Threat Intelligence Report: CVE-2026-14478

Executive Summary

CVE-2026-14478 is a local privilege escalation vulnerability in the Autodesk Installer component, disclosed with a CVSS score of 7.8. A maliciously crafted executable, when executed on the victim's machine, allows a local low-privileged attacker to inject unauthenticated IPC messages into named pipes used by the installer, or to modify pipe permissions and ownership. Successful exploitation results in full compromise of confidentiality, integrity, and availability on the affected system, potentially elevating privileges from a low-privileged user to a higher-integrity context. No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation has been identified at the time of writing.

Technical Analysis

Vulnerability Classification

The vulnerability resides in the CWE-732 (Incorrect Permission Assignment for Critical Resource) class. The affected resource is the named pipe (IPC) infrastructure leveraged by the Autodesk Installer process. Named pipes are a Windows inter-process communication (IPC) mechanism commonly used by installer services to communicate between a service process (running at elevated integrity) and client processes.

Vulnerability Mechanism

According to the NVD description, three distinct impact vectors are possible on the vulnerable named pipe infrastructure:

1. Injection of unauthenticated IPC messages — The named pipe does not adequately validate the identity or integrity level of the connecting client before accepting messages. A low-privileged local process can send crafted messages that the installer service will process as if they originated from a trusted or authenticated source.

2. Modification of pipe permissions — The low-privileged user, through the malicious executable, can alter the discretionary access control list (DACL) or security descriptor associated with the named pipe, thereby broadening access, escalating their own access, or denying access to legitimate processes.

3. Modification of pipe ownership — The attacker can change the owner of the named pipe resource, potentially enabling them to take control of the pipe and its communication stream, impersonate the legitimate service, or intercept sensitive data transmitted over the pipe.

Attack Surface

The attack surface is the local file system and Windows IPC namespace (\.\pipe*), specifically the named pipe(s) created by the Autodesk Installer service when it runs. The vulnerability is triggerable only when a malicious executable is executed locally on the victim's machine, meaning the attacker requires already achieved code execution at a low-integrity level (e.g., via phishing attachment, malicious download, or a secondary vulnerability).

Technical Basis

The flaw stems from the installer's failure to apply the principle of least privilege and robust security descriptors when creating and managing its named pipe endpoints. Named pipes with permissive DACLs (allowing "Everyone" or "Authenticated Users" WRITE access) permit any local process to connect and send messages. Adequately secured named pipes should:

• Restrict connect/write permissions to the service SID and trusted callers only.
• Perform impersonation-level validation of the connecting client.
• Set the pipe owner to the service account and reject ownership-change attempts.

The CWE-732 classification indicates that these permission-assignment controls were either missing or incorrectly configured.

CVSS Analysis

The CVSS vector — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — reflects:

• Attack Vector: Local — requires the attacker to execute code on the target system
• Attack Complexity: Low — no bypass of mitigations or special conditions required
• Privileges Required: Low — attacker needs only low-privileged local access
• User Interaction: None — no victim interaction needed beyond the initial malicious execution
• Scope: Unchanged — compromise stays within the security authority of the component
• High impact on C/I/A — full integrity violation enabling arbitrary code execution, full data confidentiality breach, and denial of service

The EPSS score of 0.00109 (1.3% percentile) indicates that this vulnerability is not currently a target of opportunistic exploitation in the wild.

Exploitation Scenarios

Note: No public exploit code or PoC is available for CVE-2026-14478. The attack chain described below is inferred from the vulnerability class (named pipe permission misconfiguration) and the NVD description.

Step 1: Reconnaissance and Target Identification

An attacker with low-privileged local access (e.g., a malicious insider, or an attacker who has achieved initial code execution via phishing or a web-browser exploit) enumerates the local system for available named pipes and determines which belong to the Autodesk Installer. On Windows, this can be accomplished by:

• Enumerating \.\pipe* using standard Windows APIs or tools such as handle.exe (Sysinternals) to list process handles to named pipes.
• Identifying processes running as NT AUTHORITY\SYSTEM or with elevated privileges that hold handles to named pipes associated with the Autodesk Installer service.

