Vulnerability · Published Aug 7, 2026 · Assigned by VulDB
CVE-2026-19191StableBit DrivePool DrivePoolService DrivePool.Service.exe permission
High 7.8
In plain English
A high-severity security flaw in DrivePool from StableBit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\DrivePool\DrivePool.Service.exe of the component DrivePoolService. Such manipulation leads to permission issues. The attack must be carried out locally. The exploit has been disclosed publicly and may be used.
Affected products (as reported)
Weakness: CWE-275, CWE-266 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-386709 | StableBit DrivePool DrivePoolService DrivePool.Service.exe permission vdb-entry
- VDB-386709 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-19191 | CVE Analysis and Report third-party-advisory
- Submit #864539 | StableBit StableBit DrivePool 2.3.13.1687 Local Privilege Escalation third-party-advisory
- https://winslow1984.com/books/cve-collection/page/stablebit-drivepool-23131687-local-privilege-escalation-via-insecure-deserialization exploit