CWE-1386 · File and Path Handling
Insecure Operation on Windows Junction / Mount Point
20CVEs
SortMost likely exploited
20 CVEs with CWE-1386 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-56857Root.Mkdir(All) can follow junctions out of the root on Windows in osGo standard library · os · CVSS 9.8 · 2026-10-08 | 9.8 | 0.6% | 2026-10-08 |
| CVE-2023-40623Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)SAP_SE · SAP BusinessObjects Suite (Installer) · CVSS 6.2 · 2023-09-12 | 6.2 | 0.4% | 2023-09-12 |
| CVE-2024-20887Arbitrary directory creation in GalaxyBudsManager PC prior to version 2.1.240315.51 allows attacker to create arbitrary directory.Samsung Mobile · GalaxyBudsManager PC · CVSS 6.2 · 2024-06-04 | 6.2 | 0.3% | 2024-06-04 |
| CVE-2023-5834Vagrant’s Windows Installer Allowed Directory Junction WriteHashiCorp · Vagrant · CVSS 3.8 · 2023-10-27 | 3.8 | 0.2% | 2023-10-27 |
| CVE-2024-7400Local privilege escalation in ESET products for WindowsESET, spol. s r.o. · ESET NOD32 Antivirus · CVSS 8.5 · 2024-09-27 | 8.5 | 0.2% | 2024-09-27 |
| CVE-2022-42291NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experience software may inadvertently delete data from a linked loc…NVIDIA · GeForce Experience · CVSS 8.2 · 2023-02-07 | 8.2 | 0.2% | 2023-02-07 |
| CVE-2023-32474Dell Display Manager application, version 2.1.1.17 and prior, contain an insecure operation on windows junction/mount point. A local malicious user could potentially exploit this…Dell · Dell Display Manager · CVSS 6.6 · 2024-02-06 | 6.6 | 0.2% | 2024-02-06 |
| CVE-2023-28065Dell Command | Update, Dell Update, and Alienware Update versions 4.8.0 and prior contain an Insecure Operation on Windows Junction / Mount Point vulnerability. A local malicious…Dell · Dell Command Update (DCU) · CVSS 6.7 · 2023-06-23 | 6.7 | 0.2% | 2023-06-23 |
| CVE-2023-28071Dell Command | Update, Dell Update, and Alienware Update versions 4.9.0, A01 and prior contain an Insecure Operation on Windows Junction / Mount Point vulnerability. A local malic…Dell · Dell Command Update (DCU) · CVSS 6.3 · 2023-06-23 | 6.3 | 0.2% | 2023-06-23 |
| CVE-2023-23697Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticated malicious user may po…Dell · Dell Command Update (DCU) · CVSS 4.7 · 2023-02-13 | 4.7 | 0.2% | 2023-02-13 |
| CVE-2023-23698Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on Windows Junction in the installer component. A local malicio…Dell · Dell Command Update (DCU) · CVSS 5.5 · 2023-02-10 | 5.5 | 0.2% | 2023-02-10 |
| CVE-2023-24572Dell Command | Integration Suite for System Center, versions before 6.4.0 contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticated malicious…Dell · Dell Command Integration Suite for System Center (DCIS) · CVSS 4.7 · 2023-02-13 | 4.7 | 0.2% | 2023-02-13 |
| CVE-2024-20886Arbitrary directory creation in Samsung Live Wallpaper PC prior to version 3.3.8.0 allows attacker to create arbitrary directory.Samsung Mobile · Samsung Live Wallpaper PC · CVSS 6.2 · 2024-06-04 | 6.2 | 0.2% | 2024-06-04 |
| CVE-2024-36340A junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points, potentially resulting in arbitrary file deletion or disclosure.AMD · AMD μProf · CVSS 6.6 · 2025-05-13 | 6.6 | 0.2% | 2025-05-13 |
| CVE-2023-32454DUP framework version 4.9.4.36 and prior contains insecure operation on Windows junction/Mount point vulnerability. A local malicious standard user could exploit the vulnerability…Dell · DUP Framework · CVSS 6.3 · 2024-02-06 | 6.3 | 0.2% | 2024-02-06 |
| CVE-2023-32470Dell Digital Delivery versions prior to 5.0.82.0 contain an Insecure Operation on Windows Junction / Mount Point vulnerability. A local malicious user could potentially exploit th…Dell · Dell Digital Delivery · CVSS 5 · 2023-09-08 | 5.0 | 0.2% | 2023-09-08 |
| CVE-2025-58074Privilege escalation during the installation of Norton Secure VPN via the Microsoft StoreGen Digital · Norton Secure VPN · CVSS 8.8 · 2026-05-04 | 8.8 | 0.1% | 2026-05-04 |
| CVE-2025-64391This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it.Veeam · Agent for Windows · CVSS 4.1 · 2026-10-07 | 4.1 | 0.1% | 2026-10-07 |
| CVE-2025-64394A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to p…Veeam · Backup for Microsoft 365 · CVSS 4.3 · 2026-10-27 | 4.3 | 0.1% | 2026-10-27 |
| CVE-2026-41116Dell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with…Dell · Inventory Collector Client · CVSS 6.3 · 2026-06-09 | 6.3 | 0.1% | 2026-06-09 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.