CVE-2026-96542Medium· 5.0▾ SunlitIncorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.08%
Last analysed / modified upstream
Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.
ea_javelin_anticheat_ea_javelin_anticheat_installer 1.0.14329371 (Specific affected standalone versions: 1.0.14329371, 1.0.14547437, 1.0.14789537, 1.0.14940698)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-54546High· 7.5On affected platforms, restricted users could use SSH port forwarding to access host-internal services
CVE-2025-54545High· 7.8On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.
CVE-2025-43470Medium· 5.5A permissions issue was addressed with additional restrictions
CVE-2026-10840High· 7.1A flaw was found in the OpenShift Pipelines operator
CVE-2026-103404Medium· 6.8Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials
CVE-2026-118131NoneCVE-2026-118131