Is CVE-2026-8501 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8501 being exploited in the wild.

How severe is CVE-2026-8501?

Informational severity, with a CVSS score of 0, published 1 June 2026.

Which products and versions are affected?

PC Tools Internet Security All versions (discontinued).

Is there a fix for CVE-2026-8501?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8501 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-8501?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8501: PC Tools Internet Security improper access control in PCTCore64.sys

CVE-2026-8501 · Severity: info · CVSS 0 · Published 2026-06-01

A security vulnerability exists in a legacy Windows driver from PC Tools Internet Security, a discontinued antivirus product. This driver fails to properly restrict who can communicate with it, allowing malicious software already on a computer to perform highly privileged actions. An attacker could use this to steal login credentials, bypass security software like Microsoft Defender, or crash the system.

Quick answers

Is CVE-2026-8501 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8501 being exploited in the wild.
How severe is CVE-2026-8501?: Informational severity, with a CVSS score of 0, published 1 June 2026.
Which products and versions are affected?: PC Tools Internet Security All versions (discontinued).
Is there a fix for CVE-2026-8501?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8501 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-8501?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The PCTCore64.sys kernel driver creates a Windows Driver Model (WDM) device object (\\.\PCTCoreDriver) without a restrictive security descriptor, failing to use SDDL or IoCreateDeviceSecure. This allows unprivileged user-mode processes to open handles to the device and issue IOCTL requests. Attackers can leverage these handlers to obtain PROCESS_ALL_ACCESS handles to sensitive processes like lsass.exe, extract NTLM/Kerberos credentials, and terminate Protected Process Light (PPL) processes. While the product is discontinued, the driver remains signed and is susceptible to 'Bring Your Own Vulnerable Driver' (BYOVD) attacks. Organizations should implement Microsoft's recommended driver block rules to mitigate this risk.

Affected products

PC Tools Internet Security All versions (discontinued)

Timeline

2026-03-26: other: Microsoft notified of the vulnerability.
2026-06-01: disclosed: Vulnerability details made public by CERT/CC.
2026-06-01: advisory: NVD published CVE-2026-8501.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.