CVE-2026-111573 · Other
NO FIX YET · SEE WHAT TO DO
The Checkmk Windows agent sets incorrect permissions on its data directory because a race condition discards permission changes at service start. A local user can place scripts in the agent's plugins or local folders to run code as SYSTEM and read the agent controller's private key.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Hosts running the Checkmk Windows agent on an affected version are exposed, and the risk depends on whether non-administrative users can log on to or run code on those machines. Teams running only Linux agents, or Windows hosts with no untrusted local users, can skip it. Systems on Checkmk 2.2.0 have no fix stated in the sources and need an upgrade path.
Not affected if linux-only-agents, no-untrusted-local-users
Who cares checkmk, monitoring-agent, windows
2.5.0p18, below 2.4.0p39, below 2.3.0p52, and 2.2.0 (EOL).2.5.0: move to 2.5.0p18 or later.Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to execute arbitrary code as SYSTEM by placing scripts in the agent's plugins or local folders, and to read the agent controller's private key.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.4.0: move to 2.4.0p39 or later.2.3.0: move to 2.3.0p52 or later.2.2.0: EOL with no fix stated in the sources; upgrade to a supported release.