EUVD-2026-84567Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only (AV:L) escalation from an existing low-priv account (PR:L); AC:H because the attacker must win a timing/UI race against the transient elevated repair windows; SYSTEM command execution gives full C:H/I:H/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or hijack those visible process windows to execute arbitrary commands with SYSTEM privileges. This issue is fixed in stable version 2.10.4.
Articles & Coverage 1
AnalysisAI
Local privilege escalation in the Netdata Windows Agent (versions 2.0.0 through 2.10.3) lets an authenticated low-privileged local user obtain SYSTEM-level code execution by interacting with or hijacking the elevated interactive process windows that the MSI repair action spawns in that user's own desktop session. Carrying a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-269 improper privilege management, exploitation is genuinely constrained: it is local-only, requires the ability to trigger an MSI repair under the host's Windows Installer elevation policy, and depends on a timing/UI race against transient elevated windows, so it is a bounded privilege-escalation issue rather than a remotely reachable emergency. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the Netdata Windows Agent (versions 2.0.0 to before 2.10.4) installed via MSI on the target host; (2) an authenticated low-privileged local user account on that host; and (3) the ability for that user to initiate an MSI repair of the Netdata package, which spawns powershell.exe, wevtutil.exe and icacls.exe as elevated INTERACTIVE processes in the initiating user's own desktop session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded privilege-escalation issue, not a remotely-exploitable emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the Netdata Windows Agent to stable version 2.10.4 or later, which replaces the interactive ExeCommand custom actions with WixQuietExec so powershell.exe, icacls.exe and wevtutil.exe no longer run in a user-controllable desktop session; apply the release from https://github.com/netdata/netdata/releases/tag/v2.10.4 and consult advisory GHSA-jmv4-pq25-crvv and PR 22751 for details. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows endpoints and servers running the Netdata Windows Agent and flag every installation in the affected range 2.0.0 through 2.10.3, prioritizing shared workstations, jump hosts, and multi-user systems where a low-privileged authenticated local user could trigger the MSI repair path; restrict interactive local logon rights on those hosts to essential personnel in the interim. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today