CVE-2025-13818: ESET Management Agent privilege escalation via insecure temporary batch file

CVE-2025-13818 · Severity: medium · CVSS 6.7 · Published 2026-02-06

ESET Management Agent, which is used to manage and monitor security on Windows systems, contains a vulnerability that allows an attacker with Administrator privileges to escalate their access to the highest system level (SYSTEM account). An attacker could exploit this by manipulating temporary batch files used during command execution, potentially gaining complete control of the affected system. ESET has released patches to address this issue.

Vendors: Eset.

Quick answers

Is CVE-2025-13818 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-13818 being exploited in the wild.
How severe is CVE-2025-13818?
Medium severity, with a CVSS score of 6.7, published 6 February 2026.
Which products and versions are affected?
Eset Management Agent 12.5.2104.0 and earlier.
Is there a fix for CVE-2025-13818?
A patch was published on 2026-02-06: Fixed in ESET Management Agent version 13.0.1400.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-13818 attacked?
It is attacked with local access.
Am I affected by CVE-2025-13818?
Check whether you run Eset Management Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a local privilege escalation (LPE) caused by insecure handling of temporary batch files used during command execution from ESET PROTECT Web Console on Windows. Commands are stored in a predictable and writable location, allowing an attacker with Administrator privileges to modify these files before execution. When executed, the modified commands run under the SYSTEM account rather than Administrator context, resulting in privilege escalation. Local Administrator access is required to exploit this vulnerability. The fix is available in ESET Management Agent version 13.0.1400.0 and later, which implements improved security measures for file operations during command execution.

Affected products

  • ESET Management Agent 12.5.2104.0 and earlier

Timeline

  • 2026-02-06: disclosed
  • 2026-02-06: patched: Fixed in ESET Management Agent version 13.0.1400.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.