CVE-2026-27750

High

Published: 05 March 2026

Published

05 March 2026

Modified

01 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0001 1.7th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27750 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Avira Internet Security. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Flaw remediation directly addresses the TOCTOU vulnerability by applying vendor-provided updates to the Avira Optimizer component that fix the lack of path revalidation before deletion.

AC-6 Least Privilege good match

prevent

Least privilege ensures the SYSTEM-level Optimizer service operates with only necessary permissions, preventing deletion of protected system locations even if a junction is substituted during the TOCTOU window.

SI-10 Information Input Validation partial match

prevent

Information input validation requires rechecking target paths for validity and type (e.g., confirming no junctions or reparse points) immediately before the cleanup deletion phase to mitigate the TOCTOU race condition.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

TOCTOU race condition in privileged SYSTEM service enables local low-priv attacker to redirect deletion via junctions/reparse points, directly resulting in arbitrary file/directory removal that achieves local privilege escalation (CWE-367 mapped to T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Avira Internet Security contains a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component. A privileged service running as SYSTEM identifies directories for cleanup during a scan phase and subsequently deletes them during a separate cleanup phase without revalidating the target…

path. A local attacker can replace a previously scanned directory with a junction or reparse point before deletion occurs, causing the privileged process to delete an unintended system location. This may result in deletion of protected files or directories and can lead to local privilege escalation, denial of service, or system integrity compromise depending on the affected target.

Deeper analysisAI

CVE-2026-27750 is a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component of Avira Internet Security. A privileged service running as SYSTEM identifies directories for cleanup during a scan phase and deletes them in a subsequent cleanup phase without revalidating the target path. This affects Avira Internet Security products, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition).

A local attacker with low privileges can exploit this vulnerability by replacing a previously scanned directory with a junction or reparse point before the deletion phase. This causes the privileged process to delete an unintended system location, potentially resulting in the removal of protected files or directories. Depending on the targeted location, outcomes may include local privilege escalation, denial of service, or system integrity compromise.

Vendor advisories provide mitigation guidance, including updates to current Avira versions, as detailed on the Avira support page (https://support.avira.com/hc/en-us/articles/360010656158-Current-Avira-versions), the Avira Internet Security product page (https://www.avira.com/en/internet-security), and Gen Digital security advisories (https://www.gendigital.com/us/en/contact-us/security-advisories/).