Checkmk Windows Agent CVE-2025-32919

Requires an existing authenticated low-privileged local account on a Windows host running the Checkmk Agent with the Windows License plugin active (PR:L, AV:L). The core prerequisite is the plugin's use of an insecure/world-writable temporary directory (CWE-427), allowing a non-privileged user to introduce or tamper with files that the SYSTEM-level agent later trusts. Limiting factors: exploitation is local-only (no remote/network path), requires the specific License plugin to be in use, and the AT:P metric indicates a situational requirement (such as a race window or specific file-handling condition) must be met; it is not a one-shot default-config remote exploit. Versions 2.4.0 before p13, 2.3.0 before p38, 2.2.0 before p46 are affected, and all of 2.1.0 (EOL) remains vulnerable.

Signals are consistent and point to a genuine but NOT emergency-tier local privilege-escalation issue. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) confirms this is locally exploitable, requires an already-authenticated low-privileged account (PR:L) plus a situational attack requirement (AT:P, e.g. a timing/race or specific precondition on the insecure temp directory), and yields high confidentiality, integrity and availability impact on both the vulnerable and a subsequent system (VC/VI/VA:H and SC/SI/SA:H) - classic user-to-SYSTEM escalation on Windows. EPSS is low at 0.27% (18th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation. However, public exploit code DOES exist (SBA Research advisory and a Full Disclosure post), which raises the practical likelihood that a local attacker or post-compromise operator could weaponize it, even though mass remote exploitation is impossible given AV:L. Net: this is a real priority for hosts running the affected Checkmk Windows Agent as a privilege-escalation/lateral-movement step, but it is not a drop-everything remote-RCE scenario. No conflicting signals were found - the low EPSS is fully explained by the local-only attack vector rather than contradicting the POC availability.

A low-privileged local user (or malware already running in a standard user context) on a Windows host running the Checkmk Agent plants or manipulates a file in the insecurely-permissioned temporary directory used by the Windows License plugin; when the agent's SYSTEM-level process consumes that file, the attacker's content is executed or loaded with elevated privileges, giving them SYSTEM. Public exploit code for this technique is available (SBA Research advisory and Full Disclosure), lowering the skill barrier, though exploitation still requires prior local access and satisfying the timing/precondition (AT:P).