CVE-2026-38765 in Protegent 360
Summary
by MITRE • 07/23/2026
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability in Unistal Systems Pvt. Ltd. Protegent 360 v2.0.0.4 represents a critical privilege escalation flaw within the kernel driver component pgsecdl.sys that exposes the system to local attackers seeking elevated access rights. This issue stems from improper input validation and insufficient privilege checks within the driver's implementation, creating a pathway for malicious actors with local system access to execute arbitrary code with kernel-level privileges. The vulnerability specifically affects the driver's handling of user-mode requests that are processed in kernel context, where inadequate boundary checking and privilege verification mechanisms allow attackers to manipulate driver functionality and gain unauthorized administrative access.
The technical flaw manifests through improper validation of input parameters passed to the pgsecdl.sys driver during kernel execution. When legitimate users interact with the driver through system calls or device ioctls, the driver fails to adequately validate the legitimacy and scope of these requests before executing privileged operations. This weakness enables attackers to craft malicious input sequences that trigger unintended code paths within the driver, potentially leading to arbitrary code execution in kernel space. The vulnerability can be categorized as a privilege escalation issue under CWE-264, specifically related to permissions and access control failures in kernel-mode components. The flaw exploits the principle of least privilege by allowing local users to bypass normal security boundaries that should prevent non-administrative users from accessing kernel-level functionality.
The operational impact of this vulnerability is severe as it transforms a local user account into an administrative-level attacker with complete system control. Once exploited, the attacker can modify system files, disable security features, install malicious software, and potentially establish persistent backdoors within the protected environment. The attack surface extends beyond simple privilege escalation to include potential data exfiltration, system instability, and complete compromise of the affected system's integrity. This vulnerability particularly affects systems running Windows operating systems where Protegent 360 is installed, as the driver operates at kernel level and interacts directly with critical system resources. The impact aligns with ATT&CK technique T1068 which describes 'Exploitation for Privilege Escalation' and T1547.001 'Registry Run Keys / Startup Folder' which may be leveraged post-exploitation to maintain persistence.
Mitigation strategies should include immediate patching of the affected software version by downloading the latest update from Unistal Systems Pvt. Ltd. administrators should also consider disabling or removing the vulnerable driver component if the software is no longer supported or if patches are unavailable. System hardening measures including kernel patch protection, driver signature enforcement, and privilege separation should be implemented to reduce the attack surface. Network segmentation and monitoring for unusual driver activity can help detect exploitation attempts. Additionally, implementing proper access controls and regularly auditing system configurations will help prevent unauthorized local access that could lead to exploitation of this vulnerability. Organizations should also consider employing endpoint detection and response solutions that can identify anomalous behavior indicative of kernel-level privilege escalation attempts. The vulnerability demonstrates the critical importance of maintaining up-to-date security software and conducting regular vulnerability assessments to identify and remediate similar issues in system drivers.