---
id: "CVE-2026-92744"
kind: "vulnerability"
aliases: ["CVE-2026-92744"]
title: "Privilege manager agent lets remote attackers run code as SYSTEM"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Delinea Privilege Manager Windows agent", "fixed": ["12.0.5804", "13.0.2064"], "affected": ">= 10.1.0, <= 12.0.5796; >= 13.0.0, <= 13.0.1058", "ecosystem": "vendor"}]
ecosystems: []
tags: ["agent", "delinea", "other", "privilege-manager", "privilege-manager-agent", "rce", "unauthenticated", "windows"]
not_affected_if: ["agent-upgraded", "cloud-agent-port-5593-blocked"]
published_at: "2026-10-29T23:17:02+00:00"
first_seen_at: "2026-10-29T23:27:17+00:00"
updated_at: "2026-10-29T23:30:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92744", "first_seen_at": "2026-10-29T23:27:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T23:30:50+00:00"}]
---

# Privilege manager agent lets remote attackers run code as SYSTEM

Delinea Privilege Manager's Windows agent can be made to run attacker code as LocalSystem by a remote unauthenticated attacker under unspecified conditions. Fixed in agent 12.0.5804 and 13.0.2064; blocking inbound TCP 5593 is the vendor's workaround.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Delinea Privilege Manager Windows agent affected >= 10.1.0, <= 12.0.5796; >= 13.0.0, <= 13.0.1058 fixed 12.0.5804, 13.0.2064

## How to check

Check the installed Privilege Manager (Thycotic) Windows Core agent version on endpoints (Programs and Features or your device management inventory). Affected per NVD: 10.1.0 to 12.0.5796 and 13.0.0 to 13.0.1058. Also check whether TCP 5593 is listening/reachable inbound: Get-NetTCPConnection -LocalPort 5593 -State Listen

## Fix

Upgrade the Privilege Manager Windows Core agent to 12.0.5804 or later (v12 line) or 13.0.2064 or later (v13 line). Mitigation if you cannot upgrade: block inbound TCP 5593 on workstations (Cloud: block entirely; on-prem: block or restrict to the Privilege Manager web server IP). Agents then pull updates on schedule.

## Timeline

- 2026-10-29T23:27:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92744
- 2026-10-29T23:30:50+00:00 analyst — Vendor/product from NVD (CNA Delinea): Delinea Privilege Manager Windows agent. Delinea release notes (13.0.2, 12.0.5 build 5804) describe an unnamed 'security issue' in Core agent <=13.0.1058 with fix 13.0.2064 / 12.0.5804 and port 5593 block workaround; the notes do not cite the CVE id and the advisories page does not list it yet, so the mapping is inferred and nothing is marked verified. 'Certain conditions' is undefined by any source.

## Documents

- [describes] NVD record CVE-2026-92744 (CNA Delinea data) https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-92744
- [fix] Delinea Privilege Manager 13.0.2 Release Notes (fix 13.0.2064, item 762554) https://docs.delinea.com/online-help/privilege-manager/release-notes/13.0.2.htm
- [mitigation] Delinea Privilege Manager 12.0.5 Windows agents build 12.0.5804 https://docs.delinea.com/online-help/privilege-manager/release-notes/12.0.5-updatewin5804.htm

## From the sources

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute
arbitrary code as LocalSystem.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_