CVE-2026-15684

Executive Summary

CVE-2026-15684 is a local privilege escalation (LPE) vulnerability in Glarysoft Glary Utilities' Disk Clean functionality. The flaw, discovered through the Zero Day Initiative (ZDI-CAN-27004), allows a low-privileged local attacker to leverage a link-following weakness (CWE-59) to abuse the service into deleting arbitrary files, ultimately achieving arbitrary code execution in the context of SYSTEM. Affected systems include all Windows endpoints running unpatched versions of Glary Utilities. With a CVSS score of 7.3 (High), this vulnerability represents a significant post-exploitation escalation vector; however, exploitation requires pre-existing low-privileged code execution on the target, limiting remote exploitability.

Technical Analysis

The vulnerability resides in the Disk Clean functionality of Glarysoft Glary Utilities. The specific flaw is classified as CWE-59, "Improper Link Resolution Before File Access," commonly known as a "link following" vulnerability. This class of bug occurs when an application fails to verify whether a path it is operating on is a reparse point, junction, or symbolic link before performing file operations.

Vulnerability Mechanism:

The Disk Clean service, which typically runs with elevated privileges (SYSTEM), scans and deletes temporary or junk files based on predefined path rules. The vulnerable code path does not validate whether the target directories or files are genuine filesystem objects or NTFS junctions/symlinks. An attacker can pre-create a junction pointing from a path the service cleans (e.g., a user-writable temporary directory) to a sensitive system location (e.g., C:\Windows\System32, C:\Program Files\, or the Windows Registry hive files).

When the Disk Clean service processes its cleanup routine, it follows the junction and performs delete operations on the resolved target. This results in arbitrary file deletion with SYSTEM privileges. While the primary primitive is file deletion, this can be escalated to arbitrary code execution via well-known techniques:

1. DLL Search Order Hijacking: Deleting a legitimate DLL from a SYSTEM-writable path and replacing it with a malicious one before the service or another process loads it.
2. Service Binary Replacement: Deleting binary files of a service that runs as SYSTEM and replacing them with a malicious payload.
3. Token Impersonation: Leveraging the service's privileges to interact with the protected storage, then abusing other subsystems.

Attack Surface:

• Preconditions: The attacker must already have the ability to execute low-privileged code (e.g., a foothold from another vulnerability, a malicious screensaver, or an unprivileged malware process).
• Local only: The attack is initiated from the local machine; no network exposure is involved.
• User Interaction: None required beyond the victim or the scheduled task triggering the Disk Clean utility.

Affected Versions: The NVD and ZDI entries do not specify any patched or unpatched version ranges. The patch confidence is 0/4, indicating no patch evidence from any tracked source. All versions of Glary Utilities containing the vulnerable Disk Clean code path should be considered affected until a vendor advisory is released.

Exploitation Scenarios

Attack Scenario: Local Privilege Escalation via Junctions in Disk Clean

1. Reconnaissance & Target Identification:

   • The attacker has local low-privileged access (e.g., obtained via phishing that dropped a dropper, or via a previous RCE on a service running as a limited user).
   • The attacker enumerates the filesystem for the installed Glary Utilities path and identifies the Disk Clean service binary (often GlaryDiskClean.exe or a system service named Glary Utilities).
   • The attacker checks if the service is set to auto-start or is triggered via scheduled tasks (schtasks /query), which is common for disk cleaning utilities.

2. Weaponization & Trigger:

   • Step 1 — Create a Malicious Junction: The attacker, running as a low-privileged user, creates a directory in a location that the Disk Clean service is known to clean (e.g., C:\Users\<user>\AppData\Local\Temp\junk).
   • Step 2 — Link to Target: Using cmd /c mklink /J "C:\Users\<user>\AppData\Local\Temp\junk" "C:\Windows\System32\sensitivedir" or the junction.exe tool from Sysinternals, the attacker creates an NTFS junction pointing to a sensitive directory where a file must be deleted (e.g., C:\Windows\System32\drivers\ or C:\Program Files\Common Files\).
   • Step 3 — Trigger Disk Clean: The attacker either waits for the scheduled task to run, invokes the service with sc start or net start, or manually launches the Disk Clean UI from the command line with flags that trigger the automatic scan (GlaryDiskClean.exe /auto).

3. Payload & Execution:

   • Phase A — Arbitrary File Deletion: The Disk Clean service, running as SYSTEM, traverses the junction. It resolves the path and begins deleting files within C:\Windows\System32\sensitivedir\. The attacker strategically targets a file that will not immediately crash the system but is required by a security product or a service (e.g., C:\Windows\System32\drivers\guard.sys from an AV or EDR).
   • Phase B — Payload Deployment: Before the service fully exits or during the deletion process, the attacker drops a malicious binary (e.g., a renamed nc.exe or a custom backdoor) into the now-vacated path, or they replace a DLL that a high-privileged process (e.g., svchost.exe) will load next.
   • Phase C — Privilege Escalation: The attacker waits for the system to relaunch the deleted service or DLL. The malicious code executes with SYSTEM privileges.

