# CVE-2026-10847: Check Point Identity Agent privilege escalation in log collection

Source: https://junglewise.ai/threats/cve-2026-10847-check-point-identity-agent-privilege-escalation-in-log-collection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-10847 · Severity: high · CVSS 7.8 · Published 2026-06-11

A security vulnerability exists in the Check Point Identity Agent, a tool used to identify users on corporate networks for security policy enforcement. A person with basic access to a Windows computer could exploit this flaw to gain full administrative control (SYSTEM privileges) over that machine. This could allow an attacker to bypass security controls, access sensitive local data, or install malicious software.

Vendors: [Check Point](https://junglewise.ai/threats/vendors/check-point).

## Quick answers

**Is CVE-2026-10847 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10847 being exploited in the wild.

**How severe is CVE-2026-10847?** High severity, with a CVSS score of 7.8, published 11 June 2026.

**Which products and versions are affected?** Check Point Identity Agent Full Windows OS versions prior to fix.

**Is there a fix for CVE-2026-10847?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10847 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-10847?** Check whether you run Check Point Identity Agent Full at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A local privilege escalation vulnerability (CWE-427: Uncontrolled Search Path Element) exists in the Check Point Identity Agent Full for Windows. The flaw resides in the log collection process, where the application improperly handles executable resolution, allowing for potential DLL hijacking or path redirection. An authenticated local attacker with low privileges can exploit this to execute arbitrary code with SYSTEM-level authority. The vulnerability requires local access but no user interaction. Check Point has addressed this in advisory sk185052.

## Affected products

- Check Point Identity Agent Full Windows OS versions prior to fix

## Timeline

- 2026-06-11: disclosed
- 2026-06-11: advisory

## References

- [https://support.checkpoint.com/results/sk/sk185052](https://support.checkpoint.com/results/sk/sk185052)