Skip to main content

CISA issues Pegatron tdeio64.sys IOCTL privilege escalation update

Source Decision Insights Threat Desk Published August 23, 2026 Companies 1
Human View Machine View

49th article in the last 90 days, one of 592 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues update on TPM 2.0 reference vulnerabilities CVE-2026-6726 and CVE-2026-6727 (Aug 2026).

Companies mentioned

Best suited for

Seniority
C Level / Executive Team
Job function
Chief Information Security Officer
Persona
Security Operations Leader
Buyer role
Decision Maker / Budget Holder
Decision stage
Which to buy
Adoption curve
Late Majority
Technology maturity
Established Technology
Industry
Information Technology / Software & Services / IT Services / Cloud Services

Our classification, not the publisher's statement. Best suited for, not only for.

Pegatron’s tdeio64.sys Windows Driver Model (WDM) driver contains an unprotected IOCTL dispatch routine that can be triggered through user-supplied requests. This privilege escalation vulnerability can allow an unprivileged local attacker to obtain NT AUTHORITY\SYSTEM privileges and compromise the affected system.

The issue involves the tdeio64.sys driver distributed by Pegatron Corporation, which provides low-level access to system I/O ports and hardware components and exposes the \\.\TdeIo device interface. Two CVEs are described: CVE-2026-14961 and CVE-2026-14960. For CVE-2026-14961, sending a crafted DeviceIoControl request enables abuse of the driver’s IOCTL dispatcher to perform arbitrary kernel memory reads and writes; this capability can overwrite the current process token with the SYSTEM process token, resulting in privilege escalation to NT AUTHORITY\SYSTEM. For CVE-2026-14960, the driver exposes IOCTLs that can interact directly with hardware I/O ports, and successful exploitation may manipulate hardware resources in ways that extend beyond normal operating system protections.

Successful exploitation provides arbitrary kernel read and write capabilities, enabling a complete compromise of the operating system. The advisory also describes the ability to elevate privileges to NT AUTHORITY\SYSTEM, bypass or disable endpoint security controls, extract credentials from protected processes such as lsass.exe, install persistent rootkits, manipulate kernel data structures, and issue low-level hardware I/O operations.

At the time of publication, no vendor-supported fix is available for the Pegatron tdeio64.sys kernel driver vulnerability. The stated mitigations are to disable or remove the vulnerable driver where it is not required, prevent untrusted users from loading or interacting with the driver, and implement solutions such as Windows Defender Application Control (WDAC) or Hypervisor-Protected Code Integrity (HVCI) to block known vulnerable drivers from loading where supported.

Thanks to Lucian Alexandru Necula for researching and reporting the vulnerability, and the document was written by Michael Bragg. The advisory lists CVE IDs CVE-2026-14961 and CVE-2026-14960, with public and first-published dates of 2026-07-15 and a last-updated time of 2026-07-15 17:09 UTC.

Blog post, originally published by Michael Bragg at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-pegatron-tdeio64.sys-ioctl-privilege-escalation-update/",
        "name": "CISA issues Pegatron tdeio64.sys IOCTL privilege escalation update",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-pegatron-tdeio64.sys-ioctl-privilege-escalation-update/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@type": "Organization",
      "name": "Pegatron"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "C Level / Executive Team"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Chief Information Security Officer"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Decision Maker / Budget Holder"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Late Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Established Technology"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Cloud Services"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:00:08-06:00",
    "datePublished": "2026-08-23T09:44:22-06:00",
    "description": "CISA describes Pegatron tdeio64.sys IOCTL issues tied to CVE-2026-14961 and CVE-2026-14960, enabling arbitrary kernel access and SYSTEM privilege escalation.",
    "headline": "CISA issues Pegatron tdeio64.sys IOCTL privilege escalation update",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Michael Bragg"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/529388"
    },
    "keywords": [
      "Operating System",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-pegatron-tdeio64.sys-ioctl-privilege-escalation-update/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages