Systrack Agent CVE-2026-35099

Lakeside SysTrack Agent versions 11.0 through 11.2.1.27 running on Windows. Attacker requires local system access as unprivileged user. Exploits a race condition during agent operations to escalate to SYSTEM privileges. No user interaction required.

The CVSS v3.1 score of 7.4 (High) reflects significant impact but with important constraints. The attack vector is local (AV:L), meaning the attacker must already have local access to the system, substantially limiting the attack surface compared to network-based vulnerabilities. Attack complexity is high (AC:H), indicating successful exploitation requires specific timing conditions that may not be reliably achievable, though race conditions can sometimes be forced through repeated attempts. Critically, the privileges required metric is None (PR:N), meaning any local user without existing privileges can attempt exploitation, and no user interaction is needed (UI:N). The impact scope includes complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) with escalation to SYSTEM, the highest privilege level in Windows. Without EPSS data or KEV status, we cannot assess real-world exploitation probability, but the high attack complexity and local-only vector suggest this is not trivially exploitable at scale. Organizations running SysTrack in environments where local access is tightly controlled face lower risk than those with multiple users on monitored endpoints. The availability of a vendor patch (11.2.1.28) significantly reduces risk for organizations with effective patch management. This represents a genuine security concern for affected installations but requires local access and technical sophistication to exploit, making it a lower priority than remotely exploitable or actively exploited vulnerabilities unless endpoints have untrusted local users.

An attacker with local access to a Windows workstation running vulnerable SysTrack Agent 11.x creates a malicious application that repeatedly attempts to exploit the race condition by manipulating the timing of operations performed by the SysTrack Agent service. By carefully orchestrating concurrent file system operations, registry modifications, or inter-process communication with the agent's privileged processes, the attacker wins the race condition and injects code or modifies critical system resources in a brief window between the agent's security check and its privileged operation. Upon successful exploitation, the attacker's code executes with SYSTEM privileges, allowing them to install persistent backdoors, disable security software, exfiltrate sensitive data from other users' profiles, or pivot to other systems on the network using stolen credentials. The high attack complexity means this requires multiple attempts and precise timing, but once a working exploit technique is developed for a specific environment, it could be automated for repeated use.