CVE-2026-12410 Gen Digital CVE debrief

Who should care

System administrators and users of CCleaner on Windows, especially those with high-risk environments or sensitive data, should be aware of this vulnerability. They should verify whether affected product deployments exist in their managed environments and review official advisories for scope, severity, and vendor guidance. Implementing monitoring for suspicious symlink/junction creation and elevated process activity is recommended. Enforcing least privilege for users and processes can help mitigate potential impacts. Regular software inventory reviews are also advised to ensure timely patching of vulnerable components. This vulnerability may impact operators with affected product deployments, platform security teams, and vulnerability management processes. Security teams should prioritize patching and compensating controls for exposed systems while remediation is scheduled and verified. Monitoring and detection logs for exposed assets should be reviewed for extra scrutiny. Exceptions should be tracked, and remediated assets should be retested before closing the item, with evidence documented. This vulnerability may require additional review context for defenders to understand its operational impact and source-confidence limits. Affected product context and defensive impact should be considered when implementing mitigations. Technical framing should be source-grounded without unsupported root-cause or exploit claims. This vulnerability has a high defensive priority due to its high CVSS score and potential for privilege escalation. System administrators and security teams should work together to ensure prompt patching and mitigation of this vulnerability. They should also review compensating controls for exposed systems while remediation is scheduled and verified. Monitoring and detection logs for exposed assets should be reviewed for extra scrutiny. Exceptions should be tracked, and remediated assets should be retested before closing the item, with evidence documented. This vulnerability may require additional review context for defenders to understand its operational impact and source-confidence limits. Affected product context and defensive impact should be be

Technical summary

The Uninstaller component in CCleaner prior to version 7.10.1464 on Windows is vulnerable to a link following attack. A local, low-privileged attacker can create a symlink/junction during application uninstallation, which CCleaner follows when deleting the application's data folder with elevated integrity, allowing for privilege escalation to SYSTEM. This vulnerability has a high CVSS score, indicating a high severity level. System administrators should review and apply vendor patches promptly.

Defensive priority

High priority due to high CVSS score and potential for privilege escalation

Recommended defensive actions

• Verify and apply vendor patch for CCleaner version 7.10.1464 or later
• Implement monitoring for suspicious symlink/junction creation and elevated process activity
• Enforce least privilege for users and processes
• Regularly review and update software inventory
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

Evidence is limited; further verification needed. Official CVE and NVD records provide some details. Vendor information from Gendigital suggests affected product versions. Affected product deployments should be verified for exposure, and defenders should review official advisories for scope, severity, and guidance. Compensating controls may be necessary while patches are applied.

Official resources