The attacker targets the pipe name associated with the Autodesk Installer service — exact pipe name is not disclosed in available advisory data.

Step 2: Triggering the Flaw

The attacker crafts a malicious executable that, when run locally:

1. Opens a handle to the target named pipe using standard Windows file/pipe APIs (e.g., CreateFileW with \\.\pipe\<name>).
2. Enumerates or probes the existing DACL/security descriptor on the named pipe to determine current permission settings.
3. Attempts to connect to the pipe without presenting any authentication token beyond that of the low-privileged caller.

Because the pipe is configured with permissive permissions (CWE-732), the connection is accepted despite the caller's low integrity level.

Step 3: Payload and Execution

At the vulnerability-class level, the attacker then performs one or more of the following actions:

• Message injection: Sends crafted IPC messages over the established pipe connection. The installer service processes these messages without verifying the caller's identity or privilege level. Depending on the message handlers implemented by the installer (not publicly detailed), this could permit commands to install/uninstall packages, modify installation state, or execute operations with the privileges of the elevated service.

• Permission modification: Invokes Windows security APIs (e.g., SetKernelObjectSecurity) to replace the DACL on the pipe object. The attacker grants themselves full control or write access, and potentially removes access for legitimate clients (denial-of-service vector).

• Ownership modification: Takes ownership of the pipe object via SetSecurityInfo with the OWNER_SECURITY_INFORMATION flag. Once the attacker owns the pipe, they may impersonate the legitimate pipe client (the installer service) or redirect the pipe traffic.

Step 4: Post-Exploitation

Successful exploitation yields the following outcomes based on the CVSS scoring:

• Confidentiality breach: The attacker may intercept IPC messages traveling over the pipe, potentially revealing installation paths, product keys, user data, or credentials passed between the installer service and legitimate clients.

• Integrity breach: The attacker can send arbitrary IPC messages that the elevated installer service processes as trusted, enabling them to install malicious payloads, tamper with installation state, modify system files accessed by the installer, or execute actions in the context of the service (potentially NT AUTHORITY\SYSTEM).

• Availability breach: By modifying pipe permissions/ownership and denying legitimate processes access, the attacker can cause installer failures, crashes, or hang conditions, denying service to legitimate users attempting to install, update, or repair Autodesk software.

The absence of user interaction (UI:N) in the CVSS vector suggests the malicious executable triggers its payload automatically upon execution.

Impact Assessment

Business Impact

Autodesk is a major provider of design, engineering, and entertainment software used across architecture, engineering, construction, manufacturing, and media industries. The Autodesk Installer is deployed on every endpoint running Autodesk products (AutoCAD, Revit, Inventor, 3ds Max, Maya, Fusion 360, and others). A successful exploit grants an attacker operating at low privilege:

1. Privilege escalation to the security context of the Autodesk Installer service — typically an elevated or SYSTEM-level context.
2. Full local system compromise — ability to read/write arbitrary files accessible to the service account, install persistence mechanisms, disable security products, and move laterally within the enterprise.

Affected Systems

• All Windows workstations and servers running Autodesk Installer components.
• Endpoints where users run with least-privilege but can execute downloaded or delivered executables.
• Organizations with shared workstations (engineering labs, CAD pools) where multiple low-privileged users share a machine.

Blast Radius

While the CVSS scope is "Unchanged," the practical blast radius extends beyond the installer component itself: the Autodesk Installer service typically operates with elevated privileges to install and modify program files, registry keys, and system services. Compromise of this service context effectively escalates the attacker from low-privileged user to high-integrity system context, creating a springboard for:

• Deployment of credential-harvesting tooling.
• Installation of kernel-level or boot-level persistence.
• Lateral movement via compromised administrative credentials or trust relationships.