4. Post-Exploitation Impact:

   • The attacker achieves full SYSTEM-level code execution on the host.
   • They can disable security controls, dump LSASS for credential harvesting, deploy persistence mechanisms (e.g., scheduled tasks, services, registry Run keys), and pivot laterally across the network.
   • Because ephemeral ps > c:\temp\out.txt outputs are written to a user-writable temp path, the attack footprint can be cleaned by the same Disk Clean utility, making forensic analysis challenging.

Impact Assessment

CVSS Analysis (Score: 7.3 — High):

• Attack Vector (AV): Local — The attacker must have local access; no network component.
• Attack Complexity (AC): Likely Low, as junction creation is trivial.
• Privileges Required (PR): Low (standard user).
• User Interaction (UI): None.
• Confidentiality (C): High — arbitrary file reads can be achieved by redirecting the service to read-then-delete interactions, though the primary primitive is deletion.
• Integrity (I): High — arbitrary file deletion paves the way for code and binary replacement.
• Availability (A): High — malicious deletion of critical system files (e.g., ntoskrnl.exe replacement or core DLLs) can cause a denial of service.

Business Impact:

• Affected Systems: All Windows workstations and servers where Glary Utilities is installed (commonly a free utility bundled with OEM systems or installed by users for maintenance).
• Blast Radius: Single-host compromise of a low-privileged user leads to full host takeover. In environments where Glary Utilities is deployed via software management tools to fleets of machines, a single foothold can cascade to domain-wide compromise if the attacker moves laterally from the SYSTEM shell.
• Detection Evasion: The service runs legitimately, so its actions (deleting files) are often whitelisted by security products. Traditional EDR may not flag a signed Glarysoft binary following a junction.

Detection Guidance

Note: Since the vulnerability is purely local (no network traffic generated for exploitation), the following detection rules focus on host-based artifacts: file system junctions, anomalous file deletions by the Glary Utilities process, and registry modifications. Network rules (Suricata) are included for completeness but would only detect post-exploitation C2 traffic.

Sigma Rule

title: Suspicious Junction Creation Followed by Glary Disk Clean File Deletion
id: 7a44b3c1-2d9e-4f6a-8bcd-1234567890ab
status: experimental
description: Detects creation of a junction followed by file deletion activity from Glary Utilities Disk Clean, indicating a potential CVE-2026-15684 exploitation attempt.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15684
author: ValtersIT Threat Intel
date: 2026/06/01
logsource:
    product: windows
    category: file_event
detection:
    selection_junction:
        EventID: 1  # Sysmon file creation
        TargetFilename|contains: '\AppData\Local\Temp\'
        Image|endswith: '\cmd.exe'
        CommandLine|contains|all:
            - 'mklink'
            - '/J'
    selection_delete:
        EventID: 23  # Sysmon file delete
        Image|endswith: '\GlaryDiskClean.exe'
        TargetFilename|contains:
            - '\System32\'
            - '\Program Files\'
            - '\config\'
    condition: selection_junction followed by selection_delete within 5 minutes
fields:
    - Computer
    - User
    - Image
    - TargetFilename
    - CommandLine
falsepositives:
    - Legitimate admin creating junctions for troubleshooting.
level: high

YARA Rule

rule CVE_2026_15684_Glary_Utility_LPE
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects malicious junction creation and file deletion commands used for CVE-2026-15684 exploitation"
        date = "2026-06-01"
        cve = "CVE-2026-15684"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-15684"
    strings:
        $s1 = "mklink /J" ascii wide nocase
        $s2 = "GlaryDiskClean.exe" ascii wide nocase
        $s3 = "\\System32\\" ascii wide nocase
        $s4 = "\\Program Files\\" ascii wide nocase
        $s5 = "junction.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and  // MZ header
        any of ($s*) and
        (#s1 > 0 or #s5 > 0) and
        (#s2 > 0) and
        (#s3 > 0 or #s4 > 0)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-15684 Glary Utilities LPE - Malicious C2 Beacon"; 
    content:"PowerShell"; http.uri; 
    content:"Invoke-"; http.uri; 
    content:"Mimikatz"; http.uri; 
    classtype:trojan-activity; 
    sid:1002684; rev:1;)

Note: Since CVE-2026-15684 is a local vulnerability, network detection only works for post-exploitation activities. The rule above is an example of detecting a common post-exploitation C2 beacon from the SYSTEM shell.

