CVE-2026-27748
Avira Internet Security ≤ 1.1.114.3113
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-27748 is a high-severity Link Following (CWE-59) vulnerability in Avira Internet Security. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-27748 is an improper link resolution vulnerability (CWE-59) in the Software Updater component of Avira Internet Security. Published on 2026-03-05, it affects the update process where a privileged service running as SYSTEM deletes a file under C:\ProgramData without validating whether the path resolves through a symbolic link or reparse point. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential from local access.
A local attacker with low privileges can exploit this by creating a malicious symbolic link or reparse point that redirects the delete operation to an arbitrary file. This allows deletion of attacker-chosen files using SYSTEM privileges, potentially leading to local privilege escalation, denial of service, or system integrity compromise, depending on the targeted file and operating system configuration.
Mitigation details are referenced in the following advisories: https://support.avira.com/hc/en-us/articles/360010656158-Current-Avira-versions, https://www.avira.com/en/internet-security, and https://www.gendigital.com/us/en/contact-us/security-advisories/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9820
Vulnerability Data
Avira Internet Security contains an improper link resolution vulnerability in the Software Updater component. During the update process, a privileged service running as SYSTEM deletes a file under C:\\ProgramData without validating whether the path resolves through a symbolic link or…
more
reparse point. A local attacker can create a malicious link to redirect the delete operation to an arbitrary file, resulting in deletion of attacker-chosen files with SYSTEM privileges. This may lead to local privilege escalation, denial of service, or system integrity compromise depending on the targeted file and operating system configuration.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Proper enforcement of access authorizations on the resolved target resource stops a link from reaching an unintended object.
Least-privilege limits the damage an attacker can cause after following an unintended link.
Validating file-name inputs can reject or canonicalize names that resolve to links before access occurs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require code to validate paths and avoid unsafe link following.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect link-following flaws before release.
Secure coding standards directly address canonicalization and symlink attacks during implementation.