CVE-2026-19191
Received Received - Intake

Permission Issue in StableBit DrivePool Service

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: VulDB

Description
A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\DrivePool\DrivePool.Service.exe of the component DrivePoolService. Such manipulation leads to permission issues. The attack must be carried out locally. The exploit has been disclosed publicly and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-19191
EUVD
EUVD-2026-54356

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
stablebit drivepool 2.3.13.1687

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-275 Permission Issues
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19191 is a local privilege escalation vulnerability in StableBit DrivePool version 2.3.13.1687. The DrivePoolService runs as LocalSystem and exposes an insecure .NET Remoting IPC endpoint. A local user can connect to a named pipe and send a malicious BinaryFormatter gadget to execute arbitrary commands with SYSTEM privileges due to unsafe deserialization of untrusted input.

Detection Guidance

Check for the named pipe \\.\pipe\StableBitDrivePool_Comm on the system. Use PowerShell command: Get-ChildItem \\.\pipe\ to list active named pipes. If this pipe exists, it may indicate the vulnerable service is running.

Impact Analysis

This vulnerability allows a standard local user to gain SYSTEM-level access on the affected system. An attacker could execute arbitrary code, install malware, modify system files, or take full control of the machine. It bypasses normal access controls and could lead to complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and control of systems handling sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. It may result in data breaches, unauthorized data access, or loss of data integrity, triggering legal and regulatory penalties.

Mitigation Strategies

Disable the DrivePoolService temporarily or update to a patched version. Block access to the named pipe \\.\pipe\StableBitDrivePool_Comm via firewall rules. Restrict local user permissions to prevent unauthorized access to the service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19191. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart