CVE-2026-107707: Intego Antivirus

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.

Affected products

• Intego Intego Antivirus: up to and including 3.0.0.1

Published 2026-10-08. Last modified 2026-10-09.