O+ Connect IPC service missing client authentication enables local privilege escalation

O+ Connect ships a local IPC (inter-process communication) endpoint — typically a named pipe, local socket, or COM/LPC interface — used by the privileged service component to take instructions from the user-mode UI. The disclosed flaw (CVE-2026-22078) is that this IPC channel does not authenticate the caller, so any local process running as any user can submit privileged action requests that the service then performs in its own (elevated) security context. Affected builds are everything prior to the vendor-fixed release; check the vendor advisory for the exact branch boundaries, but the CWE-266 classification and AV:L vector are consistent with all shipping versions of the privileged helper being impacted until the patch lands.

Vendor scored this HIGH (7.3). That feels inflated. The vector AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H already concedes the attacker must (a) be local on the box, (b) already hold a low-privilege user shell, and (c) get a user to interact with something. The Scope:Changed and Availability:High components push it into HIGH territory, but for a defender managing 10,000 hosts the practical exposure is local privilege escalation on endpoints where a user account is already compromised — that's a MEDIUM in the noisgate model unless O+ Connect is deployed on tier-0 / admin jump hosts, in which case the floor moves up.

Sources.

1. NVD — CVE-2026-22078 (record placeholder; check for live entry)
2. MITRE CVE — CVE-2026-22078
3. CWE-266 — Incorrect Privilege Assignment
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS — Exploit Prediction Scoring System
6. MITRE ATT&CK T1068 — Exploitation for Privilege Escalation
7. James Forshaw — NtObjectManager (IPC enumeration tooling reference)
8. Microsoft — Privileged Access Workstations guidance (tier-0 model)

Run on each target Windows endpoint with local administrator privileges (needed to read the service binary version). Invoke as .\Check-CVE-2026-22078.ps1 -FixedVersion '<vendor-fixed-version>' — replace the placeholder with the exact build string from the O+ Connect advisory. Deploy via Intune, SCCM, or your config-mgmt agent and aggregate results centrally. Outputs VULNERABLE, PATCHED, or UNKNOWN.

#requires -RunAsAdministrator
# Check-CVE-2026-22078.ps1
# Detects vulnerable O+ Connect installations on Windows endpoints.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN / not installed
param(
    [Parameter(Mandatory=$true)]
    [string]$FixedVersion
)

$ErrorActionPreference = 'Stop'

function Write-Status([string]$s, [int]$code) {
    Write-Output $s
    exit $code
}

# 1. Locate the service. Adjust ServiceName / DisplayName glob to match the vendor's installed service.
$svc = Get-CimInstance Win32_Service -Filter "Name LIKE '%OPlusConnect%' OR Name LIKE '%O+Connect%' OR DisplayName LIKE '%O+ Connect%'" -ErrorAction SilentlyContinue | Select-Object -First 1
if (-not $svc) {
    Write-Status 'UNKNOWN - O+ Connect service not found on this host' 2
}

# 2. Pull binary version from the service ImagePath.
$imagePath = $svc.PathName -replace '^"([^"]+)".*$', '$1' -replace '^(\S+).*$', '$1'
if (-not (Test-Path $imagePath)) {
    Write-Status "UNKNOWN - service binary path not resolvable: $imagePath" 2
}
$installed = (Get-Item $imagePath).VersionInfo.FileVersion
if (-not $installed) {
    Write-Status 'UNKNOWN - could not read FileVersion from service binary' 2
}

# 3. Compare installed vs fixed version.
try {
    $installedV = [version]($installed -replace '[^0-9\.].*$', '')
    $fixedV     = [version]($FixedVersion -replace '[^0-9\.].*$', '')
} catch {
    Write-Status "UNKNOWN - version string parse failed (installed=$installed, fixed=$FixedVersion)" 2
}

if ($installedV -ge $fixedV) {
    Write-Status "PATCHED - installed=$installed >= fixed=$FixedVersion" 0
} else {
    Write-Status "VULNERABLE - installed=$installed < fixed=$FixedVersion (CVE-2026-22078)" 1
}