CVE-2026-22561: Anthropic Claude

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via DLL search-order hijacking. The installer loads DLLs (e.g., profapi.dll) from its own directory after UAC elevation, enabling arbitrary code execution if a malicious DLL is planted alongside the installer.

Affected products

• Anthropic Claude: before 1.1.3363 (fixed in 1.1.3363)

Published 2026-03-31. Last modified 2026-07-24.