{"affected":[{"defaultStatus":"unknown","product":"Postecert FIRMAOK!","source":"CNA: VulnCheck","vendor":"Poste Italiane","versions":[{"status":"affected","version":"1.6.29","versionType":"semver"}]}],"cveId":"CVE-2026-9661","cwes":["CWE-427"],"description":"Poste Italiane Postecert FIRMAOK! 1.6.29 on Windows contains a local privilege escalation vulnerability caused by an uncontrolled OpenSSL search path, where launcher.exe and dependent executables such as updater.exe and tslupdater.exe load OpenSSL configuration and library files from a hardcoded, user-writable directory that does not exist by default. A low-privileged local attacker can create this missing directory and place malicious OpenSSL configuration or library files inside it, causing the application to load and execute attacker-controlled code with the privileges of the user running it, enabling horizontal or, when a higher-privileged user runs the application, vertical privilege escalation up to full system compromise.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: VulnCheck","url":"https://seclists.org/fulldisclosure/2026/Nov/14"}],"kev":null,"metrics":[{"score":7.3,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":7,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7.3,"severity":"high","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":7,"severity":"high","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794608247467,"publishedAt":1794606035827,"references":[{"source":"CNA: VulnCheck","tags":["technical-description","exploit"],"url":"https://seclists.org/fulldisclosure/2026/Nov/14"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://postecert.poste.it/firma/download.shtml"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/postecert-firmaok-local-privilege-escalation-via-openssl-search-path"},{"source":"ADP: CVE","tags":[],"url":"http://seclists.org/fulldisclosure/2026/Nov/14"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://postecert.poste.it/firma/download.shtml"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://seclists.org/fulldisclosure/2026/Nov/14"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://www.vulncheck.com/advisories/postecert-firmaok-local-privilege-escalation-via-openssl-search-path"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"url":"http://seclists.org/fulldisclosure/2026/Nov/14"}],"remediation":[],"revision":"e8b2c7317033fdfceb13600821d172b0fa9004ca000082ed519321427e4afc48","sources":[{"modifiedAt":1794607814165,"name":"CNA: VulnCheck","retrievedAt":1794611360616,"url":"https://www.cve.org/CVERecord?id=CVE-2026-9661"},{"modifiedAt":1794608247467,"name":"NVD","retrievedAt":1794615618540,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9661"}],"ssvc":null,"status":"published","title":"Postecert FIRMAOK! 1.6.29 Local Privilege Escalation via OpenSSL Search Path","updatedAt":1794615618540}