EUVD-2026-33572
GHSA-wvf7-cf8r-8fw5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Windows credentials
-
DeliveryLog on locally or via RDP to ServerView host
-
ExploitInvoke vulnerable ServerView Agent component
-
ExecutionChain privileges to NT AUTHORITY\SYSTEM
-
PersistDisable defenses and harvest credentials
-
ImpactPivot to management plane and persist
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Privilege chaining prevention
|
| Exploitation Conditions | Exploitation requires (1) the affected Fujitsu ServerView Agents for Windows V11.60.04 or earlier to be installed and its services running on the target Windows server, and (2) the attacker to already possess valid credentials for any local or domain account that can interactively log on to that server (CVSS PR:L, AV:L, UI:N). Limiting factors: the attack vector is strictly local - no network-only exploitation path is described - so hosts that deny interactive and Remote Desktop logon to non-administrators are not reachable; the bug is Windows-only, leaving Linux ServerView deployments out of scope; and no user interaction by another principal is required. |
| Impact | The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H is consistent with a reliable local elevation-of-privilege primitive that yields full confidentiality, integrity, and availability impact on the affected host, scoring 8.5 (High). Required PR:L means the attacker must already hold valid local credentials, which constrains opportunistic exploitation, but SYSTEM is the maximum Windows privilege and is a common pivot for tampering with EDR, dumping LSASS, or establishing persistence. EPSS and KEV data are not supplied in the input, and no POC is referenced, so likelihood signals are missing; the 'Information Disclosure' tag in the source metadata is inconsistent with the description (which is EoP, not info disclosure) and should be treated as a tagging artifact rather than evidence of a separate impact. Realistic prioritization: high on multi-tenant or jump-host servers where untrusted users can log in, moderate on single-admin management hosts. |
| Exploit ScenarioDerived | A low-privileged user with valid credentials on a Fujitsu PRIMERGY management host - for example, a help-desk operator, a compromised service account, or an attacker who has phished a standard user - logs on locally or via RDP and triggers the privilege-chaining flaw in ServerView Agents to escalate to NT AUTHORITY\SYSTEM. From SYSTEM the attacker disables endpoint protection, harvests cached domain credentials, and pivots into the broader server management plane. No public exploit identified at time of analysis, but the local attack vector and low complexity make weaponization straightforward once the bug pattern is understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 01, 2026
Local privilege escalation in Fujitsu ServerView Agents for Windows V11.60.04 and earlier enables an authenticated low-privileged user to chain privileges and obtain SYSTEM-level access on the host. The flaw was reported by JPCERT/CC and is documented in JVN advisory JVN67883085 and FSAS Technologies advisory 0529; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
Upgrade ServerView Agents for Windows to a fixed release later than V11.60.04 as published in the FSAS Technologies advisory at https://www.fsastech.com/ja-jp/resources/security/2026/0529.html and cross-referenced by JVN67883085 at https://jvn.jp/en/jp/JVN67883085/; the exact fixed version string is not included in the supplied input, so confirm the target build directly from the vendor advisory before deploying. Until patched, restrict interactive and remote logon to the affected servers to administrators only via Group Policy ('Allow log on locally' and 'Allow log on through Remote Desktop Services'), remove standard-user accounts from these hosts, and audit ACLs on the ServerView installation directory and its Windows services with tools such as accesschk to detect any writable paths or service-modification rights held by non-admins. As a more disruptive fallback, stopping and disabling the ServerView Agent services will remove the attack surface at the cost of losing hardware monitoring telemetry to ServerView Operations Manager.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ServerView Agents is Fujitsu's server management agent software, deployed on Windows-based PRIMERGY and related server platforms to expose hardware health, inventory, and monitoring data to ServerView Operations Manager. The root cause class is CWE-268 (Privilege Chaining), in which two or more lower-privileged actions or trust relationships can be combined to grant a level of access neither would provide alone - typical examples include a service running as SYSTEM that improperly trusts input from, invokes, or shares writable resources with a lower-privileged caller. The 'Microsoft' tag and Windows-only scope indicate the defect lies in how the agent's Windows service components interact with non-administrative local users on the same host.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (jpcert) · only source for this CVE.
CVSS VectorVendor: jpcert
DescriptionCVE.org
Privilege chaining issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerability is exploited, a local authenticated attacker who can log in to the server where the affected product is installed may obtain SYSTEM privilege.
Executive ViewAI
Fujitsu ServerView Agents for Windows V11.60.04 and earlier contain a local privilege escalation vulnerability (CVSS 8.5) allowing authenticated low-privileged users to obtain SYSTEM-level access on Windows hosts. No public exploit has been identified. Organizations using these agents for infrastructure management face risk of unauthorized administrative access and potential compromise of managed systems across their estate.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict ServerView Agents administrative access via OS-level access controls to authorized personnel only; (2) Implement network segmentation isolating ServerView Agent management traffic from general network; (3) Deploy endpoint detection and response (EDR) tooling to monitor for privilege escalation attempts; (4) Disable or uninstall ServerView Agents on systems where remote management is not operationally required; (5) Enforce principle of least privilege and OS hardening to minimize impact of successful privilege escalation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB