CVE-2022-26488

HIGH

Python <3.10.3 (Windows) - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-26488. PoCs published by techspence.

AI-analyzed exploit summary This is a PowerShell-based exploit for CVE-2022-26488, a local privilege escalation vulnerability in Python for Windows (CPython) installers. It abuses the 'Add Python to PATH' MSI repair operation to manipulate the system PATH variable and achieve privilege escalation via DLL hijacking.

Description

In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repair that incorrectly adds user-writable paths into PATH, enabling search-path hijacking of other users and system services. This affects Python (CPython) through 3.7.12, 3.8.x through 3.8.12, 3.9.x through 3.9.10, and 3.10.x through 3.10.2.

Exploits (1)

nomisec WORKING POC
by techspence · poc
https://github.com/techspence/PyPATHPwner

This is a PowerShell-based exploit for CVE-2022-26488, a local privilege escalation vulnerability in Python for Windows (CPython) installers. It abuses the 'Add Python to PATH' MSI repair operation to manipulate the system PATH variable and achieve privilege escalation via DLL hijacking.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: CPython (Python for Windows) versions 3.11.0a6 and earlier, 3.10.2 and earlier, 3.9.10 and earlier, 3.8.12 and earlier, 3.7.12 and earlier, and all end-of-life releases of 3.5 and 3.6
Auth required
Prerequisites: Local access to the system · Python installed with 'Add Python to PATH' option for all users · A malicious DLL prepared for hijacking
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 7.0
EPSS 0.0137
EPSS Percentile 68.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-426
Status published
Products (4)
netapp/active_iq_unified_manager
netapp/ontap_select_deploy_administration_utility
python/python 3.11.0 alpha1 (6 CPE variants)
python/python < 3.7.12
Published Mar 10, 2022
Tracked Since Feb 18, 2026