Critical Command Injection Flaw Hits upKeeper Instant Privilege Access

A critical command-injection vulnerability (CVE-2026-2449, CVSS 9.1) in upKeeper Instant Privilege allows manipulation of internal message delimiters to inject commands into the client service, enabling low-privileged users to execute arbitrary commands as LocalSystem. The flaw affects all versions through 1.5.0 and has been fixed in version 1.6.0.4576 (released March 5, 2026); administrators are urged to apply the mandatory update to prevent unauthorized privilege escalation.