CERT-FR: ESET Endpoint Encryption and Full Disk Encryption flaw CVE-2026-75882 enables confidentiality and integrity impact and security bypass
The French CERT-FR published advisory CERTFR-2026-AVI-1416 on 29 October 2026 about a vulnerability in ESET encryption products for Windows. According to the advisory, the flaw lets an attacker compromise data confidentiality and integrity and bypass the security policy. It affects ESET Endpoint Encryption and ESET Full Disk Encryption. The advisory is based on ESET security bulletin ca9033 of 29 October 2026 and does not mention exploitation in the wild.
Entenda a falha
A vulnerabilidade
CVE-2026-75882 affects ESET Endpoint Encryption for Windows before 5.4.29.0 and ESET Full Disk Encryption for Windows before 2.4.8.0. CERT-FR says an attacker can compromise data confidentiality and integrity and bypass the security policy. The advisory gives no CVSS score, component, attack vector or prerequisites (network reach, authentication, user interaction). The fixed versions are 5.4.29.0 and 2.4.8.0, per ESET bulletin ca9033.
Como funciona
The articles do not describe how the vulnerable process works. The CERT-FR advisory only lists the impacts (confidentiality, integrity, security policy bypass) and refers to the vendor bulletin for details. Nothing is stated about which input reaches which component or at which step it fails.
Por que é vulnerável
The root cause is not given. The advisory and the story state no root cause, and they do not say what the fix changes or why the flaw went unnoticed. The vendor bulletin ca9033 is the place to look for further detail.
Como foi descoberta
The articles do not say who found the flaw or how. CERT-FR published advisory CERTFR-2026-AVI-1416 on 29 October 2026, based on ESET security bulletin ca9033 of the same date. The advisory does not mention exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 12:20.
Detalhes técnicos
- Affected versions: ESET Endpoint Encryption for Windows prior to 5.4.29.0, and ESET Full Disk Encryption for Windows prior to 2.4.8.0.
- CVE referenced: CVE-2026-75882.
- The advisory gives no CVSS score, root cause or exploitation details.
Remediação
- Consult ESET security bulletin ca9033 and apply the vendor patches.
- Upgrade ESET Endpoint Encryption to 5.4.29.0 or later, and ESET Full Disk Encryption to 2.4.8.0 or later.
Linha do tempo
-
CERT-FR: ESET Endpoint Encryption and Full Disk Encryption flaw CVE-2026-75882 enables confidentiality and integrity impact and security bypass
ler a análise desta fonte ocultar
The French CERT-FR published advisory CERTFR-2026-AVI-1416 on 29 October 2026 about a vulnerability in ESET encryption products for Windows. According to the advisory, the flaw lets an attacker compromise data confidentiality and integrity and bypass the security policy. It affects ESET Endpoint Encryption and ESET Full Disk Encryption. The advisory is based on ESET security bulletin ca9033 of 29 October 2026 and does not mention exploitation in the wild.
Technical Details
- Affected versions: ESET Endpoint Encryption for Windows prior to 5.4.29.0, and ESET Full Disk Encryption for Windows prior to 2.4.8.0.
- CVE referenced: CVE-2026-75882.
- The advisory gives no CVSS score, root cause or exploitation details.
Remediation
- Consult ESET security bulletin ca9033 and apply the vendor patches.
- Upgrade ESET Endpoint Encryption to 5.4.29.0 or later, and ESET Full Disk Encryption to 2.4.8.0 or later.