Executive brief
A security vulnerability in the Norton Secure VPN installer for Windows could allow a user with limited permissions to gain full administrative control over a computer. By manipulating temporary files during the installation process, an attacker can trick the software into deleting or replacing critical system files. This could lead to a complete takeover of the affected machine or a permanent disruption of services.
Technical details
A privilege escalation vulnerability exists in Norton Secure VPN (specifically version 6.5.0.59) due to insecure file operations during installation via the Microsoft Store. The installer, running with High Integrity privileges, attempts to decompress and verify a 7z file located in a user-writable directory (C:\ProgramData\NortonInstaller\Settings\). If the hash verification fails or the registry key is missing, the installer deletes the decompressed files. An attacker can exploit this by using a Windows Junction or Mount Point to redirect these deletion operations to arbitrary system files. By deleting protected files, an attacker can achieve arbitrary file deletion as SYSTEM, which can be leveraged to gain full administrative privileges.
Affected products
- Gen Digital (NortonLifeLock) Norton Secure VPN 6.5.0.59
Timeline
- 2026-05-04: disclosed: Vulnerability disclosed by Cisco Talos and NVD
- 2026-05-04: advisory