CVE-2026-1680 Details
Description
Improper access control in the WCF endpoint in Edgemo (now owned by Danoffice IT) Local Admin Service 1.2.7.23180 on Windows allows a local user to escalate their privileges to local administrator via direct communication with the LocalAdminService.exe named pipe, bypassing client-side group membership restrictions.
A local privilege escalation vulnerability has been identified in Edgemo Local Admin Service version 1.2.7.23180, now owned by Danoffice IT. The issue arises from improper access control in the Windows Communication Foundation (WCF) endpoint of the Local Admin Service. This vulnerability allows a local user to escalate privileges to local administrator by directly communicating with the LocalAdminService.exe named pipe, bypassing client-side group membership restrictions.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://retest.dk/local-privilege-escalation-vulnerability-found-in-local-admin-service/ | CISA-ADP | ExploitThird Party Advisory |
| https://retest.dk/local-privilege-escalation-vulnerability-found-in-local-admin-service/ | National Cyber Security Centre Finland | ExploitThird Party Advisory |
| https://www.danofficeit.com/howwedoit/workplace/management/ | National Cyber Security Centre Finland | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-Other | Weakness Not in a Standard CWE Category | [email protected] |
| CWE-250 | Execution with Unnecessary Privileges | National Cyber Security Centre Finland |
Affected Products
| Product | Versions |
|---|---|
| danofficeit local admin service | 1.2.7.23180 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | National Cyber Security Centre Finland |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 3, 2026 | Initial Analysis | [email protected] |
| Feb 2, 2026 | CVE Modified | CISA-ADP |
| Jan 30, 2026 | New CVE Received | National Cyber Security Centre Finland |