Logitech Options+ Flaw Enables SYSTEM Privilege Escalation

Scworld

Logitech Options+ Flaw Enables SYSTEM Privilege Escalation

First seen 16 Sep 2026, 03:26 UTC • •57.9

Article Content

1 / 3

Browse articles

ThreatCluster •September 16, 2026 at 04:01 UTC

•CVE-2026-12518 allows privilege escalation without admin rights.
•Logitech released a patch on August 19, 2026.
•Vulnerability was publicly disclosed on September 14, 2026.

A critical vulnerability in Logitech Options+ allows standard Windows users to escalate privileges to SYSTEM level. Tracked as CVE-2026-12518, exploitation requires no admin rights or network access. Discovered by Jake Bolam from AmberWolf Research, the flaw resides in the software's updater service, which runs with extensive OS access. Users can manipulate a trusted process to relay commands to the updater, bypassing restrictions. The updater also accepts user-controlled values that can redirect installation files, compromising certificate validation. Logitech released a patch on August 19, 2026, after acknowledging the vulnerability in March. The vulnerability was publicly disclosed on September 14, 2026. Users are advised to update to the latest version of Logitech Options+.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-03-11

Vulnerability reported to Logitech

Jake Bolam from AmberWolf Research reported the flaw to Logitech, detailing the privilege escalation issue.

2026-03-25

Logitech acknowledges the report

Logitech confirmed receipt of the vulnerability report and began working on a fix.

2026-08-19

Patch released

Logitech released a patch to address the critical vulnerability in Options+.

2026-09-14

Vulnerability publicly disclosed

The vulnerability was disclosed publicly after the patch was made available.

2026-09-14

CVE-2026-12518 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

More articles in this cluster (2)

Threat Graph

13 entities, 22 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

Privilege Escalation
Zero-day Exploit
T1068 - Exploitation for Privilege Escalation
T1543.003 - Windows Service
T1574 - Hijack Execution Flow

Organization (2)

AmberWolf Research
Logitech

Vulnerability (1)

CVE-2026-12518

Weakness (2)

CWE-22 - Path Traversal
CWE-269 - Improper Privilege Management

Affected Platform (3)

Android
Nintendo Switch
Windows

Relationships

CVE-2026-12518 targets Android
CVE-2026-12518 targets Nintendo Switch
CVE-2026-12518 targets Windows
Privilege Escalation targets Android
Privilege Escalation targets Nintendo Switch
Privilege Escalation targets Windows
Zero-day Exploit targets Android
Zero-day Exploit targets Nintendo Switch
Zero-day Exploit targets Windows
T1068 - Exploitation for Privilege Escalation targets Android
T1068 - Exploitation for Privilege Escalation targets Nintendo Switch
T1068 - Exploitation for Privilege Escalation targets Windows
T1543.003 - Windows Service targets Android
T1543.003 - Windows Service targets Nintendo Switch
T1543.003 - Windows Service targets Windows
T1574 - Hijack Execution Flow targets Android
T1574 - Hijack Execution Flow targets Nintendo Switch
T1574 - Hijack Execution Flow targets Windows
CVE-2026-12518 related to AmberWolf Research
CVE-2026-12518 related to Logitech
CVE-2026-12518 related to CWE-22 - Path Traversal
CVE-2026-12518 related to CWE-269 - Improper Privilege Management

Following this threat?

Track AmberWolf Research and CVE-2026-12518 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

Critical Zero-Day Vulnerability in Cisco Secure Email Gateway Exploited On September 14, 2026, Cisco disclosed a critical SQL injection vulnerability (CVE-2026-76461) in its Secure Email Gateway, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges. This vulnerability arises from insufficient validation in the email parsing logic. Cisco confirmed…