# CVE-2026-75882: ESET Endpoint Encryption privilege escalation in kernel driver

Source: https://junglewise.ai/threats/cve-2026-75882-an-improper-access-control-vulnerability-in-eset-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-75882 · Severity: info · Published 2026-10-30

ESET Endpoint Encryption and Full Disk Encryption are Windows security products that protect sensitive data on computers. An improper access control flaw in the kernel driver allows a standard user to send specially crafted requests to privileged kernel components, potentially leading to unauthorized access to encrypted data, forced authentication to remote systems, or data loss. An attacker needs only standard user access on an affected system to exploit this vulnerability.

Vendors: [Eset](https://junglewise.ai/threats/vendors/eset).

## Quick answers

**Is CVE-2026-75882 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75882 being exploited in the wild.

**How severe is CVE-2026-75882?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Eset Endpoint Encryption 5.4.23.0 and earlier for Windows; Eset Full Disk Encryption 2.4.4.0 and earlier for Windows.

**Is there a fix for CVE-2026-75882?** Yes: fixed in ESET Endpoint Encryption 5.4.29.0 and later for Windows; ESET Full Disk Encryption 2.4.8.0 and later for Windows. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75882 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-75882?** Check whether you run Eset Endpoint Encryption or Eset Full Disk Encryption at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ESET Endpoint Encryption 5.4.29.0 and later for Windows; ESET Full Disk Encryption 2.4.8.0 and later for Windows

## Technical details

The vulnerability is an improper access control flaw in the kernel driver interface of ESET's encryption products. A standard user (PR:L) can directly access a privileged kernel driver device interface and send specially crafted requests; the driver fails to validate the caller's permissions and executes the requests under SYSTEM privileges (VC:H, VI:H, VA:H). This enables disclosure of disk metadata, coerced remote authentication, or denial of access to encrypted volumes.

## Affected products

- ESET Endpoint Encryption 5.4.23.0 and earlier for Windows
- ESET Full Disk Encryption 2.4.4.0 and earlier for Windows

## Timeline

- 2026-10-29: disclosed
- 2026-10-29: patched
- 2026-10-30: advisory

## References

- [https://support.eset.com/en/ca9033-eset-customer-advisory-improper-access-control-vulnerability-in-eset-encryption-products-for-windows-fixed](https://support.eset.com/en/ca9033-eset-customer-advisory-improper-access-control-vulnerability-in-eset-encryption-products-for-windows-fixed)