# CVE-2026-111573: Checkmk Windows agent privilege escalation via unprotected data directory

Source: https://junglewise.ai/threats/cve-2026-111573-incorrect-permissions-on-the-checkmk-windows-agent-s-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-111573 · Severity: info · Published 2026-11-06

Checkmk's Windows agent monitors system health and security. A race condition during service startup fails to properly restrict access to the agent's data directory, allowing local users to execute code as SYSTEM and steal the agent's private key. This lets attackers gain full control of monitored systems or compromise the monitoring infrastructure itself.

Technologies: [Checkmk](https://junglewise.ai/threats/technologies/checkmk). Vendors: [Checkmk](https://junglewise.ai/threats/vendors/checkmk).

## Quick answers

**Is CVE-2026-111573 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111573 being exploited in the wild.

**How severe is CVE-2026-111573?** Informational severity, published 6 November 2026.

**Which products and versions are affected?** Checkmk 3.0.0b1; Checkmk Windows Agent 2.5.0 before 2.5.0p18, 2.4.0 before 2.4.0p39, 2.3.0 before 2.3.0p52, 2.2.0.

**Is there a fix for CVE-2026-111573?** Yes: fixed in Checkmk 3.0.0b1, 2.5.0p18, 2.4.0p39, 2.3.0p52. Until then: If immediate agent updates are not possible, manually disable inheritance on C:\ProgramData\checkmk and remove local Users group entries, then verify with Get-Acl that no entries grant write access to normal users. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111573 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-111573?** Check whether you run Checkmk or Checkmk Windows Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Checkmk 3.0.0b1, 2.5.0p18, 2.4.0p39, 2.3.0p52

If immediate agent updates are not possible, manually disable inheritance on C:\ProgramData\checkmk and remove local Users group entries, then verify with Get-Acl that no entries grant write access to normal users.

## Technical details

A race condition in Checkmk's Windows agent startup causes asynchronous permission-setting scripts to be cleared before completion, silently discarding security ACL changes to C:\ProgramData\checkmk. A local authenticated user can then place arbitrary scripts in agent\local or agent\plugins folders that run as SYSTEM, or read the registered_connections.json file containing the agent controller's private key. The vulnerability requires local access and affects versions 2.5.0p9 and later most severely.

## Affected products

- Checkmk Windows Agent 2.5.0 before 2.5.0p18, 2.4.0 before 2.4.0p39, 2.3.0 before 2.3.0p52, 2.2.0
- Checkmk Checkmk 3.0.0b1

## Timeline

- 2026-10-19: disclosed
- 2026-11-06: advisory

## References

- [https://checkmk.com/werk/19231](https://checkmk.com/werk/19231)

## Related threats

- [Checkmk Kubernetes special agent argument injection](https://junglewise.ai/threats/cve-2026-121374-argument-injection-in-the-kubernetes-special-agent-in-checkmk-2)
- [Checkmk Robotmk path traversal in HTML log](https://junglewise.ai/threats/cve-2026-120495-path-traversal-in-the-synthetic-monitoring-robotmk-test-service)
- [Checkmk path traversal in remote site label synchronization](https://junglewise.ai/threats/cve-2026-118965-path-traversal-in-the-discovered-host-label-synchronization-in)
- [Checkmk Jolokia agent password exposure in process list](https://junglewise.ai/threats/cve-2026-103682-invocation-of-the-jolokia-special-agent-with-the-login-password)
- [Checkmk NetApp ONTAP password exposure in process list](https://junglewise.ai/threats/cve-2026-103674-invocation-of-the-netapp-ontap-special-agent-with-the-login)