CVSS Subscore Context

• Confidentiality Impact: High — IPC messages may contain installation metadata, and elevated code execution allows reading arbitrary user and system data.
• Integrity Impact: High — arbitrary IPC injection allows tampering with installer operations, and service-context code execution allows writing arbitrary files/system state.
• Availability Impact: High — pipe denial-of-service and service-context code execution can crash services, brick installations, or trigger system instability.

Detection Guidance

Sigma Rule

title: Named Pipe Permission Modification via Autodesk Installer
id: 3f8a1c9e-5b6d-4a8f-9e2c-1d4b7e9a2c01
status: experimental
description: Detects attempts to access or modify named pipes associated with Autodesk Installer processes, potentially indicating CVE-2026-14478 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-14478
author: Valtersit Threat Intelligence
date: 2026/05/01
tags:
    - attack.t1068
    - attack.privilege_escalation
    - cve.2026.14478
logsource:
    category: process_creation
    product: windows
detection:
    selection_pipe_tools:
        Image|endswith:
            - '\handle.exe'
            - '\accesschk.exe'
        CommandLine|contains:
            - '\pipe\'
            - '-p'
    selection_autodesk_proc:
        Image|contains:
            - 'Autodesk'
            - 'Adsk'
            - 'AdSSO'
    selection_pipe_modification:
        EventID:
            - 4656  # Handle to object requested
            - 4663  # Object accessed
    condition: selection_pipe_tools and selection_autodesk_proc
    timeframe: 5m
level: high
falsepositives:
    - Legitimate Autodesk administrative tools inspecting service configuration
    - System administrators performing authorized troubleshooting on installer components
fields:
    - User
    - Image
    - CommandLine
    - ObjectName

YARA Rule

rule CVE_2026_14478_Autodesk_NamedPipe_Exploit {
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-05-01"
        description = "Detects executables that appear crafted to interact with or modify Autodesk Installer named pipes"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-14478"
        cve = "CVE-2026-14478"
        score = 70
        hash = "N/A"
    strings:
        // Named pipe path strings common in exploit tooling
        $pipe_str = /\\\\\.\\pipe\\[a-zA-Z0-9_-]*/ ascii wide
        // Windows security API references for permission modification
        $api_dacl = "SetKernelObjectSecurity" ascii wide
        $api_dacl2 = "SetSecurityInfo" ascii wide
        $api_owner = "OWNER_SECURITY_INFORMATION" ascii wide
        $api_dacl3 = "DACL_SECURITY_INFORMATION" ascii wide
        // Autodesk-related process strings
        $adsk1 = "Adsk" ascii wide nocase
        $adsk2 = "Autodesk" ascii wide nocase
        // CreateFile pipe access strings
        $pipe_access = "GENERIC_WRITE" ascii wide
        $pipe_access2 = "GENERIC_READ" ascii wide
        $impersonate = "ImpersonateNamedPipeClient" ascii wide
    condition:
        uint16(0) == 0x5A4D and // MZ header
        filesize < 5MB and
        2 of ($pipe_str*) and
        1 of ($api_dacl*) and
        (1 of ($adsk*) or 1 of ($pipe_access*) or 1 of ($pipe_access2*))
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-14478 Autodesk Installer Named Pipe Exploitation Attempt"; 
    flow:to_server; 
    content:"Autodesk"; nocase; 
    fileext:"exe";
    metadata:ruleset Valtersit TI, cve CVE-2026-14478, attack_target Windows_Endpoint, deployment Endpoint, signature_severity Critical, created_at 2026_05_01;
    classtype:attempted-admin; 
    sid:2026144780; 
    rev:1;)

Detection caveat: CVE-2026-14478 is a local-only vulnerability. Network IDS detection is inherently limited. The Suricata rule above only flags outbound transfer of potentially malicious executables that mention "Autodesk" in the filename or content — it cannot detect the local exploitation itself. Endpoint detection via Sigma/Elastic/Splunk rules is strongly preferred.

