---
id: "TECH-202610-glpi-agent-remote-code-execution-via-rogue-glpi-server-using"
kind: "technique"
aliases: []
title: "GLPI Agent remote code execution via rogue GLPI server using an AD CS ESC17 certificate (public tool GLPwnIou)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "GLPI Agent", "fixed": [], "vendor": "GLPI Project"}, {"name": "GLPI", "fixed": [], "vendor": "Teclib"}, {"name": "Active Directory Certificate Services", "fixed": [], "vendor": "Microsoft"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-27T15:07:24+00:00"
updated_at: "2026-10-27T15:07:24+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-27T15:07:24+00:00"}]
---

# GLPI Agent remote code execution via rogue GLPI server using an AD CS ESC17 certificate (public tool GLPwnIou)

Fenrisk research (2026-10-20) with a newly public tool, GLPwnIou. GLPI Agent before 1.8, and agents upgraded from before 1.8, ask the server for inventory/deploy tasks by default and run them as SYSTEM/root, even when the server does not use deploy. Before, HTTPS with certificate checking stopped a fake server. With an ESC17-vulnerable AD CS template (Server Authentication EKU plus Enrollee Supplies Subject), an attacker in the domain can get a valid certificate for the GLPI server's name. They then put themselves in the middle (mitm6, ARP spoofing, or a stale or editable DNS record) and push commands or binaries to every agent that connects. At risk: Active Directory environments running GLPI Agent with a misconfigured AD CS. Proof of concept and pentest tool; no in-the-wild use reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :GLPI Agent affected ? fixed ?
- :GLPI affected ? fixed ?
- :Active Directory Certificate Services affected ? fixed ?

## How to check

GLPI Agent version below 1.8, or installed before 1.8 and later upgraded, with the deploy task active; AD CS templates allowing Server Authentication plus Enrollee Supplies Subject to low-privileged users; CA events 4886/4887 for the GLPI server name from an unexpected requester; glpi-agent spawning cmd.exe/powershell or writing C:\Windows\Temp\pwned.fenrisk; deploy responses with ID 0fae2958-24d5-0651-c49c-d1fec1766af6 and no usual GLPI/PHP headers

## Fix

Lock down AD CS Server Authentication templates (limit who can enroll, remove Enrollee Supplies Subject) and audit certificate requests; turn off the deploy task on agents that do not need it (agents upgraded from before 1.8 keep it on); enforce HTTPS with strict checking or pinning to the GLPI server certificate; disable IPv6 where unused to block mitm6, and watch DNS changes for the GLPI host

## Timeline

- 2026-10-27T15:07:24+00:00 analyst

## Documents

- [describes] Reviving GLPI Agent Abuse with ESC17 · Fenrisk https://t.co/NugPx5B6G2
- [describes] @_r_netsec: Reviving GLPI Agent Abuse with ESC17 https://t.co/NugPx5B6G2 https://x.com/_r_netsec/status/2115089475785424978

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_