CVE-2026-107782

High

Description

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.

SeverityHigh

CVSS7.8

Exploit probability—

ProductSystem Informer

PublishedOct 8, 2026

First seenOct 8, 2026

Weakness typeCWE-863Incorrect authorization

How to fix

Update

winsiderss System Informer4.0.26241.138 or later

Patches

github.com/winsiderss/systeminformer/commit/ce451a264a424f6f386b1615df651f8364aaeb9f

Vendor advisories

github.com/winsiderss/systeminformer/releases/tag/v4.0.26241.138

Affected products

Product	Affected versions	Fixed in
winsiderss System Informer	v < 4.0.26241.138	4.0.26241.138

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.