CyberSecBulletin
CVE-2026-2450NVD status: Awaiting Analysis

upKeeper Instant Privilege Access: .NET Misconfiguration: Use of Impersonation

Published Updated By the CyberSecBulletin desk

CVE-2026-2450 is a high-severity .NET misconfiguration: use of impersonation vulnerability in upKeeper Instant Privilege Access from upKeeper Solutions, with a CVSS 4.0 base score of 7.4 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. Affected upKeeper Instant Privilege Access versions: 1.5.0 and earlier. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.28% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Check which version of upKeeper Instant Privilege Access you run against the affected versions below, and install the vendor's latest release.

Affected products and versions

VendorProductAffected versionsFixed in
upKeeper SolutionsupKeeper Instant Privilege Access1.5.0 and earlierNot stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Attack requirements
PresentThe target must be in a specific state or configuration for the attack to work.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Confidentiality (vulnerable system)
LowLimited loss of confidentiality on the vulnerable system.
Integrity (vulnerable system)
LowLimited loss of integrity on the vulnerable system.
Availability (vulnerable system)
HighSerious loss of availability on the vulnerable system.
Confidentiality (other systems)
HighSerious loss of confidentiality on systems beyond the vulnerable one.
Integrity (other systems)
HighSerious loss of integrity on systems beyond the vulnerable one.
Availability (other systems)
HighSerious loss of availability on systems beyond the vulnerable one.

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. Scored by CNA.

Official description

.NET misconfiguration: use of impersonation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Hijacking a Privileged Thread of Execution.This issue affects upKeeper Instant Privilege Access: through 1.5.0.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: .NET Misconfiguration: Use of Impersonation

Allowing a.NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks.

How developers prevent this class of flaw

  • Run the application with limited privilege to the underlying operating and file system.

More .NET Misconfiguration: Use of Impersonation vulnerabilities (CWE-520)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in upKeeper Instant Privilege Access

All upKeeper Instant Privilege Access vulnerabilities

Recent .NET Misconfiguration: Use of Impersonation vulnerabilities

Spotted an error? Tell us.