Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV L L N L N H H H 8.5 .0014 3.3 —
AFFECTED Product Versions Fixed Intego Antivirus unspecified —
TIMELINE Oct 8 Reserved by VulnCheck Oct 8 Published (CNA: VulnCheck) Oct 9 EXPLOIT PUBLISHED — CVE-2026-107707 (Intego Antivirus). Public exploit reference added.
Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.
| Date | Event | Detail |
|---|---|---|
| October 8, 2026 | Reserved | Reserved by VulnCheck |
| October 8, 2026 | Published | Published (CNA: VulnCheck) |
| October 9, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-107707 (Intego Antivirus). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Intego | Intego Antivirus | — | — | — |
Authoritative record: CVE-2026-107707 at cve.org
Vendors: intego
Weaknesses: CWE-59
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-107707 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
