EUVD-2026-47622
GHSA-fc5x-r66h-vp5f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local low-privileged user (AV:L/PR:L), deterministic no-interaction chain (AC:L/UI:N), crosses boundary to SYSTEM with full impact (S:C, C/I/A:H).
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodically monitors the directory %ProgramData%\ServerEye3\update\ for a trigger file named "update_available". Due to insufficient access restrictions on this directory, a local standard user can create the trigger file and provide a path to a directory containing malicious JSON instructions. The service subsequently executes the utility UpdaterAction.exe with SYSTEM privileges, which parses the instructions and performs an unvalidated file copy from a user-controlled source to a protected system destination (e.g., overwriting a service binary). This leads to full system compromise as the service automatically restarts the overwritten binary with SYSTEM privileges.
AnalysisAI
Local privilege escalation in the servereye Windows agent (Sensorhub / ClientAgentContainerService) versions 20.15 and earlier lets any local standard user gain SYSTEM. The SYSTEM-level SE3Recovery service (EmergencyRecoveryService.exe) watches a world-writable directory for a trigger file and then runs UpdaterAction.exe, which performs an unvalidated file copy from a user-controlled source over a protected service binary, resulting in full system compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an existing local standard-user account or process on a Windows host that has the servereye Sensorhub agent (version 20.15 or earlier) installed with the SE3Recovery service active as SYSTEM. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (8.8 High) is internally consistent with the description: the attacker needs an existing local low-privileged foothold (AV:L, PR:L), the technique is deterministic with no user interaction (AC:L, UI:N), and success crosses a security boundary from standard user to SYSTEM (S:C) with full C/I/A impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A standard user, or malware confined to user privileges, on a host running the servereye agent writes a malicious JSON instruction file plus a payload and drops the 'update_available' trigger into %ProgramData%\ServerEye3\update\. The SYSTEM SE3Recovery service picks up the trigger and invokes UpdaterAction.exe, which copies the attacker's payload over a servereye service binary; on the next service restart the attacker's code runs as SYSTEM. … |
| Remediation | Upgrade the servereye Sensorhub/Windows agent to a fixed release per the vendor bulletin at https://www.servereye.de/security-bulletins/2026-001/ (Patch available per vendor advisory); the provided data does not state an exact patched version number, so confirm the target build directly with servereye GmbH. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct inventory of systems running ServerEye agent versions 20.15 and earlier and evaluate operational dependency on EmergencyRecoveryService.exe. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today