{"id":"CVE-2026-111573","kind":"vulnerability","aliases":["CVE-2026-111573"],"related":[],"title":"Checkmk Windows agent: local users gain SYSTEM via writable data directory","description":"Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to execute arbitrary code as SYSTEM by placing scripts in the agent's plugins or local folders, and to read the agent controller's private key.","summary":"The Checkmk Windows agent sets incorrect permissions on its data directory because a race condition discards permission changes at service start. A local user can place scripts in the agent's plugins or local folders to run code as SYSTEM and read the agent controller's private key.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["checkmk","monitoring-agent","other","windows"],"not_affected_if":["linux-only-agents","no-untrusted-local-users"],"how_to_check":"- Check the installed Checkmk agent version on Windows hosts, for example with the agent's own version output or the installed package list.\n- Compare the version against the affected ranges: below `2.5.0p18`, below `2.4.0p39`, below `2.3.0p52`, and `2.2.0` (EOL).\n- Review the permissions on the agent's data directory, including the plugins and local folders, and look for write access for non-administrative users.","fix":"- Checkmk `2.5.0`: move to `2.5.0p18` or later.\n- Checkmk `2.4.0`: move to `2.4.0p39` or later.\n- Checkmk `2.3.0`: move to `2.3.0p52` or later.\n- Checkmk `2.2.0`: EOL with no fix stated in the sources; upgrade to a supported release.","status":"open","published_at":"2026-11-06T16:17:37+00:00","first_seen_at":"2026-11-06T16:42:41+00:00","triaged_at":"2026-11-06T16:44:45+00:00","updated_at":"2026-11-06T16:44:45+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-06T16:44:45Z","model":"claude-haiku-5-5","output":{"fix":"- Checkmk `2.5.0`: move to `2.5.0p18` or later.\n- Checkmk `2.4.0`: move to `2.4.0p39` or later.\n- Checkmk `2.3.0`: move to `2.3.0p52` or later.\n- Checkmk `2.2.0`: EOL with no fix stated in the sources; upgrade to a supported release.","reach":"local","title":"Checkmk Windows agent: local users gain SYSTEM via writable data directory","impact":"high","summary":"The Checkmk Windows agent sets incorrect permissions on its data directory because a race condition discards permission changes at service start. A local user can place scripts in the agent's plugins or local folders to run code as SYSTEM and read the agent controller's private key.","audience":"businesses","category":"other","nicknames":[],"who_cares":["checkmk","windows","monitoring-agent"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Local user runs code as SYSTEM and reads the agent's private key","analyst_note":"","how_to_check":"- Check the installed Checkmk agent version on Windows hosts, for example with the agent's own version output or the installed package list.\n- Compare the version against the affected ranges: below `2.5.0p18`, below `2.4.0p39`, below `2.3.0p52`, and `2.2.0` (EOL).\n- Review the permissions on the agent's data directory, including the plugins and local folders, and look for write access for non-administrative users.","plain_action":"","needs_analyst":false,"not_affected_if":["linux-only-agents","no-untrusted-local-users"],"who_is_affected":"Hosts running the Checkmk Windows agent on an affected version are exposed, and the risk depends on whether non-administrative users can log on to or run code on those machines. Teams running only Linux agents, or Windows hosts with no untrusted local users, can skip it. Systems on Checkmk 2.2.0 have no fix stated in the sources and need an upgrade path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001261,"input_tokens":4267,"output_tokens":1669,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111573':14A,17A '-2026':13A,16A '2.2.0':104C '2.3.0':101C '2.4.0':99C '2.5.0':97C 'agent':3A,21B,27B,53B,67B,78C,121C,131C 'allow':106C 'arbitrari':112C 'caus':82C 'chang':41B,91C 'checkmk':1A,18B,25B,76C,96C 'code':61B,113C 'condit':38B,86C 'control':68B,132C 'cve':12A,15A 'data':10A,33B,80C 'directori':11A,34B,81C 'discard':39B,88C 'eol':105C 'execut':111C 'folder':58B,126C 'gain':6A 'incorrect':29B,72C 'key':71B,135C 'local':4A,46B,57B,108C,125C 'monitor':20B 'monitoring-ag':19B 'p18':98C 'p39':100C 'p52':102C 'permiss':30B,40B,73C,90C 'place':49B,117C 'plugin':55B,123C 'privat':70B,134C 'race':37B,85C 'read':65B,129C 'run':60B 'script':50B,118C 'servic':43B,93C 'set':28B 'start':44B,94C 'system':7A,63B,115C 'user':5A,47B,109C 'via':8A 'window':2A,23B,26B,77C 'writabl':9A","nicknames":[],"mitigations":[],"who_affected":"Hosts running the Checkmk Windows agent on an affected version are exposed, and the risk depends on whether non-administrative users can log on to or run code on those machines. Teams running only Linux agents, or Windows hosts with no untrusted local users, can skip it. Systems on Checkmk 2.2.0 have no fix stated in the sources and need an upgrade path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["checkmk","medium","monitoringagent","other","windows"],"campaign_type":null,"search_a":"'-111573':14A,17A '-2026':13A,16A 'agent':3A 'checkmk':1A 'cve':12A,15A 'data':10A 'directori':11A 'gain':6A 'local':4A 'system':7A 'user':5A 'via':8A 'window':2A 'writabl':9A","search_b":"'agent':21B,27B,53B,67B 'chang':41B 'checkmk':18B,25B 'code':61B 'condit':38B 'control':68B 'data':33B 'directori':34B 'discard':39B 'folder':58B 'incorrect':29B 'key':71B 'local':46B,57B 'monitor':20B 'monitoring-ag':19B 'permiss':30B,40B 'place':49B 'plugin':55B 'privat':70B 'race':37B 'read':65B 'run':60B 'script':50B 'servic':43B 'set':28B 'start':44B 'system':63B 'user':47B 'window':23B,26B","search_c":"'2.2.0':104C '2.3.0':101C '2.4.0':99C '2.5.0':97C 'agent':78C,121C,131C 'allow':106C 'arbitrari':112C 'caus':82C 'chang':91C 'checkmk':76C,96C 'code':113C 'condit':86C 'control':132C 'data':80C 'directori':81C 'discard':88C 'eol':105C 'execut':111C 'folder':126C 'incorrect':72C 'key':135C 'local':108C,125C 'p18':98C 'p39':100C 'p52':102C 'permiss':73C,90C 'place':117C 'plugin':123C 'privat':134C 'race':85C 'read':129C 'script':118C 'servic':93C 'start':94C 'system':115C 'user':109C 'window':77C","first_public_at":"2026-11-06T16:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@checkmk.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111573","severity":null,"published_at":"2026-11-06T16:17:37+00:00","modified_at":"2026-11-06T16:17:39+00:00","first_seen_at":"2026-11-06T16:42:41+00:00","fetched_at":"2026-11-06T16:42:41+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}