---
id: "CVE-2026-9661"
page: "https://infrastack.ai/live/CVE-2026-9661"
kind: "vulnerability"
aliases: ["CVE-2026-9661"]
title: "Postecert FIRMAOK on Windows: user-writable OpenSSL path allows privilege escalation"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Postecert FIRMAOK!", "fixed": [], "affected": "<= 1.6.29 (Windows)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dll-hijacking", "firmaok", "local-privilege-escalation", "postecert", "vendor", "windows"]
not_affected_if: ["linux", "macos", "no-local-untrusted-users", "other-version"]
published_at: "2026-11-13T22:17:27+00:00"
first_seen_at: "2026-11-13T22:33:35+00:00"
updated_at: "2026-11-13T22:36:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9661", "first_seen_at": "2026-11-13T22:33:35+00:00"}, {"source": "analyst", "url": "https://seclists.org/fulldisclosure/2026/Nov/14", "first_seen_at": "2026-11-13T22:36:26+00:00", "cites": ["https://seclists.org/fulldisclosure/2026/Nov/14", "https://nvd.nist.gov/vuln/detail/CVE-2026-96616"]}]
exploit_sources: []
---

# Postecert FIRMAOK on Windows: user-writable OpenSSL path allows privilege escalation

Link for people: https://infrastack.ai/live/CVE-2026-9661 (this .md is for agents)

FIRMAOK! 1.6.29 for Windows loads OpenSSL config and library files from a hardcoded directory that is user-writable and does not exist by default. A local low-privileged user can create that directory, place malicious files in it, and get code run with the privileges of whoever launches the app.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Postecert FIRMAOK! affected <= 1.6.29 (Windows) fixed no fixed version listed

## How to check

- Check the installed FIRMAOK! version (Windows, Apps > Installed apps). 1.6.29 was tested and is affected; the researcher says other versions may be too.
- The hardcoded OpenSSL directory is not named in the advisory text I could read (VulnCheck, full-disclosure post); the full path is only in the researcher's PDF (https://olografix.org/acme/_poc/CVE-2026-9661.pdf), which did not load. Unknown until read.
- The directory does not exist by default. If you find a directory the researcher's PDF names, and it exists or ordinary users can create it, treat the machine as exposed.
- Also check whether the Linux and macOS builds are affected: sources only cover Windows.

## Timeline

- 2026-11-13T22:33:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-9661
- 2026-11-13T22:36:26+00:00 analyst https://seclists.org/fulldisclosure/2026/Nov/14 — VulnCheck and researcher's Full Disclosure post (6 Nov 2026) read. Vendor Poste Italiane did not respond to the researcher, and no fix or vendor advisory is known. The exact directory path is only in the researcher's PDF, which would not load. No PoC link beyond that PDF, no exploitation reported. Triage's NVD mention doc (CVE-2026-96616) looks like a typo link.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/postecert-firmaok-local-privilege-escalation-via-openssl-search-path
- [advisory] Full Disclosure: Postecert FIRMAOK! LPE via OpenSSL configuration (CVE-2026-9661) https://seclists.org/fulldisclosure/2026/Nov/14
- [mentions] NVD CVE-2026-96616 https://nvd.nist.gov/vuln/detail/CVE-2026-96616

## From the sources

Poste Italiane Postecert FIRMAOK! 1.6.29 on Windows contains a local privilege escalation vulnerability caused by an uncontrolled OpenSSL search path, where launcher.exe and dependent executables such as updater.exe and tslupdater.exe load OpenSSL configuration and library files from a hardcoded, user-writable directory that does not exist by default. A low-privileged local attacker can create this missing directory and place malicious OpenSSL configuration or library files inside it, causing the application to load and execute attacker-controlled code with the privileges of the user running it, enabling horizontal or, when a higher-privileged user runs the application, vertical privilege escalation up to full system compromise.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_