Read the docs
TI-2022-07570 Aliases CVE-2022-23511GHSA-j8x2-2m5w-j939

A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows…

Priority LOW 32CWE-274Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-premises servers, in versions up to and including v1.247354. When users trigger a repair of the Agent, a pop-up window opens with SYSTEM permissions. Users with administrative access to affected hosts may use this to create a new command prompt as NT AUTHORITY\SYSTEM. To trigger this issue, the third party must be able to access the affected host and elevate their privileges such that they're able to trigger the agent repair process. They must also be able to install the tools required to trigger the issue. This issue does not affect the CloudWatch Agent for macOS or Linux. Agent users should upgrade to version 1.247355 of the CloudWatch Agent to address this issue. There is no recommended work around. Affected users must update the installed version of the CloudWatch Agent to address this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00523 44th percentileScored 2026-11-07
Fix Fixed amazon-cloudwatch-agent (aws): 1.247355github.com/aws/amazon-cloudwatch-agent (Go): 1.247355.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSamazon-cloudwatch-agentbefore 1.2473551.247355Patch availableCNA
—github.com/aws/amazon-cloudwatch-agent (Go)before 1.247355.01.247355.0Patch availableGHSA-j8x2-2m5w-j939
  • amazon-cloudwatch-agent VendorAWS Affected before 1.247355 Fixed in 1.247355 Patch available CNA
  • github.com/aws/amazon-cloudwatch-agent (Go) Vendor— Affected before 1.247355.0 Fixed in 1.247355.0 Patch available GHSA-j8x2-2m5w-j939

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:amazon:cloudwatch_agent:*:*:*:*:*:*:*:*before 1.247355VulnerableAWS
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:amazon:cloudwatch_agent:*:*:*:*:*:*:*:* Versions before 1.247355 Vulnerable ·AWS
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA amazon-cloudwatch-agent (aws) Fixed in 1.247355
  • Fix · GHSA-j8x2-2m5w-j939 github.com/aws/amazon-cloudwatch-agent (Go) Fixed in 1.247355.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23511
  2. 2026-10-03 Alias added: GHSA-j8x2-2m5w-j939

References

Patch 2

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences