CVE-2026-108889 Missing authorization in Cloud Billing
Local attackers can exploit insufficient access control in the LWBilling64.sys driver to terminate arbitrary processes, potentially causing denial of service or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108889?
CVE-2026-108889 is a medium-severity missing authorization vulnerability in Yungengxin Cloud Billing, published on 12 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub_14000443C in the library LWBilling64.sys of the component IOCTL Process Termination. Executing a manipulation of the argument Pid can lead to exposed ioctl with insufficient access control. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-782
Which versions are affected by CVE-2026-108889?
How do I fix CVE-2026-108889?
No fix has been published for CVE-2026-108889 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-108889 being exploited?
There is no known exploitation of CVE-2026-108889 in the wild and no public exploit code.
Sources
Also known as GHSA-wgpj-m7xc-f5q8.