Read the docs
TI-2021-05149 Aliases CVE-2021-22159GHSA-52fx-r79r-42fh

Insider Threat Management Windows Agent Local Privilege Escalation Vulnerability The…

Priority LOW 34CWE-306Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.

Summary

Insider Threat Management Windows Agent Local Privilege Escalation Vulnerability The Proofpoint Insider Threat Management (formerly ObserveIT) Agent for Windows before 7.4.3, 7.5.4, 7.6.5, 7.7.5, 7.8.4, 7.9.3, 7.10.2, and 7.11.0.25 as well as versions 7.3 and earlier is missing authentication for a critical function, which allows a local authenticated Windows user to run arbitrary commands with the privileges of the Windows SYSTEM user. Agents for MacOS, Linux, and ITM Cloud are not affected.

Why it matters now

EPSS 0.00335 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:proofpoint:insider_threat_management:*:*:*:*:*:windows:*:*before 7.4.3; 7.5.0 to before 7.5.4; 7.6.0 to before 7.6.5; 7.7.0 to before 7.7.5; 7.8.0 to before 7.8.4; 7.9.0 to before 7.9.3; 7.10.0 to before 7.10.2; 7.11.0.0 to before 7.11.0.25VulnerableProofpoint
  • cpe:2.3:a:proofpoint:insider_threat_management:*:*:*:*:*:windows:*:* Versions before 7.4.3; 7.5.0 to before 7.5.4; 7.6.0 to before 7.6.5; 7.7.0 to before 7.7.5; 7.8.0 to before 7.8.4; 7.9.0 to before 7.9.3; 7.10.0 to before 7.10.2; 7.11.0.0 to before 7.11.0.25 Vulnerable ·Proofpoint

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22159
  2. 2026-10-03 Alias added: GHSA-52fx-r79r-42fh

References

Advisory 2

  • TI-2020-07138 rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT… CVSS 3.1HIGH 8.8
  • TI-2021-09235 The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an… CVSS 3.1HIGH 8.1
  • TI-2023-04418 ITM MacOS Agent Improper Certificate Validation CVSS 3.1HIGH 7.5
  • TI-2022-08988 Proofpoint Insider Threat Management Agent for Windows relies on an inherently dangerous… CVSS 3.1HIGH 7.8
  • TI-2021-09234 The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and… CVSS 3.1HIGH 7.4
  • TI-2021-05148 The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable… CVSS 3.1HIGH 7.2
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences