Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Checkmk GmbH | Checkmk | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://checkmk.com/werk/19231 |
|
Fri, 06 Nov 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to execute arbitrary code as SYSTEM by placing scripts in the agent's plugins or local folders, and to read the agent controller's private key. | |
| Title | Privilege escalation via unprotected Windows agent data folder | |
| First Time appeared |
Checkmk
Checkmk checkmk |
|
| Weaknesses | CWE-277 | |
| CPEs | cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:* cpe:2.3:a:checkmk:checkmk:2.2.0:*:*:*:*:*:*:* |
|
| Vendors & Products |
Checkmk
Checkmk checkmk |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: Checkmk
Published:
Updated: 2026-11-06T16:27:41.790Z
Reserved: 2026-10-16T12:30:37.722Z
Link: CVE-2026-111573
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-06T16:17:37.723
Modified: 2026-11-06T16:17:39.157
Link: CVE-2026-111573
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-06T17:30:09Z
-
CWE-277
Insecure Inherited Permissions