Vulnerability · Published Sep 24, 2026 · Assigned by INCIBE
CVE-2026-7169Uncontrolled Search Path Element in Evope Collector
High 7.5
In plain English
A high-severity security flaw in Evope Collector from Evope Collector. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a ‘wtsapi32.dll’ file in the ‘C:\ProgramData\Evope\’ directory. The ‘Evope.Service.exe’ component, which runs with ‘NT AUTHORITY\SYSTEM’ privileges, loads this DLL without properly verifying its integrity or origin. Successful exploitation could allow code execution with SYSTEM privileges and result in local privilege escalation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Evope Collector | Evope Collector | 1.1.6.9.0 |