Because O+ Connect's IPC service does not authenticate clients

O+ Connect ships a local IPC (inter-process communication) endpoint — typically a named pipe, local socket, or COM/LPC interface — used by the privileged service component to take instructions from the user-mode UI. The disclosed flaw (CVE-2026-22078) is that this IPC channel does not authenticate the caller, so any local process running as any user can submit privileged action requests that the service then performs in its own (elevated) security context. Affected builds are everything prior to the vendor-fixed release; check the vendor advisory for the exact branch boundaries, but the CWE-266 classification and AV:L vector are consistent with all shipping versions of the privileged helper being impacted until the patch lands.

Vendor scored this HIGH (7.3). That feels inflated. The vector AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H already concedes the attacker must (a) be local on the box, (b) already hold a low-privilege user shell, and (c) get a user to interact with something. The Scope:Changed and Availability:High components push it into HIGH territory, but for a defender managing 10,000 hosts the practical exposure is local privilege escalation on endpoints where a user account is already compromised — that's a MEDIUM in the noisgate model unless O+ Connect is deployed on tier-0 / admin jump hosts, in which case the floor moves up.

Why this verdict

• Local-only vector (AV:L): Removes the entire unauthenticated-internet attacker population. Real exposure = your installed-base count, not your perimeter.
• Requires existing user foothold (PR:L): This is a privilege amplifier in an active-intrusion chain, not a doorway. Your EDR/initial-access controls are the first and load-bearing line of defense.
• Requires UI interaction (UI:R): Eliminates headless servers and kiosks entirely; further narrows to hosts with active interactive sessions at the moment of attack.
• Role multiplier — typical role (endpoint user app): O+ Connect is an endpoint client. Successful chain → SYSTEM on one workstation. Blast radius = single host. No identity-plane, hypervisor, or CI/CD pivot.
• Role multiplier — high-value role (admin jump host / PAW): If O+ Connect is installed on tier-0 admin workstations, the chain ends in tier-0 credential exposure. This is the worst plausible outcome but is rare by design (PAWs should not run general endpoint apps). Verdict floor stays MEDIUM rather than HIGH because the canonical install base is general endpoints, not PAWs.
• No KEV, no PoC, no in-the-wild reports as of disclosure +1 day. EPSS will start low.

Why not higher?

HIGH would require either (a) internet-facing exposure, (b) no auth/UI prerequisite, or (c) the affected component canonically occupying a high-value role (DC, hypervisor, IdP, CA, backup, kernel agent). None apply: O+ Connect is a user endpoint helper, the chain demands a local foothold AND user interaction, and there is no current evidence of exploitation. If your inventory shows O+ Connect on tier-0 admin workstations, treat THOSE hosts as HIGH and patch in the 30-day window — but the population-wide verdict is MEDIUM.

Why not lower?

LOW would require either no real privilege boundary crossed or a vanishingly small affected population. Neither is true: Scope:Changed and Availability:High in the vector confirm a meaningful privilege boundary is broken, and any commodity malware that lands on a user endpoint can chain this for SYSTEM. IGNORE is wrong because the bug is a real, weaponizable LPE primitive once a PoC drops.

1. Inventory O+ Connect deployments and segment tier-0 hosts — Pull install counts from SCCM/Intune/Jamf/Tanium. Any O+ Connect install on a Privileged Access Workstation, jump host, or domain admin endpoint is an out-of-band remediation — patch THOSE within the noisgate CRITICAL window (≤3 days) even though the bucket-level verdict is MEDIUM. For the general endpoint population, the MEDIUM bucket has no mitigation SLA — schedule patching into your normal monthly train (≤365 days remediation).
2. Confirm EDR is healthy and tuned on every host with O+ Connect installed — This CVE is a post-compromise primitive. Your EDR catching the initial foothold (step 1 of the chain) is what actually prevents exploitation. Verify Defender XDR / CrowdStrike / SentinelOne is reporting in within the last 24h on the full O+ Connect footprint and that tamper protection is on. Do this immediately as part of the MEDIUM hygiene baseline.
3. If supported, ACL the IPC endpoint via host firewall / EDR custom rule — Some vendors document a registry/config flag to restrict the named pipe DACL to specific SIDs as a stopgap. Check the O+ Connect advisory KB for an interim DACL override. If available, push via GPO/Intune within 30 days as a belt-and-braces measure until full patch coverage hits.
4. Block known IPC-enumeration tooling at the EDR custom-rule layer — Detection on PipeViewer/NamedPipeScan/NtObjectManager use on production endpoints is a cheap, durable rule that also catches future IPC-class bugs. Add to your detection backlog this quarter.

Run on each target Windows endpoint with local administrator privileges (needed to read the service binary version). Invoke as .\Check-CVE-2026-22078.ps1 -FixedVersion '<vendor-fixed-version>' — replace the placeholder with the exact build string from the O+ Connect advisory. Deploy via Intune, SCCM, or your config-mgmt agent and aggregate results centrally. Outputs VULNERABLE, PATCHED, or UNKNOWN.

#requires -RunAsAdministrator
# Check-CVE-2026-22078.ps1
# Detects vulnerable O+ Connect installations on Windows endpoints.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN / not installed
param(
    [Parameter(Mandatory=$true)]
    [string]$FixedVersion
)

$ErrorActionPreference = 'Stop'

function Write-Status([string]$s, [int]$code) {
    Write-Output $s
    exit $code
}

# 1. Locate the service. Adjust ServiceName / DisplayName glob to match the vendor's installed service.
$svc = Get-CimInstance Win32_Service -Filter "Name LIKE '%OPlusConnect%' OR Name LIKE '%O+Connect%' OR DisplayName LIKE '%O+ Connect%'" -ErrorAction SilentlyContinue | Select-Object -First 1
if (-not $svc) {
    Write-Status 'UNKNOWN - O+ Connect service not found on this host' 2
}

# 2. Pull binary version from the service ImagePath.
$imagePath = $svc.PathName -replace '^"([^"]+)".*$', '$1' -replace '^(\S+).*$', '$1'
if (-not (Test-Path $imagePath)) {
    Write-Status "UNKNOWN - service binary path not resolvable: $imagePath" 2
}
$installed = (Get-Item $imagePath).VersionInfo.FileVersion
if (-not $installed) {
    Write-Status 'UNKNOWN - could not read FileVersion from service binary' 2
}

# 3. Compare installed vs fixed version.
try {
    $installedV = [version]($installed -replace '[^0-9\.].*$', '')
    $fixedV     = [version]($FixedVersion -replace '[^0-9\.].*$', '')
} catch {
    Write-Status "UNKNOWN - version string parse failed (installed=$installed, fixed=$FixedVersion)" 2
}

if ($installedV -ge $fixedV) {
    Write-Status "PATCHED - installed=$installed >= fixed=$FixedVersion" 0
} else {
    Write-Status "VULNERABLE - installed=$installed < fixed=$FixedVersion (CVE-2026-22078)" 1
}

Sources

1. NVD — CVE-2026-22078 (record placeholder; check for live entry)
2. MITRE CVE — CVE-2026-22078
3. CWE-266 — Incorrect Privilege Assignment
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS — Exploit Prediction Scoring System
6. MITRE ATT&CK T1068 — Exploitation for Privilege Escalation
7. James Forshaw — NtObjectManager (IPC enumeration tooling reference)
8. Microsoft — Privileged Access Workstations guidance (tier-0 model)