Insecure Permissions Enable Local Privilege Escalation in Foxit

A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-91798 represents a critical privilege escalation flaw in Foxit PDF Editor and Reader where the update daemon's configuration file is writable by unprivileged users. This CWE-732 weakness allows an attacker with local access to modify daemon configuration settings and inject malicious scripts that execute with elevated privileges when the update process runs. The vulnerability affects any organization deploying Foxit for PDF handling, particularly enterprises where multiple users share systems or where local access controls are not strictly enforced. The impact is severe: an attacker can escalate from a standard user account to system or daemon privileges, potentially compromising the entire system.

Casky's 224 mapped skills against MITRE ATT&CK technique TA0004 (Privilege Escalation) enable practitioners to detect exploitation attempts across multiple attack vectors. Claude's extended reasoning identifies suspicious patterns including: unauthorized modification of daemon configuration files, privilege escalation via service manipulation, and script execution context anomalies. A practitioner using Casky would surface findings showing process hierarchy violations (legitimate user spawning daemon-level processes), file permission misconfigurations on update-related directories, and execution of scripts from unexpected sources with elevated tokens. By correlating these indicators across the 754 mapped security skills, Casky helps teams identify both pre-exploitation reconnaissance—such as probing file permissions on update daemons—and post-exploitation artifacts that confirm privilege escalation has occurred.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-91798.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-91798

Casky has 224 skills that investigate the attack patterns behind CVE-2026-91798. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn