CVE-2026-116596: Pyrus Pyrus Sync for Windows vulnerability

Published Oct 26, 2026

Updated

Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service, which allow an attacker with unprivileged access to create files using the ISyncService contract.

Affected Software

1 affected component

Pyrus Pyrus Sync for Windows

Event History

Oct 26, 2026

CVE Published

via MITRE·04:17 PM

Data Sourced

via MITRE·04:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs unprivileged access to a Windows system running Pyrus Sync for Windows. The issue is local, so it does not describe exploitation by a remote unauthenticated attacker.

What capability does exploitation provide?

The missing authorization controls in the PyrusSyncService service allow an unprivileged user to create files through the ISyncService contract. This can be used for local privilege escalation.

Which component should responders verify is present?

Verify whether Pyrus Sync for Windows is installed and whether the PyrusSyncService Windows service is present or running. The provided information does not identify affected versions or configuration prerequisites.

CVE-2026-116596: Pyrus Pyrus Sync for Windows vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What capability does exploitation provide?

Which component should responders verify is present?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What capability does exploitation provide?

Which component should responders verify is present?