Elastic Detection

// Elastic EQL Rule — Detect local privilege escalation attempts via named pipe access
// Applicable to Windows endpoints running Elastic Endpoint Security

sequence with maxspan=30s
  [process where event.type == "start" and
     // Low-privileged process attempting to access named pipes
     process.name : ("*pipe*", "handle.exe", "accesschk.exe", "PsExec*.exe") and
     process.args : ("*\\\\.\\pipe\\*", "*pipe*")
  ]
  [file where event.type == "change" and
     // Modification to pipe security settings or suspicious DLL loads
     file.name : ("*.dll", "*.sys") and
     (file.path : "*Autodesk*" or file.path : "*Adsk*")
  ] 

// Secondary EQL — Detect new local processes performing pipe operations with security APIs

process where event.type == "start" and
  process.args : ("*SetSecurityInfo*", "*SetKernelObjectSecurity*", "*OWNER_SECURITY_INFORMATION*", "*DACL_SECURITY_INFORMATION*")

Splunk SPL Query

index=windows sourcetype=XmlWinEventLog:Security
    (EventCode=4656 OR EventCode=4663)
    ObjectName="*pipe*"
    | rex field=ObjectName "pipe\\(?<pipe_name>[^\]]+)"
    | search User!="NT AUTHORITY\\SYSTEM" AND User!="*$"
    | eval target_process = if(match(ProcessName, "(?i)Adsk|Autodesk|installer"), "AUTODESK_INSTALLER", "OTHER")
    | search target_process="AUTODESK_INSTALLER"
    | stats count min(_time) as first_seen max(_time) as last_seen
        by User, ComputerName, ObjectName, ProcessName, EventCode
    | where count > 3
    | eval risk_score = 70
    | table _time, first_seen, last_seen, User, ComputerName, ObjectName, ProcessName, EventCode, count, risk_score

index=windows sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational
    EventCode=10 (ProcessAccess)
    | search TargetImage="*Autodesk*" OR TargetImage="*Adsk*"
    | search SourceImage!="C:\\Program Files\\Autodesk\\*"
    | eval privileged_source = if(match(SourceImage, "(?i)(?<!low|restricted)"), "POTENTIAL_ELEVATED", "UNKNOWN")
    | table _time, Computer, User, SourceImage, TargetImage, GrantedAccess

Wazuh OSSEC Rule

<group name="autodesk_cve_2026_14478,">
  <!-- Detect process access to Autodesk named pipes from non-standard processes -->
  <rule id="171647" level="12">
    <if_sid>550</if_sid> <!-- Parent: Windows Security 4656/4663 event logs -->
    <field name="win.event.type">4656|4663</field>
    <field name="win.eventData.objectName" type="pcre2">\\pipe\\.*</field>
    <field name="win.eventData.processName" type="pcre2">(?i).*(adsk|autodesk).*</field>
    <description>CVE-2026-14478: Named pipe access attempt against Autodesk Installer by: $(win.eventData.subjectUserName)</description>
    <group>privilege_escalation,cve_2026_14478,</group>
  </rule>

  <rule id="171648" level="14">
    <if_sid>1447801</if_sid>
    <field name="win.eventData.subjectUserName" type="pcre2">(?i)(?!nt authority)</field>
    <description>CVE-2026-14478: Non-SYSTEM account $(win.eventData.subjectUserName) accessing Autodesk named pipes - possible exploit</description>
    <group>privilege_escalation,cve_2026_14478,</group>
  </rule>

  <rule id="171649" level="10">
    <if_sid>550</if_sid>
    <field name="win.event.type">4663</field>
    <field name="win.eventData.objectName" type="pcre2">\\pipe\\.*</field>
    <field name="win.eventData.accessList" type="pcre2">(?i).*(WRITE_DAC|WRITE_OWNER|READ_CONTROL).*</field>
    <description>CVE-2026-14478: Attempt to modify permissions/ownership of Autodesk Installer named pipe by: $(win.eventData.subjectUserName)</description>
    <group>privilege_escalation,cve_2026_14478,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment

Patch confidence is rated 2/4 (CLAIMED). NVD lists a patch availability status, but the vendor advisory and specific patch version have not been independently confirmed. Analysts should treat the patch availability as unverified until Autodesk issues an official security advisory.

