CVE-2026-6064: AVG Internet Security avgToolsSvc Link-Following Privilege Escalation — Detection and Remediation Guide

The Zero Day Initiative has published ZDI-26-832, disclosing a local privilege escalation vulnerability in AVG Internet Security, tracked as CVE-2026-6064 with a CVSS score of 7.3. The flaw resides in the avgToolsSvc service — a privileged component that runs with elevated (SYSTEM) rights — and is rooted in link following (CWE-59): the service operates on files or directories at a path that a low-privileged attacker can influence, and it follows attacker-planted symbolic links, junctions, or reparse points to a target of the attacker's choosing.

The exploitation prerequisite matters: an attacker must first be able to execute low-privileged code on the host. That sounds like a mitigating factor — it isn't. In nearly every real-world intrusion I have worked, initial access lands as a standard user: a phished endpoint, a drive-by download, a cracked software installer, a low-value RDP credential. The difference between a contained compromise and full domain dominance is almost always whether the attacker can escalate. Vulnerabilities like CVE-2026-6064 are precisely the bridge between "user-level foothold" and "SYSTEM-level persistence," which is why EDR solutions, ransomware operators, and post-exploitation frameworks actively weaponize link-following bugs in security products.

There is a particular irony — and operational risk — in privilege escalation flaws inside security software itself. Organizations deploy AV/EDR to raise the cost of compromise; a local EoP in the AV agent hands that advantage back to the adversary on a product they installed deliberately and likely exempted from other controls.

Technical Analysis

Affected Component

• Product: AVG Internet Security (Windows endpoint installations)
• Component: avgToolsSvc service (runs as a high-integrity/system-privileged Windows service)
• Vulnerability class: Link following / improper privilege management (CWE-59 — Improper Link Resolution Before File Access)
• CVE: CVE-2026-6064
• CVSS: 7.3 (High — local attack vector, low-privilege prerequisite, high impact to confidentiality/integrity/availability)
• Advisory: ZDI-26-832

How the Vulnerability Works (Defender's Perspective)

Link-following privilege escalation bugs follow a well-established pattern, and CVE-2026-6064 fits it:

1. Privileged operation on an attacker-controllable path. The avgToolsSvc service performs a file operation — delete, move, rename, overwrite, permission assignment, or content write — at a path inside a directory that a standard user can write to (commonly under %ProgramData%, %TEMP%, or a product log/quarantine directory).

2. Missing or insufficient reparse-point validation. Before the privileged operation, the service fails to verify that the target path is a real file and not a symbolic link, NTFS junction, or mount point. In some variants, there is a check, but it is TOCTOU-racy (time-of-check to time-of-use), allowing the attacker to swap the link between validation and execution.

3. Attacker plants the link. Using only standard-user rights, the attacker creates a junction or symlink pointing the service's target path at a sensitive destination — for example C:\Windows\System32, a privileged service binary, a scheduled task file, or a DLL the service will load.

4. The privileged service does the dirty work. avgToolsSvc, running as SYSTEM, executes the operation against the redirected target. Depending on the operation type, the attacker achieves an arbitrary file delete, arbitrary file write with controlled or partially controlled content, or ACL modification on a system file — each of which converts cleanly into SYSTEM-level code execution (hijack a service binary, overwrite a DLL loaded by a privileged process, etc.).

Exploitation Requirements and Status

• Prerequisite: Local, low-privileged code execution on an endpoint running the vulnerable AVG build. No user interaction beyond the attacker's own action is needed once on the box.
• Exploitation status: As of publication of the ZDI advisory, this is a coordinated disclosure. ZDI's typical process implies the vendor was notified in advance and a fix window was observed. There is no confirmed public report of mass in-the-wild exploitation at the time of writing, but link-following EoP primitives are among the most rapidly weaponized vulnerability classes once technical details surface — the technique requires no kernel interaction, no race-winning reliability engineering in the simpler variants, and no exploit mitigations bypasses. Treat "no confirmed exploitation" as "exploit code will exist soon," not as "safe to defer."
• CISA KEV: Not listed at time of publication. Monitor CISA KEV — if added, federal remediation deadlines (typically 3 weeks) apply and are a useful internal forcing function even for private-sector teams.

