Executive brief
Protegent 360 is an antivirus and data security suite designed to protect Windows systems from malware and unauthorized file access. A vulnerability in its kernel drivers allows any local user, even those with restricted guest access, to bypass security protections and gain full administrative control over the computer. This could allow an attacker to disable the antivirus, delete critical system files, or install persistent malware that is difficult to remove.
Technical details
A privilege escalation vulnerability exists in the kernel-mode drivers (wscsrv.sys and pgsecdl.sys) of Protegent 360 v2.0.0.4. The drivers create device objects with no security descriptors and expose IOCTL interfaces with FILE_ANY_ACCESS, allowing unprivileged local users to communicate with them. Specifically, the sub_186f4 function (and related IOCTL handlers) lacks access control checks, enabling an attacker to perform kernel-mode writes to protected directories like C:\Windows\system32 via ZwWriteFile, disable process protection, or modify security rules. This effectively allows a low-privileged user to achieve SYSTEM-level execution or bypass all filesystem security filters.
Affected products
- Unistal Systems Pvt. Ltd. Protegent 360 2.0.0.4
Timeline
- 2026-05-21: disclosed: Initial research published by DreadSec
- 2026-07-22: advisory: CVE-2026-38766 published by NVD/MITRE