Administrator escalation via unsigned service binary

Improper certificate validation in Pega Synchronization Engine 3.1.1 through 3.1.27 allows local users to gain Administrator access. The Pega Updater Service accepts a configuration-selected unsigned binary and starts it as a service without validating its signing certificate. Non-admin access to a client desktop is required, and successful exploitation executes attacker-controlled code with service privileges.