CVE-2026-3991

A local, authenticated low-privileged user places or modifies resources that the DLP Windows Endpoint agent loads or references from an untrusted control sphere (for example substituting files, libraries, or other loadable components or influencing a search/load path). Because the agent runs with elevated/system privileges, when the agent loads the attacker-controlled component the attacker-controlled code or functionality executes in the agent's privileged context, resulting in privilege escalation to the agent's elevated account and enabling access to protected data or modification of enforcement behavior. Success is verified by observing elevated process context or ability to perform privileged actions (e.g., access protected files or modify agent behavior).