CVE-2026-19191 in DrivePool
Summary
by MITRE • 08/07/2026
A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\DrivePool\DrivePool.Service.exe of the component DrivePoolService. Such manipulation leads to permission issues. The attack must be carried out locally. The exploit has been disclosed publicly and may be used.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability in StableBit DrivePool 2.3.13.1687 represents a critical local privilege escalation issue within the DrivePool.Service.exe component that operates with elevated system privileges. The flaw exists in the service executable located at C:\Program Files\StableBit\DrivePool\DrivePool.Service.exe and specifically affects code execution pathways that handle permission management operations. The vulnerability stems from inadequate access control mechanisms within the service implementation, creating opportunities for local attackers to manipulate system permissions through direct code manipulation or exploitation of improper privilege handling routines.
The technical nature of this vulnerability aligns with common software security weaknesses documented in CWE-284, which addresses improper access control issues in software implementations. The attack vector requires local system access, meaning an attacker must already have user-level credentials on the target machine to exploit this weakness. However, once executed successfully, the exploit can potentially elevate privileges from standard user to administrative level, allowing full system compromise. This represents a significant risk because DrivePool Service typically runs with elevated privileges to manage storage pooling operations, creating a privileged execution environment that becomes compromised.
From an operational impact perspective, this vulnerability creates substantial risk for organizations using StableBit DrivePool software since it enables local attackers to gain unauthorized access to system resources and potentially escalate their privileges. The public disclosure of exploitation techniques means that malicious actors can readily leverage this weakness without requiring advanced technical skills or specialized tools. Organizations relying on drive pooling solutions for storage management face particular exposure since the service operates continuously with elevated permissions, providing persistent attack surfaces for privilege escalation attempts.
The security implications extend beyond immediate privilege escalation to encompass broader system compromise potential through the ATT&CK framework's privilege escalation tactics and techniques. This vulnerability could serve as an initial access point for more sophisticated attacks, potentially enabling lateral movement within network environments or persistent threat actor operations. Mitigation strategies should focus on immediate patching of the DrivePool software to version 2.3.13.1688 or later, which addresses this specific permission handling flaw. Additionally, system administrators should implement least privilege principles by reviewing service account permissions and ensuring that DrivePool.Service.exe operates with minimal required privileges, particularly if the vulnerability cannot be immediately patched. Network segmentation and endpoint protection measures can provide additional defense-in-depth layers to prevent exploitation attempts and contain potential compromise scenarios.