1. Immediate Mitigations

Pending patch verification and deployment, implement the following controls:

• Restrict local execution: Enforce application allowlisting (Windows Defender Application Control, AppLocker) to prevent unauthorized executables from running, specifically blocking non-signed binaries in user-writable paths.
• Remove local admin rights: Ensure all Autodesk product users operate under least-privilege accounts with no local administrator rights.
• Monitor and restrict named-pipe creation: Use Windows Defender Firewall and/or local security policy to restrict which services can create/access named pipes in the Autodesk namespace.
• Harden the installer context: If feasible, configure Autodesk Installer services to run under a least-privilege service account rather than SYSTEM (may break functionality — test first).
• Apply Software Restriction Policies to prevent execution from temporary directories (%TEMP%, %APPDATA%) where malicious executables commonly execute.

2. Patch / Upgrade Steps

1. Verify the official status of CVE-2026-14478 on the Autodesk Security Advisory page.
2. Identify the specific Autodesk product versions installed on your endpoints (AutoCAD, Revit, Inventor, Autodesk Desktop App, etc.).
3. Check the Autodesk Desktop Application for available updates; if a patch is released, apply it in a staged rollout:
   • Test on a small pilot group of non-production machines.
   • Validate that core product functionality (install, repair, licensing) remains intact.
   • Roll out via your enterprise patch management solution (SCCM, Intune, BigFix, etc.).
4. Since NVD lists a patch but the specific patched version is not disclosed, contact Autodesk Support directly for the confirmed patched build number before deploying.

3. Long-Term Hardening

• Implement Privileged Access Workstations (PAW) for users who require Autodesk products with elevated installation rights.
• Adopt a zero-trust endpoint model where local privilege escalation paths are systematically identified and remediated.
• Enable Windows 10/11 Credential Guard and Device Guard to limit the impact of local privilege escalation.
• Segment engineering/CAD workstations from general-user workstations in network architecture.
• Subscribe to Autodesk Trust Center alerts to receive immediate notification of patch releases and version-specific advisories.
• Maintain a patch-management SLA for all Autodesk product updates, not just security-critical ones (installer components are frequently updated).
• Periodically audit named-pipe DACLs on endpoints using accesschk or scripted PowerShell to identify permissive ACLs on elevated-service pipes.

References

1. NVD Entry: CVE-2026-14478 — NIST National Vulnerability Database — Official CVE record with CVSS vector, CWE classification, and patch status.

2. Autodesk Trust Center: Autodesk Security Advisories — Vendor security advisory portal; monitor for the official CVE-2026-14478 advisory and patched version details.

3. MITRE ATT&CK: T1068 — Exploitation for Privilege Escalation — Technique mapping for this vulnerability's exploitation impact.

4. MITRE CWE: CWE-732 — Incorrect Permission Assignment for Critical Resource — Underlying weakness class describing the named-pipe permission misconfiguration.

5. EPSS Data: FIRST EPSS Scoring for CVE-2026-14478 — Exploit Prediction Scoring System data indicating low (0.00109) current likelihood of exploitation.

Threat Actor Activity

• No exploit-in-the-wild evidence: No public reports of CVE-2026-14478 being exploited in real-world campaigns.
• No known threat actor association: No ransomware groups, APT actors, or cybercrime operations have been publicly linked to this CVE.
• No CISA KEV status: This vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.
• No public PoC or exploit code: GitHub, Exploit-DB, and other public repositories show no published proof-of-concept for this vulnerability as of this report's date.