ITM Windows Agent Insecure Filesystem Permissions
Priority LOW 24CWE-281Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to disrupt agent monitoring. All versions prior to 7.14.3 are affected. Agents for MacOS and Linux and Cloud are unaffected.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00154 4th percentileScored 2026-11-07
Fix Fixed Insider Threat Management (Proofpoint): 7.14.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Proofpoint | Insider Threat Management | before 7.14.3 | 7.14.3 | Patch available | CNA |
- Insider Threat Management VendorProofpoint Affected before 7.14.3 Fixed in 7.14.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:proofpoint:insider_threat_management:*:*:*:*:*:windows:*:* | before 7.14.3 | Vulnerable | Proofpoint |
- cpe:2.3:a:proofpoint:insider_threat_management:*:*:*:*:*:windows:*:* Versions before 7.14.3 Vulnerable ·Proofpoint
Remediation
- Fix · CNA Insider Threat Management (Proofpoint) Fixed in 7.14.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Proofpoint Insider Threat Management 7.14.3
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2023-18058 ITM Server Missing Authorization for Agent ConfigPriority LOW 29
- TI-2023-18057 ITM Server Missing Authorization in SOAP EndpointsPriority LOW 21
- TI-2023-18059 ITM Server Missing Authorization for URL validationPriority LOW 20
Timeline
- 2026-10-02 Threatist record created from CVE-2023-2818
- 2026-10-03 Alias added: GHSA-gm3h-h75w-r3wg
References
More Proofpoint Insider Threat Management vulnerabilities
- TI-2020-07138 rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT… CVSS 3.1HIGH 8.8
- TI-2021-09235 The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an… CVSS 3.1HIGH 8.1
- TI-2023-04418 ITM MacOS Agent Improper Certificate Validation CVSS 3.1HIGH 7.5
- TI-2022-08988 Proofpoint Insider Threat Management Agent for Windows relies on an inherently dangerous… CVSS 3.1HIGH 7.8
- TI-2021-05149 Insider Threat Management Windows Agent Local Privilege Escalation Vulnerability The… CVSS 3.1HIGH 7.8
- TI-2021-09234 The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and… CVSS 3.1HIGH 7.4
Sources
- CVE-2023-2818 · CVE Program
- CVE-2023-2818 · NVD
- FIRST EPSS
- GHSA-gm3h-h75w-r3wg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences