CVE-2026-111573: Privilege escalation via unprotected Windows agent data folder

Q: Who can exploit this issue?

A local user on a Windows system running an affected Checkmk agent can exploit it. The issue is a local privilege escalation, so remote access alone is not described as sufficient.

Q: What access or conditions does an attacker need?

The attacker needs the ability to place scripts in the agent's plugins or local folders. Exploitation relies on the agent data directory having incorrect permissions because the intended permission changes are discarded during service startup.

Q: What is the impact of successful exploitation?

An attacker can execute arbitrary code as SYSTEM. They can also read the agent controller's private key.

Q: Which releases are affected?

Affected releases are Checkmk versions earlier than 2.5.0p18, 2.4.0p39, and 2.3.0p52, as well as the end-of-life 2.2.0 release.

Published Nov 6, 2026

Updated

Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to execute arbitrary code as SYSTEM by placing scripts in the agent's plugins or local folders, and to read the agent controller's private key.

Event History

Nov 6, 2026

CVE Published

via MITRE·03:59 PM

Data Sourced

via MITRE·03:59 PM

DescriptionWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A local user on a Windows system running an affected Checkmk agent can exploit it. The issue is a local privilege escalation, so remote access alone is not described as sufficient.

What access or conditions does an attacker need?

The attacker needs the ability to place scripts in the agent's plugins or local folders. Exploitation relies on the agent data directory having incorrect permissions because the intended permission changes are discarded during service startup.

What is the impact of successful exploitation?

An attacker can execute arbitrary code as SYSTEM. They can also read the agent controller's private key.

Which releases are affected?

Affected releases are Checkmk versions earlier than 2.5.0p18, 2.4.0p39, and 2.3.0p52, as well as the end-of-life 2.2.0 release.

CVE-2026-111573: Privilege escalation via unprotected Windows agent data folder

Event History

Frequently Asked Questions

Who can exploit this issue?

What access or conditions does an attacker need?

What is the impact of successful exploitation?

Which releases are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access or conditions does an attacker need?

What is the impact of successful exploitation?

Which releases are affected?