Logitech Options+ Flaw Enables SYSTEM Privilege Escalation

Scworld

Logitech Options+ Flaw Enables SYSTEM Privilege Escalation

First seen 16 Sep 2026, 03:26 UTC • •57.9

Article Content

1 / 3

Browse articles

ThreatCluster •September 17, 2026 at 03:24 UTC

•CVE-2026-12518 allows privilege escalation without admin rights.
•Logitech released a patch on August 19, 2026.
•Vulnerability was publicly disclosed on September 14, 2026.

A critical vulnerability in Logitech Options+ allows standard Windows users to escalate privileges to SYSTEM level. Tracked as CVE-2026-12518, exploitation requires no admin rights or network access. Discovered by Jake Bolam from AmberWolf Research, the flaw resides in the software's updater service, which runs with extensive OS access. Users can manipulate a trusted process to relay commands to the updater, bypassing restrictions. The updater also accepts user-controlled values that can redirect installation files, compromising certificate validation. Logitech released a patch on August 19, 2026, after acknowledging the vulnerability in March. The vulnerability was publicly disclosed on September 14, 2026. Users are advised to update to the latest version of Logitech Options+.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 54d ago How this analysis works

Timeline

2026-03-11

Vulnerability reported to Logitech

Jake Bolam from AmberWolf Research reported the flaw to Logitech, detailing the privilege escalation issue.

2026-03-25

Logitech acknowledges the report

Logitech confirmed receipt of the vulnerability report and began working on a fix.

2026-08-19

Patch released

Logitech released a patch to address the critical vulnerability in Options+.

2026-09-14

Vulnerability publicly disclosed

The vulnerability was disclosed publicly after the patch was made available.

2026-09-14

CVE-2026-12518 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

More articles in this cluster (2)

Threat Graph

13 entities, 22 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

Privilege Escalation
Zero-day Exploit
T1068 - Exploitation for Privilege Escalation
T1543.003 - Windows Service
T1574 - Hijack Execution Flow

Organization (2)

AmberWolf Research
Logitech

Vulnerability (1)

CVE-2026-12518

Weakness (2)

CWE-22 - Path Traversal
CWE-269 - Improper Privilege Management

Affected Platform (3)

Android
Nintendo Switch
Windows

Relationships

CVE-2026-12518 targets Android
CVE-2026-12518 targets Nintendo Switch
CVE-2026-12518 targets Windows
Privilege Escalation targets Android
Privilege Escalation targets Nintendo Switch
Privilege Escalation targets Windows
Zero-day Exploit targets Android
Zero-day Exploit targets Nintendo Switch
Zero-day Exploit targets Windows
T1068 - Exploitation for Privilege Escalation targets Android
T1068 - Exploitation for Privilege Escalation targets Nintendo Switch
T1068 - Exploitation for Privilege Escalation targets Windows
T1543.003 - Windows Service targets Android
T1543.003 - Windows Service targets Nintendo Switch
T1543.003 - Windows Service targets Windows
T1574 - Hijack Execution Flow targets Android
T1574 - Hijack Execution Flow targets Nintendo Switch
T1574 - Hijack Execution Flow targets Windows
CVE-2026-12518 related to AmberWolf Research
CVE-2026-12518 related to Logitech
CVE-2026-12518 related to CWE-22 - Path Traversal
CVE-2026-12518 related to CWE-269 - Improper Privilege Management

Following this threat?

Track AmberWolf Research and CVE-2026-12518 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…

CVE-2026-121392 in FreeRDP Exposes RDP Sessions to Interception A vulnerability, CVE-2026-121392, has been identified in FreeRDP versions prior to 3.32.2, which allows man-in-the-middle attackers to bypass server identity checks. The flaw arises from improper certificate validation in the tls_verify_certificate() function, permitting attackers with a trusted certificate to…