EUVD-2026-36247
GHSA-phqv-gxhh-jc8p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local shell
-
DeliveryIdentify Identity Agent search path
-
ExploitPlant malicious executable in writable directory
-
ExecutionTrigger log-collection routine
-
PersistService resolves attacker binary as SYSTEM
-
ImpactExecute payload with SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Exploitation requires (1) authenticated local code execution on a Windows endpoint that has Check Point Identity Agent Full installed and running as a privileged service, and (2) the attacker must be able to write an executable into a location consulted by the agent's log-collection process during its executable-resolution step - typically a directory in the SYSTEM PATH or the agent's working directory where standard users have write access. Limiting factors: the attack vector is local only (AV:L), no remote network exploitation is possible, the Identity Agent Light edition and non-Windows platforms are not implicated, and the log-collection routine must execute (which may be event-driven or periodic), bounding how quickly an attacker can trigger the unsafe resolution. |
| Impact | CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N) accurately reflects a high-impact local privilege escalation: low attack complexity, only standard user privileges needed, no user interaction, and full Confidentiality/Integrity/Availability impact once SYSTEM is obtained. There is no EPSS, KEV, or POC data provided, so real-world exploitation is unconfirmed and should be treated as opportunistic post-compromise rather than an internet-facing emergency. However, identity agents are deployed broadly on enterprise endpoints, making this a high-value LPE primitive for ransomware operators and red teams once a PoC surfaces; prioritize patching ahead of generic LPEs because the vendor (Check Point) typically discloses only after coordinated fixes, suggesting the issue is reliably exploitable. |
| Exploit ScenarioDerived | A standard-privilege user (or an attacker who has phished a workstation account) drops a malicious executable into a directory that the Identity Agent's log-collection routine searches before the legitimate path, then waits for or triggers the next log-collection event. When the SYSTEM-level Identity Agent service resolves the executable name, it launches the attacker's binary with SYSTEM privileges, yielding full host takeover suitable for credential theft, EDR tampering, or ransomware staging. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 11, 2026
Local privilege escalation in Check Point Identity Agent Full for Windows allows an authenticated local user to execute arbitrary code with SYSTEM privileges through improper executable resolution during the log collection process. The flaw is a classic CWE-427 uncontrolled search path issue, and no public exploit has been identified at time of analysis. Exploitation is constrained to attackers who already have a foothold on the endpoint but provides a reliable path to full SYSTEM compromise.
RemediationAI
Patch available per vendor advisory - consult Check Point sk185052 at https://support.checkpoint.com/results/sk/sk185052 for the fixed Identity Agent Full build and upgrade all Windows endpoints accordingly; exact fix version is not disclosed in the provided input. As compensating controls until patches are deployed, restrict local interactive logon on endpoints running Identity Agent to trusted users (limits the local foothold prerequisite), audit and remove write permissions for non-admin users on directories that appear in the SYSTEM PATH or in the Identity Agent installation path (mitigates planting of a hijack binary), and monitor process-creation telemetry for the Identity Agent service spawning unexpected children, especially during log-collection cycles. Side effects: tightening PATH/directory ACLs may break poorly written third-party installers that rely on world-writable program directories.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Check Point Identity Agent Full is a Windows endpoint client that maps logged-in users to IP addresses for Check Point gateway policy enforcement, typically running with elevated privileges as a Windows service. The vulnerability is categorized as CWE-427 (Uncontrolled Search Path Element), meaning the log-collection routine resolves an executable name without specifying a fully qualified, trusted path or otherwise validating the target binary. On Windows, this class of flaw typically manifests as DLL or EXE hijacking, where a privileged process loads an attacker-controlled binary from a writable directory that appears earlier in the search order than the legitimate one.
Know when Checkpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack from an authenticated standard user (AV:L/PR:L), no user interaction or special complexity, and successful hijack yields SYSTEM with full C/I/A impact.
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
DescriptionCVE.org
A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log collection process. Successful exploitation could allow an attacker to gain elevated privileges on the affected Windows endpoint.
Executive ViewAI
Check Point Identity Agent Full for Windows contains a local privilege escalation vulnerability (CVE-2026-10847, CVSS 7.8) that allows any user with endpoint access to gain full SYSTEM control through the log collection process. This elevates the risk of endpoint compromise: if a user account or administrator with standard privileges is compromised, attackers gain unrestricted control over that Windows system. Organizations with Check Point Identity Agent deployed across their Windows fleet should treat this as a material risk to endpoint security until patched.
No vendor-released patch identified at time of analysis. Interim mitigations: disable log collection process if not operationally critical, enforce principle of least privilege to limit user accounts with admin rights, deploy file integrity monitoring to detect unauthorized executable modification, and implement activity logging for the Check Point Identity Agent service to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Exploit-DB