Read the docs
TI-2025-27895 Aliases CVE-2025-43079GHSA-j3gv-x7fr-5wqw

Local Privilege Escalation via qagent_uninstall.sh Qualys Cloud Agents

Priority LOW 29CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-426.

Summary

The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges (e.g., via sudo) in an environment where $PATH has been manipulated, an attacker with root/sudo privileges could cause malicious executables to be run in place of the intended system binaries. This behavior can be leveraged for local privilege escalation and arbitrary command execution under elevated privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00174 6th percentileScored 2026-11-07
Fix Fixed Qualys Agent (Qualys Inc): 7.2.3, 7.1.0, 6.0.0 +8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QualysQualys Agent5.0 to before 7.2.37.2.3Patch availableCNA
QualysQualys Agent3.12 to before 7.1.07.1.0Patch availableCNA
QualysQualys Agent4.17 to before 6.0.06.0.0Patch availableCNA
QualysQualys Agentbefore 6.2.16.2.1Patch availableCNA
QualysQualys Agentbefore 6.3.16.3.1Patch availableCNA
QualysQualys Agentbefore 3.31.1-83.31.1-8Patch availableCNA
QualysQualys Agentbefore 3.21.1-63.21.1-6Patch availableCNA
QualysQualys Agentbefore 4.2.64.2.6Patch availableCNA
QualysQualys Agentbefore 5.0.35.0.3Patch availableCNA
QualysQualys Agentbefore 5.0.25.0.2Patch availableCNA
QualysQualys Agentbefore 6.0.36.0.3Patch availableCNA
  • Qualys Agent VendorQualys Affected 5.0 to before 7.2.3 Fixed in 7.2.3 Patch available CNA
  • Qualys Agent VendorQualys Affected 3.12 to before 7.1.0 Fixed in 7.1.0 Patch available CNA
  • Qualys Agent VendorQualys Affected 4.17 to before 6.0.0 Fixed in 6.0.0 Patch available CNA
  • Qualys Agent VendorQualys Affected before 6.2.1 Fixed in 6.2.1 Patch available CNA
  • Qualys Agent VendorQualys Affected before 6.3.1 Fixed in 6.3.1 Patch available CNA
  • Qualys Agent VendorQualys Affected before 3.31.1-8 Fixed in 3.31.1-8 Patch available CNA
  • Qualys Agent VendorQualys Affected before 3.21.1-6 Fixed in 3.21.1-6 Patch available CNA
  • Qualys Agent VendorQualys Affected before 4.2.6 Fixed in 4.2.6 Patch available CNA
  • Qualys Agent VendorQualys Affected before 5.0.3 Fixed in 5.0.3 Patch available CNA
  • Qualys Agent VendorQualys Affected before 5.0.2 Fixed in 5.0.2 Patch available CNA
  • Qualys Agent VendorQualys Affected before 6.0.3 Fixed in 6.0.3 Patch available CNA

Remediation

  • Fix · CNA Qualys Agent (Qualys Inc) Fixed in 7.2.3
  • Fix · CNA Qualys Agent (Qualys Inc) Fixed in 7.1.0
  • Fix · CNA Qualys Agent (Qualys Inc) Fixed in 6.0.0
  • Fix · CNA Qualys Agent (Qualys Inc) Fixed in 6.2.1
  • Fix · CNA Qualys Agent (Qualys Inc) Fixed in 6.3.1
  • Fix · CNA Qualys Agent (Qualys Inc) Fixed in 3.31.1-8
  • Fix · CNA Qualys Agent (Qualys Inc) Fixed in 3.21.1-6
  • Fix · CNA Qualys Agent (Qualys Inc) Fixed in 4.2.6
  • Fix · CNA Qualys Agent (Qualys Inc) Fixed in 5.0.3
  • Fix · CNA Qualys Agent (Qualys Inc) Fixed in 5.0.2
  • Fix · CNA Qualys Agent (Qualys Inc) Fixed in 6.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-43079
  2. 2026-10-03 Alias added: GHSA-j3gv-x7fr-5wqw

References

Other 1

  • TI-2023-12716 Local privilege escalation in Qualys Cloud Agent CVSS 3.1HIGH 7.0
  • TI-2023-12715 Race condition in Qualys Cloud Agent CVSS 3.1HIGH 7.0
  • TI-2023-12713 Executable Hijacking CVSS 3.1HIGH 7.0
  • TI-2022-12003 An issue was discovered in Qualys Cloud Agent 4.8.0-49. CVSS 3.1HIGH 7.3
  • TI-2023-05652 Possible XXE vulnerability in Jenkins Plugin for Qualys Policy Compliance CVSS 3.1MEDIUM 6.5
  • TI-2023-12714 NTFS Junction CVSS 3.1MEDIUM 6.7
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences