SF-LABS-2026-02 / BLANK CHECK / Vulnerability Disclosure

Intuit QuickBooks Desktop BLANK CHECK Local Privilege Escalation

Reported, awaiting vendor acknowledgement

Awaiting vendor acknowledgement

A standard, non-administrator user can gain full SYSTEM control of any Windows machine running QuickBooks Desktop, with no admin rights, no reboot and no user interaction. Confirmed on the current, fully-updated release. Reported to Intuit. Full details and proof-of-concept follow once the disclosure window closes.

Demonstration

Proof-of-Concept Video

Video proof-of-concept will be added when available. The recording shows the escalation path end-to-end, from the unprivileged-user starting state to the SYSTEM shell that results.

Disclosure Record

Timeline and Affected Surface

Advisory ID: SF-LABS-2026-02
Codename: BLANK CHECK
Vendor: Intuit
Product: QuickBooks Desktop (current 2024 line, fully updated)
Vulnerability class: Local privilege escalation to SYSTEM
Discovery date: 2026-06-12
Vendor notified: 2026-06-12
Vendor acknowledged: Awaiting acknowledgement
90-day expiry: Computed from acknowledgement date when received
CVE ID: Pending. Submitted via HackerOne coordinator (Intuit)
Affected versions: Disclosed when the disclosure window closes
Researcher: Ryan Purita, Principal Security Consultant, Sherlock Forensics
Methodology: Original research by Sherlock Forensics Labs

Sherlock Forensics adheres to coordinated disclosure timelines. Technical specifics, proof-of-concept code and remediation guidance will be published when the disclosure window closes or earlier with vendor approval. We do not publish details that could enable exploitation while affected users remain vulnerable.

Public Summary

What is Publicly Disclosed Now

SF-LABS-2026-02 BLANK CHECK is a local privilege escalation in Intuit QuickBooks Desktop confirmed on the current 2024 line with all updates applied. The exploit requires the attacker to already have code execution in a standard non-administrator user context on the target machine. That foothold is the routine outcome of phishing, drive-by download or commodity malware. BLANK CHECK converts any such standard-user foothold into SYSTEM on a fully patched endpoint running affected QuickBooks Desktop versions.

Defensive recommendations for the embargo period are limited to standard local-attack-surface hardening: enforce least-privilege user accounts, restrict execution of unsigned or untrusted binaries from user-writable locations and review installed-software inventory against the public affected-versions list once it lands.

Sherlock Forensics will publish full technical detail when the disclosure window closes or earlier on vendor approval. Researchers and incident response teams who need pre-release notification under NDA can reach the lab at labs@sherlockforensics.com.

About

About Sherlock Forensics Labs

Sherlock Forensics Labs is the research arm of Sherlock Forensics, a Vancouver BC based digital forensics and cybersecurity practice. Lead researcher Ryan Purita is a Principal Security Consultant with 20 years of courtroom-tested digital forensics work plus CISSP, ISSAP and ISSMP certification. The lab follows industry-standard 90-day coordinated disclosure with vendor-acknowledged early-release provisions. See the Labs hub for active and archived disclosures.