Why This Matters in Your Kill Chain

Ransomware intrusion sets and APT operators alike budget for a local EoP as a standard post-exploitation step. The ATT&CK mapping here is direct: T1068 — Exploitation for Privilege Escalation, with the underlying behavior touching T1202 (Indirect Command Execution via the service), T1574 (Hijack Execution Flow) if the write primitive is used for DLL planting, and T1078 in the broader sense of gaining higher-integrity tokens. A working CVE-2026-6064 exploit collapses your layered controls: with SYSTEM on the endpoint, the attacker can tamper with or blind the very AV product they just escalated through, dump LSASS (often gated by AV tamper protection — now bypassable), and pivot.

Detection & Response

The honest constraint: a link-following EoP is a local attack executed by a legitimate, signed, trusted process (the AVG service) performing file operations it is nominally allowed to perform. You will not catch it with a hash-based IOC or a signature. You catch it by watching the behavioral preconditions and the second-order artifacts: low-privileged processes creating junctions/symlinks in AVG-managed paths, avgToolsSvc touching files outside its expected operational directories, and the downstream privilege-escalation artifacts (new service installs, DLL writes to System32, suspicious child processes of AVG services).

The following detections are tuned for those observables. Deploy them in audit/monitor mode first in any environment with heavy developer or admin tooling that legitimately uses junctions (rare on endpoints, common on build servers).

Sigma Rules

---
title: Link Creation in AVG ProgramData or Temp Paths by Non-System Process
id: 3f9a2c14-7b6e-4d21-9a58-5c2e1f8b3d47
status: experimental
description: Detects creation of symbolic links or NTFS junctions in AVG-controlled directories or user-writable temp paths by processes other than SYSTEM or the AVG installer/updater — a prerequisite step for link-following privilege escalation against avgToolsSvc (CVE-2026-6064).
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-26-832/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
  selection_junction:
    CommandLine|contains:
      - 'mklink'
      - '/J '
      - '/D '
      - 'New-Item -ItemType Junction'
      - 'New-Item -ItemType SymbolicLink'
      - 'CreateSymbolicLink'
  selection_paths:
    CommandLine|contains:
      - '\AVG\'
      - 'avgToolsSvc'
      - '\ProgramData\AVG'
  filter_system:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection_tool and selection_junction and selection_paths and not filter_system
falsepositives:
  - AVG support scripts or vendor troubleshooting procedures run interactively
  - Enterprise packaging tools migrating AVG data directories
level: high
---
title: avgToolsSvc Spawning Unexpected Child Processes
id: 8d4c1b72-3e5f-4a69-b2c7-9f1d6e4a2b35
status: experimental
description: Detects the AVG privileged service avgToolsSvc spawning shells, script engines, or LOLBins — a strong post-exploitation indicator after successful privilege escalation via CVE-2026-6064 or service binary hijacking.
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-26-832/
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.execution
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\avgToolsSvc.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\sc.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare: AVG support remediation tooling invoked by the vendor during an active support case
level: critical
---
title: Suspicious File Write to System32 Following AVG Service Activity
id: 5e2b8d41-6c9a-4f3b-8d17-2a4c7e9b1f63
status: experimental
description: Detects creation or modification of executables or DLLs in System32/SysWOW64 by non-standard processes, correlated in time with link-following escalation primitives against AVG avgToolsSvc (CVE-2026-6064).
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-26-832/
  - https://attack.mitre.org/techniques/T1574/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1574.001
  - attack.persistence
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Windows\System32\'
      - '\Windows\SysWOW64\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.sys'
  filter_legit:
    Image|contains:
      - '\Windows\System32\'
      - '\Windows\SysWOW64\'
      - '\Windows\SoftwareDistribution\'
      - '\Windows\WinSxS\'
      - 'msiexec.exe'
  filter_updaters:
    Image|contains:
      - '\AVG\'
      - '\Avast\'
  condition: selection_path and selection_ext and not filter_legit and not filter_updaters
falsepositives:
  - Third-party software installers running elevated (validate against change-management records)
  - Enterprise software deployment agents (SCCM/Intune) — tune with known agent paths
level: high

KQL — Microsoft Sentinel / Defender

This query hunts for the two highest-signal behaviors in one pass: link-creation tooling referencing AVG paths by non-SYSTEM identities, and avgToolsSvc spawning unusual child processes. It runs against Defender for Endpoint telemetry (DeviceProcessEvents) with a Sysmon SecurityEvent fallback.

