CVE-2020-26941 [Medium] | Security Vulnerability in Endpoint Antivirus

A local (authenticated) low-privileged user can exploit a behavior in an ESET installer to achieve arbitrary file overwrite (deletion) of any file via a symlink, due to insecure permissions. The possibility of exploiting this vulnerability is limited and can only take place during the installation phase of ESET products. Furthermore, exploitation can only succeed when Self-Defense is disabled. Affected products are: ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security, ESET Smart Security Premium versions 13.2 and lower; ESET Endpoint Antivirus, ESET Endpoint Security, ESET NOD32 Antivirus Business Edition, ESET Smart Security Business Edition versions 7.3 and lower; ESET File Security for Microsoft Windows Server, ESET Mail Security for Microsoft Exchange Server, ESET Mail Security for IBM Domino, ESET Security for Kerio, ESET Security for Microsoft SharePoint Server versions 7.2 and lower.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-03-07	0.04%	0.07%	+0.03%
2	2023-03-07	0.89%	0.04%	-0.84%
3	2022-04-01	—	0.89%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-03-07

0.04%

0.07%

+0.03%

2023-03-07

0.89%

0.04%

-0.84%

2022-04-01

—

0.89%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.5	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:N) Service keeps running; no real outage angle.	1.8	3.6	[email protected]
3.6	2.0	LOW	`AV:L/AC:L/Au:N/C:N/I:P/A:P` Click to expand Access vector (AV:L) Requires local access to the target system. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:N) No confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:P) Partial availability impact.	3.9	4.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.5

3.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N): Service keeps running; no real outage angle.

1.8

3.6

[email protected]

3.6

2.0

LOW

AV:L/AC:L/Au:N/C:N/I:P/A:P Click to expand

Access vector (AV:L): Requires local access to the target system.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:N): No confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:P): Partial availability impact.

3.9

4.9

[email protected]

Affected software / configurations for CVE-2020-26941

Vendor	Product	Version	Raw CPE
eset	endpoint_antivirus	<= 7.3	cpe:2.3:a:eset:endpoint_antivirus::::::-::*
eset	endpoint_security	<= 7.3	cpe:2.3:a:eset:endpoint_security::::::::
eset	file_security	<= 7.2	cpe:2.3:a:eset:file_security::::::windows_server::*
eset	internet_security	<= 13.2	cpe:2.3:a:eset:internet_security::::::::
eset	internet_security	1294	cpe:2.3:a:eset:internet_security:1294:::::::*
eset	mail_security	<= 7.2	cpe:2.3:a:eset:mail_security::::::domino::*
eset	mail_security	<= 7.2	cpe:2.3:a:eset:mail_security::::::exchange_server::*
eset	nod32_antivirus	<= 7.3	cpe:2.3:a:eset:nod32_antivirus:::::business:::*
eset	nod32_antivirus	<= 13.2	cpe:2.3:a:eset:nod32_antivirus::::::-::*
eset	security	<= 7.2	cpe:2.3:a:eset:security::::::kerio::*
eset	security	<= 7.2	cpe:2.3:a:eset:security::::::sharepoint_server::*
eset	smart_security	<= 7.3	cpe:2.3:a:eset:smart_security:::::business:::*
eset	smart_security	<= 13.2	cpe:2.3:a:eset:smart_security:::::-:::*
eset	smart_security	<= 13.2	cpe:2.3:a:eset:smart_security:::::premium:::*

References for CVE-2020-26941

URL	Tags
https://support.eset.com/en/ca7794-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows	Vendor Advisory

URL

CVE-2020-26941

Exploit prediction scoring system (EPSS) score for CVE-2020-26941

Common vulnerability scoring system (CVSS) metrics for CVE-2020-26941

Weakness enumeration for CVE-2020-26941

Affected software / configurations for CVE-2020-26941

References for CVE-2020-26941