{"id":"CVE-2026-92744","kind":"vulnerability","aliases":["CVE-2026-92744"],"related":[],"title":"Privilege manager agent lets remote attackers run code as SYSTEM","description":"Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute\narbitrary code as LocalSystem.","summary":"Delinea Privilege Manager's Windows agent can be made to run attacker code as LocalSystem by a remote unauthenticated attacker under unspecified conditions. Fixed in agent 12.0.5804 and 13.0.2064; blocking inbound TCP 5593 is the vendor's workaround.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Delinea Privilege Manager Windows agent","fixed":["12.0.5804","13.0.2064"],"affected":">= 10.1.0, <= 12.0.5796; >= 13.0.0, <= 13.0.1058","ecosystem":"vendor"}],"ecosystems":[],"tags":["agent","delinea","other","privilege-manager","privilege-manager-agent","rce","unauthenticated","windows"],"not_affected_if":["agent-upgraded","cloud-agent-port-5593-blocked"],"how_to_check":"Check the installed Privilege Manager (Thycotic) Windows Core agent version on endpoints (Programs and Features or your device management inventory). Affected per NVD: 10.1.0 to 12.0.5796 and 13.0.0 to 13.0.1058. Also check whether TCP 5593 is listening/reachable inbound: Get-NetTCPConnection -LocalPort 5593 -State Listen","fix":"Upgrade the Privilege Manager Windows Core agent to 12.0.5804 or later (v12 line) or 13.0.2064 or later (v13 line). Mitigation if you cannot upgrade: block inbound TCP 5593 on workstations (Cloud: block entirely; on-prem: block or restrict to the Privilege Manager web server IP). Agents then pull updates on schedule.","status":"open","published_at":"2026-10-29T23:17:02+00:00","first_seen_at":"2026-10-29T23:27:17+00:00","triaged_at":"2026-10-29T23:29:02+00:00","updated_at":"2026-10-29T23:30:50+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-29T23:29:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Privilege manager agent lets remote attackers run code as SYSTEM","impact":"high","summary":"A privilege manager agent under certain conditions accepts input from a remote, unauthenticated attacker. The attacker can execute arbitrary code with LocalSystem rights on the affected machine.","audience":"businesses","category":"other","nicknames":[],"who_cares":["windows","privilege-manager-agent"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote code runs as LocalSystem on the affected machine.","analyst_note":"Identify the vendor and product named in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-92744), the affected versions, the 'certain conditions', and the vendor fix.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the product or the configuration that makes the agent reachable. Teams that run the privilege manager agent on Windows endpoints should look at it first. unknown","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000623,"input_tokens":4073,"output_tokens":431,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the vendor and product named in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-92744), the affected versions, the 'certain conditions', and the vendor fix.","search":"'-2026':12A,15A '-92744':13A,16A '12.0.5804':61B '13.0.2064':63B '5593':67B 'agent':3A,21A,22B,31B,40B,60B,78C 'allow':79C 'arbitrari':86C 'attack':6A,46B,54B,83C 'block':64B 'certain':74C 'code':8A,47B,87C 'condit':57B,75C 'cve':11A,14A 'delinea':17A,23B,35B 'execut':85C 'fix':58B 'inbound':65B 'let':4A 'localsystem':49B,89C 'made':43B 'manag':2A,27B,30B,37B,77C 'manager':19A 'privileg':1A,26B,29B,36B,76C 'privilege':18A 'privilege-manag':25B 'privilege-manager-ag':28B 'rce':32B 'remot':5A,52B,81C 'run':7A,45B 'system':10A 'tcp':66B 'unauthent':33B,53B,82C 'unspecifi':56B 'vendor':70B 'window':34B,39B 'windows':20A 'workaround':72B","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the product or the configuration that makes the agent reachable. Teams that run the privilege manager agent on Windows endpoints should look at it first. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T23:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"1443cd92-d354-46d2-9290-d812316ca43a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92744","severity":null,"published_at":"2026-10-29T23:17:02+00:00","modified_at":"2026-10-29T23:17:02+00:00","first_seen_at":"2026-10-29T23:27:17+00:00","fetched_at":"2026-10-29T23:27:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92744:1115","url":null,"severity":null,"published_at":"2026-10-29T23:30:50+00:00","modified_at":"2026-10-29T23:30:50+00:00","first_seen_at":"2026-10-29T23:30:50+00:00","fetched_at":"2026-10-29T23:30:50+00:00","note":"Vendor/product from NVD (CNA Delinea): Delinea Privilege Manager Windows agent. Delinea release notes (13.0.2, 12.0.5 build 5804) describe an unnamed 'security issue' in Core agent <=13.0.1058 with fix 13.0.2064 / 12.0.5804 and port 5593 block workaround; the notes do not cite the CVE id and the advisories page does not list it yet, so the mapping is inferred and nothing is marked verified. 'Certain conditions' is undefined by any source."}],"documents":[{"id":20031,"url":"https://docs.delinea.com/online-help/privilege-manager/release-notes/13.0.2.htm","title":"Delinea Privilege Manager 13.0.2 Release Notes (fix 13.0.2064, item 762554)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":20032,"url":"https://docs.delinea.com/online-help/privilege-manager/release-notes/12.0.5-updatewin5804.htm","title":"Delinea Privilege Manager 12.0.5 Windows agents build 12.0.5804","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":20033,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-92744","title":"NVD record CVE-2026-92744 (CNA Delinea data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}