// Hunt: AVG avgToolsSvc link-following EoP preconditions and post-exploitation (CVE-2026-6064 / ZDI-26-832)
let Lookback = 7d;
let LinkTools = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe","net.exe","net1.exe","sc.exe","whoami.exe"]);
let JunctionIndicators = dynamic(["mklink", "/J ", "/D ", "New-Item -ItemType Junction", "New-Item -ItemType SymbolicLink", "CreateSymbolicLink"]);
union
(DeviceProcessEvents
 | where TimeGenerated > ago(Lookback)
 | where FileName in~ (LinkTools)
 | where ProcessCommandLine has_any (JunctionIndicators)
 | where ProcessCommandLine has "AVG" or ProcessCommandLine has "avgToolsSvc"
 | where InitiatingProcessAccountName !in~ ("system","local service","network service")
 | project TimeGenerated, DeviceName, AccountName=InitiatingProcessAccountName, FileName, ProcessCommandLine, Indicator="Junction/symlink creation referencing AVG paths", SHA256, ReportId),
(DeviceProcessEvents
 | where TimeGenerated > ago(Lookback)
 | where InitiatingProcessFileName =~ "avgToolsSvc.exe"
 | where FileName in~ (SuspiciousChildren)
 | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, Indicator="avgToolsSvc spawned suspicious child process", SHA256, ReportId)
)
| sort by TimeGenerated desc

If your AVG endpoints are not onboarded to Defender for Endpoint, ingest Sysmon via the Sentinel AMA connector and run the equivalent against Event/SecurityEvent filtering on EventID 4688 with command-line auditing enabled — the same string logic applies.

Velociraptor VQL

Use this artifact for fleet-scale sweeps to identify (a) unexpected reparse points inside AVG data directories and (b) suspicious lineage of processes parented to avgToolsSvc — useful both for proactive hunting and for scoping during an IR engagement on a host where you suspect the EoP was used.

-- Hunt: Reparse points in AVG directories and avgToolsSvc child process lineage (CVE-2026-6064)
-- Part 1: Find junction/symlink artifacts under AVG ProgramData and install paths
SELECT FullPath, Name, Mode, Mtime,
       parse_pe(file=FullPath) IS NOT NULL AS IsExecutable
FROM glob(globs=[
  'C:/ProgramData/AVG/**',
  'C:/Program Files/AVG/**',
  'C:/Program Files (x86)/AVG/**'
])
WHERE Mode =~ 'l'           -- symlink/reparse attribute
   OR Mode =~ 'L'

-- Part 2: Processes parented by avgToolsSvc.exe
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
      SELECT Pid FROM pslist() WHERE Name =~ 'avgToolsSvc'
)
  AND Name =~ '(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|net|sc)\\.exe'

Remediation & Verification Script

The following PowerShell performs three functions: (1) inventory — identify AVG installations and the avgToolsSvc binary version across the local machine, (2) audit — enumerate existing reparse points in AVG-writable directories that a standard user could have planted, and (3) harden/verify — confirm the service is running, check for suspicious child processes, and prompt the update path. Run elevated. For fleet deployment, wrap in your RMM/Intune/SCCM of choice.

# CVE-2026-6064 (ZDI-26-832) - AVG avgToolsSvc link-following EoP
# Inventory, audit, and verification script - run elevated

$ErrorActionPreference = 'SilentlyContinue'

# --- 1. Inventory: locate avgToolsSvc and report version ---
$svc = Get-CimInstance Win32_Service -Filter "Name='avgToolsSvc'"
if ($svc) {
    $svcPath = $svc.PathName -replace '"','' -replace ' .*',''
    $ver = (Get-Item $svcPath).VersionInfo.FileVersion
    Write-Host "[+] avgToolsSvc found: $svcPath" -ForegroundColor Cyan
    Write-Host "[+] File version: $ver" -ForegroundColor Cyan
    Write-Host "[!] ACTION: Compare against the fixed build in the AVG vendor advisory (ZDI-26-832)." -ForegroundColor Yellow
} else {
    Write-Host "[-] avgToolsSvc service not present - host may not be affected." -ForegroundColor Green
}

