CVE-2023-6154 is a high severity (CVSS 7.8) local privilege escalation in seccenter.exe, used by Bitdefender Total Security, Internet Security, Antivirus Plus and Antivirus Free at version 27.0.25.114. A configuration issue can lead to a third party library being loaded. Bitdefender says an automatic update to 27.0.25.115 fixes it.
What's affected
- Products: Bitdefender Total Security, Internet Security, Antivirus Plus and Antivirus Free.
- Affected: version 27.0.25.114 for each product.
- Fixed: version 27.0.25.115, delivered by automatic update, per advisory VA-11168.
- Severity: 7.8 High in both the NVD record and Bitdefender (vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Published: Bitdefender advisory dated 1 April 2024.
How to check if you're exposed
Open the Bitdefender product, go to the About or Settings page, and read the version. 27.0.25.114 is the affected build, and 27.0.25.115 or later is the fixed one. If the version is still 27.0.25.114, run a manual update.
For managed machines, pull the Bitdefender product name and version from your endpoint inventory, then list any still at the affected build. Because the fix arrives automatically, a machine that stays on the old build usually has a problem with updates, which is worth fixing for other reasons too.
What to do now
- Update the Bitdefender product so it reports version 27.0.25.115 or later.
- Keep automatic updates on, and investigate machines that cannot reach the update service.
- Limit local logon rights on shared machines, where a standard user could try to abuse the flaw.
- Record the product version in your inventory.
- Check that the same machines run other software updates on schedule.
Why it matters
The record says a configuration setting issue in seccenter.exe lets an attacker change the product's expected behavior and potentially load a third party library. The weakness classes are CWE-15, external control of a system setting, and CWE-610, externally controlled reference to a resource in another sphere. When a privileged process loads code from a location or setting a normal user can influence, that user can run code at the higher privilege.
Security software runs with high privilege almost everywhere, which makes it a valuable target for local escalation. The attacker needs a foothold as a normal user first, so this is a second stage tool rather than a way in. The record does not list this CVE as known exploited. It is the simplest of the Bitdefender advisories in this batch to act on: confirm the version and move on.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect the free edition?
Yes. Bitdefender lists Antivirus Free at version 27.0.25.114 among the affected products, along with the paid editions.
Sources
Last reviewed: 19 October 2026.
