CVE-2026-111573Medium· 6.3▾ SunlitIncorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to e…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to execute arbitrary code as SYSTEM by placing scripts in the agent's plugins or local folders, and to read the agent controller's private key.
Checkmk >= 2.5.0 < 2.5.0p18Checkmk >= 2.4.0 < 2.4.0p39Checkmk >= 2.3.0 < 2.3.0p52Checkmk 2.2.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103674Low· 2.0NetApp ONTAP special agent exposes password in process list
CVE-2026-103682Low· 2.0Jolokia special agent exposes password in process list
CVE-2026-117611High· 7.1Trust of compromised eMudhra root CA in bundled CA stores
CVE-2026-113461Medium· 5.2mk-oracle: Local privilege escalation via insecure Oracle Home library loading
CVE-2026-14452High· 8.6Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup acces…
CVE-2026-105331Medium· 5.2Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.