Is CVE-2026-111573 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111573 being exploited in the wild.

How severe is CVE-2026-111573?

Informational severity, published 6 November 2026.

Which products and versions are affected?

Checkmk 3.0.0b1; Checkmk Windows Agent 2.5.0 before 2.5.0p18, 2.4.0 before 2.4.0p39, 2.3.0 before 2.3.0p52, 2.2.0.

How is CVE-2026-111573 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-111573?

Check whether you run Checkmk or Checkmk Windows Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111573: Checkmk Windows agent privilege escalation via unprotected data directory

CVE-2026-111573 · Severity: info · Published 2026-11-06

Checkmk's Windows agent monitors system health and security. A race condition during service startup fails to properly restrict access to the agent's data directory, allowing local users to execute code as SYSTEM and steal the agent's private key. This lets attackers gain full control of monitored systems or compromise the monitoring infrastructure itself.

Technologies: Checkmk. Vendors: Checkmk.

Quick answers

Is CVE-2026-111573 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111573 being exploited in the wild.
How severe is CVE-2026-111573?: Informational severity, published 6 November 2026.
Which products and versions are affected?: Checkmk 3.0.0b1; Checkmk Windows Agent 2.5.0 before 2.5.0p18, 2.4.0 before 2.4.0p39, 2.3.0 before 2.3.0p52, 2.2.0.
Is there a fix for CVE-2026-111573?: Yes: fixed in Checkmk 3.0.0b1, 2.5.0p18, 2.4.0p39, 2.3.0p52. Until then: If immediate agent updates are not possible, manually disable inheritance on C:\ProgramData\checkmk and remove local Users group entries, then verify with Get-Acl that no entries grant write access to normal users. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111573 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-111573?: Check whether you run Checkmk or Checkmk Windows Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Checkmk 3.0.0b1, 2.5.0p18, 2.4.0p39, 2.3.0p52

If immediate agent updates are not possible, manually disable inheritance on C:\ProgramData\checkmk and remove local Users group entries, then verify with Get-Acl that no entries grant write access to normal users.

Technical details

A race condition in Checkmk's Windows agent startup causes asynchronous permission-setting scripts to be cleared before completion, silently discarding security ACL changes to C:\ProgramData\checkmk. A local authenticated user can then place arbitrary scripts in agent\local or agent\plugins folders that run as SYSTEM, or read the registered_connections.json file containing the agent controller's private key. The vulnerability requires local access and affects versions 2.5.0p9 and later most severely.

Affected products

Checkmk Windows Agent 2.5.0 before 2.5.0p18, 2.4.0 before 2.4.0p39, 2.3.0 before 2.3.0p52, 2.2.0
Checkmk Checkmk 3.0.0b1

Timeline

2026-10-19: disclosed
2026-11-06: advisory

References

https://checkmk.com/werk/19231

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.