Elastic Detection

sequence by host.name with maxspan=10m
  [any where process.name == "cmd.exe" and process.command_line contains "mklink /J"]
  [file where process.name == "GlaryDiskClean.exe" and event.action == "deletion" and 
     file.path : ("C:\\Windows\\System32\\*", "C:\\Program Files\\*", "C:\\Windows\\config\\*")]

Splunk SPL Query

index=windows EventCode=23 OR EventCode=1
| eval event_type = if(EventCode==1, "file_create", "file_delete")
| where (event_type=="file_create" AND ProcessName="*cmd.exe" AND CommandLine="*mklink /J*") OR
        (event_type=="file_delete" AND ProcessName="*GlaryDiskClean.exe" AND (FileName="*System32*" OR FileName="*Program Files*"))
| transaction host maxspan=5m 
| where eventstats count(eval(event_type=="file_create")) > 0 AND count(eval(event_type=="file_delete")) > 0
| table _time, host, user, ProcessName, CommandLine, TargetFilename
| sort _time

Wazuh OSSEC Rule

<group name="sysmon,">
    <rule id="100684" level="12">
        <if_sid>92050</if_sid>
        <field name="win.eventdata.image">.*\\GlaryDiskClean\.exe</field>
        <field name="win.eventdata.targetFilename">.*\\System32\\.*</field>
        <description>CVE-2026-15684: Glary Utilities Disk Clean deleting files in System32, possible junction abuse.</description>
        <group>privilege_escalation,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

Note: The vendor has not released a fix at the time of this report. The following actions are interim and hardening measures.

1. Immediate Mitigations (Interim Controls):

   • Restrict Disk Clean Access: Disable the Glary Utilities Disk Clean scheduled task and service if not strictly business-critical. Use Group Policy to set the service to "Disabled" (sc config <service> start= disabled).
   • Block Junction Creation: Harden user-writable directories by applying restrictive ACLs. Remove the CreateSymbolicLink privilege for standard users via secpol.msc → Local Policies → User Rights Assignment — though this does not block NTFS junctions (which use FILE_WRITE_ATTRIBUTES), it reduces the attack surface.
   • Application Whitelisting: Use AppLocker or WDAC to block execution of GlaryDiskClean.exe if not required, or run it in an isolated sandbox with minimal privileges.
   • Endpoint Monitoring: Deploy the Sigma/Sysmon rules above to alert on junction-then-delete patterns. Harden EDR policies to monitor for file deletions in protected paths by unknown processes.

2. Patch/Upgrade Steps:

   • Monitoring for Fix: Track the ZDI advisory page (ZDI-CAN-27004) and Glarysoft's official update channel for a patched version.
   • When Patch Becomes Available: Glarysoft typically releases silent in-app updates. Ensure the "Automatically update to the latest version" setting is enabled in Glary Utilities' settings, or manually download the latest version from the official site (glarysoft.com).
   • Immediate Action Upon Patch: Uninstall the current version, reboot, and install the patched version. Verify the installed version number after update.

3. Long-Term Hardening:

   • Least Privilege Principle: Review software running with SYSTEM privileges on all endpoints. Remove or replace system-level utilities that can be abused for junction attacks (not just Glary Utilities; also consider WinRAR, 7-Zip maintenance scripts, and AV self-protection modules).
   • NTFS Protection: Implement controlled folder access (Windows Defender Exploit Guard) to protect critical system directories from unexpected writes and deletes.
   • Credential Guard & LSA Protection: Enable Windows Credential Guard and LSA protection to mitigate post-exploitation credential dumping if the SYSTEM shell is achieved.
   • Network Segmentation: Isolate high-value assets so a single host compromise does not immediately lead to lateral movement. Use Tiered Administration models.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-15684 — Official CVE description and CVSS metadata.
2. Zero Day Initiative (ZDI) Advisory: https://www.zerodayinitiative.com/advisories/ZDI-CAN-27004 — Original researcher advisory with technical details. (Note: This is the source of ZDI-CAN-27004; the advisory may be under embargo at the time of writing.)
3. Mitre ATT&CK Technique Reference: https://attack.mitre.org/techniques/T1547/ — "Boot or Logon Autostart Execution" — relevant post-exploitation persistence pattern if the attacker achieves SYSTEM.
4. CWE-59 Documentation: https://cwe.mitre.org/data/definitions/59.html — "Improper Link Resolution Before File Access ('Link Following')" — vulnerability class reference.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence:

• CISA KEV: Not listed (no evidence of exploitation in the wild).

No known threat actor campaigns are associated with this CVE at the time of reporting. The EPSS score of 0.00142 (4th percentile) indicates a low probability of exploitation in the short term, but LPE chains are commonly weaponized by commodity malware and ransomware gangs once a public PoC is released — continued monitoring is advised.