CVE-2024-0353 is a high severity (CVSS 7.8) local privilege escalation weakness in ESET Products for Windows. ESET advisory CA8612 lists fixed builds for each product, and a Cleaner module update that also addresses it. It is not listed as exploited in the wild by CISA.
What's affected
Several ESET security products for Windows, including NOD32 Antivirus, Internet Security, Endpoint, Server, Mail and SharePoint products, in the builds listed below. The vulnerability sits in file operations handling in the real-time file system protection feature, and could let a low-privileged local attacker delete arbitrary files as NT AUTHORITY\SYSTEM.
The weakness is mapped to CWE-269, improper privilege management. The record was published on 2024-02-15. The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog.
ESET advisory CA8612 lists these affected builds: NOD32 Antivirus, Internet Security, Smart Security Premium and Security Ultimate 16.2.15.0 and earlier, plus earlier builds of Endpoint Antivirus and Endpoint Security, Server Security, Mail Security for Exchange and Domino, and Security for SharePoint Server. The fixed builds are NOD32 Antivirus, Internet Security, Smart Security Premium and Security Ultimate 17.0.10.0 and later, and Endpoint products 11.0.2032.0, 10.1.2063.0, 10.0.2052.0, 9.1.2071.0 and 8.1.2062.0 or later from the respective version family. Server Security fixed builds are 10.0.12015.0, 9.0.12019.0, 8.0.12016.0 and 7.3.12013.0 or later. Mail Security for Exchange fixed builds are 10.1.10014.0, 10.0.10018.0, 9.0.10012.0, 8.0.10024.0 and 7.3.10018.0 or later. Check the advisory for the Domino and SharePoint builds.
ESET also released a fix in Cleaner module version 1248 as part of standard module updates, so that devices without Azure Code Signing support are covered. Regularly updated devices should already have it. Customers of ESET File Security for Microsoft Azure are told to migrate to the latest ESET Server Security for Microsoft Windows Server.
How to check if you're exposed
On a Windows machine, compare the installed ESET product version with the fixed builds in the advisory.
Get-CimInstance Win32_Product | Where-Object Name -like "ESET*" | Select-Object Name, Version
ESET management consoles also report product versions across a fleet. Check the Cleaner module version too, since version 1248 or later carries the fix for devices that cannot take a new build.
You can also paste a manifest or SBOM into the free in-browser scanner at Safeguard Gold to see which known CVEs apply to your dependencies. It only covers components that appear in a manifest or SBOM, so a standalone appliance still needs the manual check.
What to do now
- Find every deployment of ESET Products for Windows in your environment, including test systems and anything bought or installed by a team outside IT.
- Upgrade to the fixed build for your ESET product family, and confirm the Cleaner module is at version 1248 or later.
- Confirm that endpoint protection modules are updating automatically.
- Limit local code execution by standard users on servers.
- Track the installed version of every endpoint product in your inventory, since the fix depends on the exact build.
- Re-run a scan after the change and record the date, so you can show the exposure is closed.
Why it matters
Link following bugs let a privileged component act on a file path that a low privileged user can redirect. Here the real-time protection feature performed file operations that could be abused to delete files as SYSTEM, which is the highest local account on Windows.
Deleting arbitrary files as SYSTEM is a known route to full local privilege escalation, because removing the right file can change how a privileged process behaves on its next start. ESET states it has no knowledge of exploitation in the wild.
The CVSS vector reads as follows. The attack is possible with local access, attack complexity is low, privileges required are low, and user interaction is not needed. The impact on confidentiality, integrity and availability is high, high and high respectively. A score is a starting point. Your own exposure, meaning whether the product faces the internet and what it can reach, decides the real priority.
Try it yourself
A CVE score does not say whether the flaw can be reached in your setup. This demo walks through an exploitability check.
Click through it at your own pace, or open it full screen.
Quick check
Is this vulnerability known to be exploited in the wild?
The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog. ESET says it has no knowledge of exploitation in the wild.
Which versions are fixed?
ESET advisory CA8612 lists fixed builds for each product, and a Cleaner module update that also addresses it.
Sources
Last reviewed: 19 October 2026.
