CVE-2026-11858: Missing authorization in Quanos SCHEMA ST4 Client Update Service allows arbitrary file overwrite as SYSTEM

Synopsis

A missing authorization vulnerability in the Quanos SCHEMA ST4 Client Update Service allows a local attacker to escalate privileges to SYSTEM. The service runs as NT AUTHORITY\SYSTEM and exposes a .NET Remoting interface over a named pipe without access controls, reachable by any locally authenticated low-privileged user without network access. Successful exploitation gives the attacker arbitrary file write and delete operations at SYSTEM level, enabling full local privilege escalation. No fix version has been published; HarborGuard tracks this advisory and will surface a patched rebuild the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; the vulnerable named pipe interface is local-only and is not exposed over the network.

• AuthenticationRequired

  Any low-privilege local account is sufficient to connect to the unprotected .NET Remoting interface and invoke privileged update methods.

• Victim interactionNot required

  No victim interaction is needed; the attacker connects directly to the named pipe and invokes the privileged interface without any user involvement.

• Attack complexityDetail

  The exploit is reliable and condition-free: no race conditions, memory-layout dependencies, or other environmental factors are required to invoke the exposed update methods.

Blast Radius

• Writes arbitrary files anywhere on the local filesystem under NT AUTHORITY\SYSTEM privileges, including overwriting security-critical executables or configuration files.
• Deletes arbitrary files on the local filesystem as SYSTEM, allowing removal of audit logs, security tooling, or OS-level binaries.
• Leverages file write primitives to plant malicious binaries in auto-start locations, achieving persistent code execution as SYSTEM on the affected host.