CVE-2026-120232 Horizon DataSys CVE debrief

Who should care

Defenders of systems using Horizon DataSys Reboot Restore Standard up to 13.2 should assess exposure and prioritize patching or compensating controls. This includes reviewing system logs for potential exploitation attempts and verifying if patching is feasible. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-120232 is a local privilege escalation vulnerability in Horizon DataSys Reboot Restore Standard up to 13.2. Defenders should assess exposure, prioritize patching or compensating controls, and monitor system logs.

• Local systems may be vulnerable to memory corruption
• Patching or compensating controls may be necessary
• System logs should be monitored for potential exploitation attempts

Technical summary

The vulnerability impacts the function sub_23908 in the library shield.sys of the component Kernel Driver in Horizon DataSys Reboot Restore Standard up to 13.2, leading to memory corruption. The attack requires local access. This vulnerability affects systems using Horizon DataSys Reboot Restore Standard up to 13.2, and defenders should assess exposure and prioritize patching or compensating controls accordingly. The CVE record and NVD entry provide details on the vulnerability, but specific version details and exploitation scope require further verification.

Defensive priority

Assess exposure of local systems using Horizon DataSys Reboot Restore Standard up to 13.2 and verify if patching is feasible.

Recommended defensive actions

• Assess exposure of local systems using Horizon DataSys Reboot Restore Standard up to 13.2
• Verify if patching is feasible and prioritize accordingly
• Monitor system logs for potential memory corruption attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, specific version details and exploitation scope require further verification. Defenders should verify if patching is feasible and prioritize accordingly. The vulnerability impacts the function sub_23908 in the library shield.sys of the component Kernel Driver in Horizon DataSys Reboot Restore Standard up to 13.2, leading to memory corruption. The attack requires local access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.