{"id":"CVE-2026-111573","title":"Privilege escalation via unprotected Windows agent data folder","summary":"Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to e…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H","cvssSource":"cna","cwe":["CWE-277"],"vendor":"Checkmk GmbH","product":"Checkmk","affected":["Checkmk >= 2.5.0 < 2.5.0p18","Checkmk >= 2.4.0 < 2.4.0p39","Checkmk >= 2.3.0 < 2.3.0p52","Checkmk 2.2.0"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:27:41.790Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111573","references":[{"url":"https://checkmk.com/werk/19231"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T16:57:43.265Z","epss":0.00131,"epssPercentile":0.02695,"slug":"CVE-2026-111573","body":"## Overview\n\nIncorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to execute arbitrary code as SYSTEM by placing scripts in the agent's plugins or local folders, and to read the agent controller's private key.\n\n## Affected\n\n- `Checkmk >= 2.5.0 < 2.5.0p18`\n- `Checkmk >= 2.4.0 < 2.4.0p39`\n- `Checkmk >= 2.3.0 < 2.3.0p52`\n- `Checkmk 2.2.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}