CVE-2026-8501: High severity PC Tools PCTCore64.sys (PC Tools Internet Security) vulnerability
Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or load the affected driver can exploit this vulnerability to perform sensitive and privileged operations on the target system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
PCTCore64.sys (PCTCoreDriver)from your environment.Uninstall or remove the PCTCore64.sys driver (PCTCoreDriver) from systems where it is installed if the driver is not required.
- Configuration
Modify the device object's security descriptor to prevent user-mode processes from opening the PCTCoreDriver device and invoking privileged IOCTL handlers; grant access only to Administrators and SYSTEM.
PCTCoreDriver WDM device interface device security descriptor / access control = restrict access to Administrators and SYSTEM - Compensating control
Prevent non-privileged users from loading or accessing the PCTCore64.sys driver (for example, block loading of the driver via endpoint control or enforce driver-loading policies) and restrict local access to systems where the driver is installed.
- Operational
Audit and inventory endpoints for the presence of PCTCore64.sys / PCTCoreDriver; isolate or remediate affected systems, remove the driver where appropriate, and monitor for signs of attempted or successful exploitation of the PCTCoreDriver device interface.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8501?
CVE-2026-8501 has a high severity rating of 7.8 based on the CVSS 3.1 scoring system.
How do I fix CVE-2026-8501?
To fix CVE-2026-8501, ensure that you update or patch the PC Tools PCTCore64.sys driver as soon as an update is provided by the vendor.
What causes CVE-2026-8501?
CVE-2026-8501 is caused by improper access control in the PCTCore64.sys Windows kernel driver that allows unauthorized access to privileged IOCTL handlers.
Who could be affected by CVE-2026-8501?
Local attackers with the ability to access or load the affected driver within PC Tools Internet Security could exploit CVE-2026-8501.
What are the potential impacts of CVE-2026-8501?
Exploitation of CVE-2026-8501 could lead to unauthorized access to sensitive data and allow attackers to execute arbitrary code with elevated privileges.