesTotal VPNwin-service.exe. This can lead to potential local privilege escalation. The exploitation of this issue is considered difficult and requires high complexity. The vendor was contacted regarding this issue but did not provide a response.

Recommendations Review directory permissions for the affected file. Monitor the system closely for any suspicious activity.

Fix

LPE

Untrusted Search Path

Weakness Enumeration

CWE-428

CWE-426

Related Identifiers

CVE-2026-2542

Affected Products

Total Vpn

Windows

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-2542 · Security Note
• https://vuldb.com/?submit.749365 · Note
• https://t.me/CVEtracker/44795 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2023303633467514884 · Twitter Post
• https://twitter.com/offseq/status/2023298844633547055 · Twitter Post
• https://twitter.com/cracbot/status/2024801267462410705 · Twitter Post
• https://vuldb.com/?ctiid.346127 · Note
• https://github.com/Cyber-Wo0dy/report/blob/main/totalvpn/0.5.29.0/totalvpn_unquoted_service_path.md · Note
• https://vuldb.com/?id.346127 · Note
• https://twitter.com/CVEnew/status/2023302240518193231 · Twitter Post
• https://t.me/cveNotify/152090 · Telegram Post
• https://twitter.com/cracbot/status/2025163635400814917 · Twitter Post