CISA issues guidance on CVE-2026-8501 access control flaw
2 companies named across 6 categories, one of 298 articles referencing Microsoft. Previous coverage: Gigamon and Splunk Integrate Deep Observability Pipeline With Federated Search (Jun 2026).
Companies mentioned
The PCTCore64.sys Windows kernel driver from PC Tools Internet Security contains a missing access control flaw that lets user-mode processes reach the PCTCoreDriver device interface and invoke privileged IOCTL handlers. The highest-level impact described is credential theft and broader system compromise through privileged kernel-level operations.
In this issue, the driver creates a Windows Driver Model (WDM) device object \\.\PCTCoreDriver via IoCreateDevice and provides user-mode access through a DOS device symbolic link created with IoCreateSymbolicLink. The advisory states the device object is created without a restrictive security descriptor and that the driver does not apply security best practices using either Security Descriptor Definition Language (SDDL) or the IoCreateDeviceSecure API, allowing unprivileged user-mode processes to open handles to the device and issue privileged IOCTL requests. The advisory cites CVE-2026-8501 as improper access control in the PCTCore64.sys driver. It also lists IOCTL handlers that can enable system-wide handle enumeration, cross-process handle manipulation, credential extraction from lsass.exe, and forced termination of arbitrary processes, including Protected Process Light (PPL)-protected processes. It further notes one vulnerable IOCTL can acquire a PROCESS_ALL_ACCESS handle to sensitive processes such as lsass.exe, enabling credential theft including extraction of NTLM hashes and Kerberos authentication material.
The advisory states that a local attacker with the ability to load a Windows kernel driver can exploit the vulnerable PCTCore64.sys driver to access sensitive processes such as lsass.exe and other PPL-protected services. It further states successful exploitation can enable credential theft, arbitrary process termination, denial-of-service (DoS) conditions, and broader system compromise through privileged kernel-level operations.
According to the advisory, the PC Tools Internet Security product line and its PCTCore64.sys driver are no longer actively maintained and should not be used in production environments. It instructs organizations to remove and block the vulnerable driver where possible and to implement mitigations designed to reduce exposure to BYOVD attacks, including restricting administrative privileges, enforcing Microsoft recommended driver block rules, and enabling protections such as Hypervisor-Protected Code Integrity (HVCI), Windows Defender Application Control (WDAC), and Credential Guard.
The guidance also includes attribution and publication details, including thanks to Tzachi Hazan for researching and reporting the vulnerability and a document written by Molly Jaconski. The advisory lists CVE IDs and dates: CVE-2026-8501 with date public and date first published of 2026-06-01, date last updated of 2026-06-01 16:21 UTC, and document revision 1.