Idira Endpoint Privilege Manager EUVD-2026-36362

Attacker must already have local code execution on the Linux host as an unprivileged user (PR:L, AV:L), and must be able to act during the EPM agent daemon's initialization window - either by waiting for a legitimate restart (boot, update, crash) or by inducing one. The host must be running an Idira Endpoint Privilege Manager Linux Agent build older than 26.5; Windows and macOS agents are not in scope. No user interaction is required (UI:N) and attack complexity is low (AC:L), but exposure is bounded to systems where EPM is deployed as a trust anchor and where untrusted users can obtain shell access.

The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H accurately conveys a high-impact local issue: an attacker who already has an unprivileged shell on the host can reliably interfere with the EPM daemon's startup and gain effective control over confidentiality, integrity, and availability of the protected system. Because EPM is itself a privilege-enforcement product, compromising its daemon has an outsized effect - it can neutralize the very controls used to detect or block privilege escalation, making this a meaningful priority on hosts that rely on EPM as their primary least-privilege boundary. No EPSS, KEV, or POC data was supplied, and the U:Amber tag indicates the vendor considers the technical detail sensitive but actionable; absent broader exploitation signals, this should be treated as a high-severity local issue rather than a mass-exploitation candidate, but patched promptly on hosts where EPM is the trust anchor.

An attacker with an existing low-privileged local account - for example via a compromised application service account or a phishing-acquired user session - waits for or triggers an EPM agent restart and races the daemon's initialization to manipulate the resources it acquires or releases improperly. By successfully compromising the daemon's startup, the attacker subverts the privilege-management policy on the host, enabling them to operate outside EPM's enforcement and effectively impact confidentiality, integrity, and availability of the protected system. No public exploit identified at time of analysis.