Read the docs
TI-2026-85986 Aliases CVE-2026-111573GHSA-gx39-fx9h-w86g

Privilege escalation in Checkmk Windows agent data folder

Priority LOW 27CWE-277Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Checkmk from 2.5.0 before 2.5.0p18, from 2.4.0 before 2.4.0p39, from 2.3.0 before 2.3.0p52, and 2.2.0 use incorrect permissions on the Windows agent data directory (CWE-277). A race condition discards the permission changes during service start. A local user with low privileges can run code as SYSTEM by placing scripts in the agent's plugins or local folders, and can read the agent controller's private key.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to execute arbitrary code as SYSTEM by placing scripts in the agent's plugins or local folders, and to read the agent controller's private key.

Why it matters now

EPSS 0.00131 2nd percentileScored 2026-11-07
Fix Fixed Checkmk (Checkmk GmbH): 2.5.0p18, 2.4.0p39, 2.3.0p52

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Checkmk GmbHCheckmk2.5.0 to before 2.5.0p18; 2.4.0 to before 2.4.0p39; 2.3.0 to before 2.3.0p52; 2.2.02.5.0p18, 2.4.0p39, 2.3.0p52Patch availableCNA
  • Checkmk VendorCheckmk GmbH Affected 2.5.0 to before 2.5.0p18; 2.4.0 to before 2.4.0p39; 2.3.0 to before 2.3.0p52; 2.2.0 Fixed in 2.5.0p18, 2.4.0p39, 2.3.0p52 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*——Checkmk GmbH
  • cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:* Versions — — ·Checkmk GmbH

Remediation

Upgrade Checkmk to 2.5.0p18, 2.4.0p39 or 2.3.0p52, which fix this flaw. The sources list no fixed version for Checkmk 2.2.0.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Checkmk (Checkmk GmbH) Fixed in 2.5.0p18, 2.4.0p39, 2.3.0p52

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-111573
  2. 2026-11-06 Alias added: GHSA-gx39-fx9h-w86g
  3. 2026-11-08 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2025-26345 Cross Site Scripting through compromised remote site CVSS 4.0HIGH 8.5
  • TI-2025-40190 Cross-site scripting in HTML logs of Synthetic Monitoring test services CVSS 4.0HIGH 7.3
  • TI-2024-12762 Checkmk NagVis Remote Code Execution CVSS 3.1HIGH 7.2
  • TI-2024-12761 Checkmk NagVis Reflected Cross-site Scripting CVSS 3.1MEDIUM 5.4
  • TI-2024-19037 Brute-force protection ineffective for some login methods CVSS 3.1CRITICAL 9.8
  • TI-2024-05712 local IP restriction of internal HTTP endpoints CVSS 3.1CRITICAL 9.8
See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences