CVE-2026-110359 Hyland CVE debrief

Who should care

Defenders and administrators of Hyland Desktop Host for Windows systems should assess exposure and prioritize remediation. This includes reviewing system configurations, verifying the presence of affected versions, and applying necessary patches or mitigations. Security teams and vulnerability management teams should also be aware of the potential impact and take appropriate measures to protect their systems.

Why it matters

CVE-2026-110359 is a local privilege escalation vulnerability in Hyland Desktop Host for Windows before version 25.1.1, allowing local users to escalate privileges due to weak permissions on a privileged service.

• Local privilege escalation can lead to increased access and control
• Weak permissions on privileged services can be exploited by local users

Technical summary

The vulnerability is caused by a privileged service running from the %PROGRAMDATA%//Hyland//DesktopHost//bin folder with weak permissions, allowing local users to escalate privileges. This service is part of Hyland Desktop Host for Windows before version 25.1.1. The weakness in permissions enables local privilege escalation, which can lead to increased access and control within the system. Defenders should prioritize verifying and remediating this vulnerability on affected systems, especially those with local access.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability on affected systems, especially those with local access.

Recommended defensive actions

• Verify and remediate affected systems
• Restrict local access to sensitive folders
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates through normal change control

Evidence notes

The vulnerability is caused by a privileged service running with weak permissions, allowing local users to escalate privileges. The service is located in the %PROGRAMDATA%//Hyland//DesktopHost//bin folder. Evidence is based on the CVE Program record and NIST NVD detail page. Defenders should verify the presence of affected systems and review official advisories for remediation guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.