# --- 2. Audit: find reparse points (junctions/symlinks) in AVG-writable dirs ---
$avgDirs = @("$env:ProgramData\AVG", "$env:ProgramFiles\AVG", "${env:ProgramFiles(x86)}\AVG")
foreach ($dir in $avgDirs) {
    if (Test-Path $dir) {
        Get-ChildItem -Path $dir -Recurse -Force -Attributes ReparsePoint |
            ForEach-Object {
                Write-Host "[!] REPARSE POINT: $($_.FullName) -> $($_.Target)" -ForegroundColor Red
            }
    }
}

# --- 3. Audit: suspicious child processes of avgToolsSvc in the last 24h (event log) ---
$start = (Get-Date).AddDays(-1)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$start} |
    Where-Object { $_.Message -match 'avgToolsSvc\.exe' -and $_.Message -match '(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32)\.exe' } |
    ForEach-Object { Write-Host "[!] SUSPICIOUS CHILD: $($_.TimeCreated) :: $($_.Message.Substring(0,[Math]::Min(400,$_.Message.Length)))" -ForegroundColor Red }

# --- 4. Trigger update check / report state ---
Write-Host "[i] Open AVG Internet Security > Menu > Settings > Update, or push the vendor-fixed build via your deployment tooling." -ForegroundColor Cyan
Write-Host "[i] Confirm tamper protection is ENABLED so attackers cannot kill/modify the agent post-escalation." -ForegroundColor Cyan

Remediation

1. Patch immediately. Apply the fixed build of AVG Internet Security published by Gen Digital (AVG/Avast) in response to ZDI-26-832 / CVE-2026-6064. Retrieve the current advisory and fixed version from the ZDI advisory page and AVG's update channel (Menu → Settings → Update → Check for updates), or via your managed AV console if you deploy through Avast/AVG Business Hub. Confirm the build number on every endpoint — auto-update is not a guarantee; verify with the inventory section of the script above.

2. Force-update stragglers. Endpoints isolated from update servers (OT-adjacent workstations, lab machines, dormant VDI images) are exactly where a local EoP gets exploited months later. Sweep your asset inventory for stale avgToolsSvc versions and remediate by exception report, not by assumption.

3. Reduce the blast radius before patching completes.

   • Enforce least privilege: standard users should never hold local admin. This bug requires only low-privileged code execution, but removing admin rights constrains what the attacker does after SYSTEM (e.g., certain persistence and defense-evasion steps).
   • Ensure AVG tamper protection / self-defense is enabled so the post-escalation step of disabling the agent is harder.
   • Where feasible, restrict write access for standard users to product-managed directories that privileged services operate on (%ProgramData%\AVG subdirectories). Test against update functionality before broad rollout.

4. Hunt retroactively. Local EoP in an AV product is the kind of finding that justifies a lookback, not just a forward patch. Run the KQL query above over the last 30 days (extend table retention window as licensed). If you find junctions in AVG paths created by interactive user sessions, escalate to IR: assume the EoP was used and scope for credential access (LSASS), new services/scheduled tasks, and unexpected SYSTEM-spawned child processes.

5. Layered endpoint controls. Application control (WDAC/AppLocker) limiting what unsigned or user-context binaries can execute shrinks the attacker's ability to stage the link-creation tooling and the post-escalation payload. EDR tamper detection should alert on avgToolsSvc termination attempts.

6. Track KEV and vendor updates. Monitor the CISA Known Exploited Vulnerabilities catalog for CVE-2026-6064. If it lands there, expect a Binding Operational Directive deadline for federal agencies and treat that date as your own internal SLA.

The strategic lesson is durable: your security stack is part of your attack surface. Every privileged agent — AV, EDR, backup, RMM — is a high-value target for link-following and file-operation bugs because it runs at the highest integrity level and touches attacker-writable paths by design. Include security-agent version drift in your vulnerability management program with the same rigor you apply to the OS and browser.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub