CVE-2026-27748

High

Published: 05 March 2026

Published

05 March 2026

Modified

01 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 6.5th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27748 is a high-severity Link Following (CWE-59) vulnerability in Avira Internet Security. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the improper link resolution flaw in the Software Updater by requiring identification, reporting, and timely correction of the vulnerability.

SI-10 Information Input Validation good match

prevent

Requires validation of file paths prior to deletion operations to block resolution through symbolic links or reparse points exploited in this CVE.

AC-6 Least Privilege partial match

prevent

Enforces least privilege on the SYSTEM-level updater service to limit the impact of redirected file deletions to non-critical locations.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1070.004 File Deletion Stealth

Adversaries may delete files left behind by the actions of their intrusion activity.

attack.mitre.org →

Why these techniques?

Vulnerability enables local arbitrary file deletion with SYSTEM privileges via symlink abuse, directly supporting exploitation for privilege escalation (T1068) and indicator removal via targeted file deletion (T1070.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Avira Internet Security contains an improper link resolution vulnerability in the Software Updater component. During the update process, a privileged service running as SYSTEM deletes a file under C:\\ProgramData without validating whether the path resolves through a symbolic link or…

reparse point. A local attacker can create a malicious link to redirect the delete operation to an arbitrary file, resulting in deletion of attacker-chosen files with SYSTEM privileges. This may lead to local privilege escalation, denial of service, or system integrity compromise depending on the targeted file and operating system configuration.

Deeper analysisAI

CVE-2026-27748 is an improper link resolution vulnerability (CWE-59) in the Software Updater component of Avira Internet Security. Published on 2026-03-05, it affects the update process where a privileged service running as SYSTEM deletes a file under C:\ProgramData without validating whether the path resolves through a symbolic link or reparse point. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential from local access.

A local attacker with low privileges can exploit this by creating a malicious symbolic link or reparse point that redirects the delete operation to an arbitrary file. This allows deletion of attacker-chosen files using SYSTEM privileges, potentially leading to local privilege escalation, denial of service, or system integrity compromise, depending on the targeted file and operating system configuration.

Mitigation details are referenced in the following advisories: https://support.avira.com/hc/en-us/articles/360010656158-Current-Avira-versions, https://www.avira.com/en/internet-security, and https://www.gendigital.com/us/en/contact-us/security-advisories/.