TI-2023-12716 Aliases CVE-2023-28143 GHSA-crgr-4cw4-mj2w

Local privilege escalation in Qualys Cloud Agent

LOW 32CWE-426Published 2023-04-18 · Updated 2025-02-05

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-426.

Summary

Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7) installer allows a local escalation of privilege bounded only to the time of installation and only on older macOSX (macOS 10.15 and older) versions. Attackers may exploit incorrect file permissions to give them ROOT command execution privileges on the host. During the install of the PKG, a step in the process involves extracting the package and copying files to several directories. Attackers may gain writable access to files during the install of PKG when extraction of the package and copying files to several directories, enabling a local escalation of privilege.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00174 6th percentileScored 2026-11-07

Fix Fixed Cloud Agent (Qualys): 3.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Qualys	Cloud Agent	2.5.1-75 to before 3.7	3.7	Patch available	CNA

Cloud Agent VendorQualys Affected 2.5.1-75 to before 3.7 Fixed in 3.7 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:qualys:cloud_agent::::::macos::*	2.5.1-75 to before 3.7	Vulnerable	Qualys
cpe:2.3:o:apple:mac_os_x::::::::	up to 10.15	Running on	Apple

cpe:2.3:a:qualys:cloud_agent:*:*:*:*:*:macos:*:* Versions 2.5.1-75 to before 3.7 Vulnerable ·Qualys
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions up to 10.15 Running on ·Apple

Remediation

Fix · CNA Cloud Agent (Qualys) Fixed in 3.7

Timeline

2026-10-02 Threatist record created from CVE-2023-28143
2026-10-03 Alias added: GHSA-crgr-4cw4-mj2w

References

Advisory 1

https://qualys.com/security-advisories

TI-2023-12715 Race condition in Qualys Cloud Agent CVSS 3.1HIGH 7.0
TI-2023-12713 Executable Hijacking CVSS 3.1HIGH 7.0
TI-2023-12714 NTFS Junction CVSS 3.1MEDIUM 6.7
TI-2022-12004 An issue was discovered in Qualys Cloud Agent 4.8.0-49. CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences