EUVD-2026-36247
GHSA-phqv-gxhh-jc8p
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack from an authenticated standard user (AV:L/PR:L), no user interaction or special complexity, and successful hijack yields SYSTEM with full C/I/A impact.
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
Lifecycle Timeline
2DescriptionCVE.org
A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log collection process. Successful exploitation could allow an attacker to gain elevated privileges on the affected Windows endpoint.
AnalysisAI
Local privilege escalation in Check Point Identity Agent Full for Windows allows an authenticated local user to execute arbitrary code with SYSTEM privileges through improper executable resolution during the log collection process. The flaw is a classic CWE-427 uncontrolled search path issue, and no public exploit has been identified at time of analysis. Exploitation is constrained to attackers who already have a foothold on the endpoint but provides a reliable path to full SYSTEM compromise.
Technical ContextAI
Check Point Identity Agent Full is a Windows endpoint client that maps logged-in users to IP addresses for Check Point gateway policy enforcement, typically running with elevated privileges as a Windows service. The vulnerability is categorized as CWE-427 (Uncontrolled Search Path Element), meaning the log-collection routine resolves an executable name without specifying a fully qualified, trusted path or otherwise validating the target binary. On Windows, this class of flaw typically manifests as DLL or EXE hijacking, where a privileged process loads an attacker-controlled binary from a writable directory that appears earlier in the search order than the legitimate one.
RemediationAI
Patch available per vendor advisory - consult Check Point sk185052 at https://support.checkpoint.com/results/sk/sk185052 for the fixed Identity Agent Full build and upgrade all Windows endpoints accordingly; exact fix version is not disclosed in the provided input. As compensating controls until patches are deployed, restrict local interactive logon on endpoints running Identity Agent to trusted users (limits the local foothold prerequisite), audit and remove write permissions for non-admin users on directories that appear in the SYSTEM PATH or in the Identity Agent installation path (mitigates planting of a hijack binary), and monitor process-creation telemetry for the Identity Agent service spawning unexpected children, especially during log-collection cycles. Side effects: tightening PATH/directory ACLs may break poorly written third-party installers that rely on world-writable program directories.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today