CVE-2025-27727: Malicious .rbs swap during forced-fail MSI install triggers SYSTEM rollback execution

Emiliano Mema@Nosalva

•updated Jul 22, 2026•0•0•8

Detects a sequence of events indicative of an MSI rollback attack, where an attacker triggers an MSI installer error, modifies the associated .rbs (rollback script) file in the C:\Config.Msi folder using a non-msiexec process, and subsequently executes the modified script (poc.cmd) to achieve unauthorized code execution with elevated privileges.