Netdata Agent CVE-2026-83598

Requires an interactive low-privileged local account on a Windows host running Netdata Agent 2.0.0 through 2.10.3, plus the ability to trigger a Windows Installer (MSI) repair of the Netdata package. The specific trigger is the MSI repair custom action invoking powershell.exe as SYSTEM WITHOUT the -NoProfile flag, causing it to load the initiating user's %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1. Limiting factors: exploitation is local-only (no network vector), needs a pre-existing low-privilege foothold, and depends on the attacker being able to initiate (or induce) an MSI repair - if repair can only be launched by an administrator, the practical bar rises significantly. Fixed configurations (v2.10.4+) run PowerShell with -NoProfile and are not exploitable.

This is a genuine, well-scoped local privilege-escalation issue rather than a high-CVSS-but-low-real-risk item, though its real-world urgency is moderate. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) is internally consistent with the description: a low-privileged local user who can initiate an MSI repair gains SYSTEM code execution via their own PowerShell profile, yielding full C/I/A impact on the host. The attack is local-only (AV:L) and requires an existing low-privilege foothold (PR:L), which meaningfully caps the blast radius - this is a post-compromise escalation primitive, not a remote entry point. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'; there is no SSVC decision data supplied either. The signals are non-conflicting: local vector, authenticated-user prerequisite, and absence of KEV/POC together point to a real but not widespread, opportunistic-exploitation-class flaw. The main uncertainty is operational - whether a low-privileged user can independently trigger MSI repair in a given environment (Windows Installer allows this in some default configurations) versus needing an admin to initiate it, which would raise the practical bar.

A low-privileged user on a Windows host running Netdata Agent 2.0.0-2.10.3 writes malicious commands into their own %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1, then triggers an MSI repair of the Netdata package. During repair, powershell.exe launches as SYSTEM without -NoProfile and loads that profile, executing the planted commands with SYSTEM privileges for full local takeover. No public exploit code was identified, but the technique is simple and reliable given local access.