{"id":"CVE-2026-6064","kind":"vulnerability","aliases":["CVE-2026-6064"],"related":[],"title":"Norton, Avast and AVG: Data Shredder link flaw gives SYSTEM rights","description":"Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\\SYSTEM privelages.","summary":"The Data Shredder component in Norton Antivirus, Avast Antivirus and AVG Internet Security follows symbolic links during privileged shred operations, allowing arbitrary file and folder deletion. A local low-privileged user can use this to escalate to NT AUTHORITY\\SYSTEM.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avast","avg","endpoint","norton","vendor","windows"],"not_affected_if":["patched-version","product-not-installed"],"how_to_check":"- Check the installed version of Norton, Avast or AVG Internet Security on Windows against `26.5.10933`\n- unknown","fix":"- Update Norton Antivirus, Avast Antivirus and AVG Internet Security to `26.5.10933` or later","status":"open","published_at":"2026-10-28T11:17:26+00:00","first_seen_at":"2026-10-28T11:32:33+00:00","triaged_at":"2026-10-28T11:33:24+00:00","updated_at":"2026-10-28T11:33:24+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-28T11:33:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update Norton Antivirus, Avast Antivirus and AVG Internet Security to `26.5.10933` or later","reach":"local","title":"Norton, Avast and AVG: Data Shredder link flaw gives SYSTEM rights","impact":"high","summary":"The Data Shredder component in Norton Antivirus, Avast Antivirus and AVG Internet Security follows symbolic links during privileged shred operations, allowing arbitrary file and folder deletion. A local low-privileged user can use this to escalate to NT AUTHORITY\\SYSTEM.","category":"vendor","nicknames":[],"who_cares":["windows","endpoint","norton","avast","avg"],"confidence":0.7,"needs_auth":"yes","worst_case":"local user gains SYSTEM privileges on the Windows machine","analyst_note":"Confirm the vendor advisory for affected build ranges and whether the fixed version covers all three products; the NVD entry gives only the prior-to version.","how_to_check":"- Check the installed version of Norton, Avast or AVG Internet Security on Windows against `26.5.10933`\n- unknown","needs_analyst":true,"not_affected_if":["product-not-installed","patched-version"],"who_is_affected":"Windows machines running Norton Antivirus, Avast Antivirus or AVG Internet Security builds earlier than `26.5.10933`. Any local user with low privileges can trigger the flaw, so shared workstations and servers with untrusted local accounts are the most exposed. Systems without these products installed are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000622,"input_tokens":3363,"output_tokens":572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-6064':14A,17A '26.5.10933':83C 'allow':44B,86C 'antivirus':30B,32B,74C,76C 'arbitrari':45B,104C 'attack':92C 'author':63B,113C 'avast':2A,18B,31B,75C 'avg':4A,19B,34B,78C 'compon':27B,71C 'cve':12A,15A 'data':5A,25B,69C 'delet':49B,106C 'enabl':103C 'endpoint':20B 'escal':60B,94C 'file':46B 'file/folder':105C 'flaw':8A 'folder':48B 'follow':37B,66C 'gain':111C 'give':9A 'internet':35B,79C 'leverag':109C 'link':7A,39B,65C 'local':51B,88C 'low':53B,90C 'low-privileg':52B,89C 'norton':1A,21B,29B,73C 'nt':62B,112C 'oper':43B,102C 'prior':81C 'privelag':115C 'privileg':41B,54B,91C,95C,100C 'right':11A 'secur':36B,80C 'shred':42B,101C 'shredder':6A,26B,70C 'symbol':38B 'system':10A,64B,97C,114C 'use':57B 'user':55B 'vendor':22B 'vulner':67C 'window':23B,85C","nicknames":[],"mitigations":[],"who_affected":"Windows machines running Norton Antivirus, Avast Antivirus or AVG Internet Security builds earlier than `26.5.10933`. Any local user with low privileges can trigger the flaw, so shared workstations and servers with untrusted local accounts are the most exposed. Systems without these products installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@nortonlifelock.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-6064","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6064","severity":null,"published_at":"2026-10-28T11:17:26+00:00","modified_at":"2026-10-28T11:17:26+00:00","first_seen_at":"2026-10-28T11:32:33+00:00","fetched_at":"2026-10-28T11:32:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}