Is CVE-2026-14852 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14852 being exploited in the wild.

How severe is CVE-2026-14852?

Informational severity, with a CVSS score of 5.2, published 14 July 2026.

Which products and versions are affected?

Checkmk GmbH Checkmk 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, 2.2.0 (EOL).

Is there a fix for CVE-2026-14852?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14852 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-14852?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14852: Checkmk privilege escalation in mk_sap_hana agent plugin

CVE-2026-14852 · Severity: info · CVSS 5.2 · Published 2026-07-14

A security vulnerability in the Checkmk monitoring agent could allow a local user to gain full administrative control over a Linux server. By creating a specially named process that mimics a SAP HANA database, an attacker can trick the monitoring software into executing unauthorized commands with root privileges. This issue affects organizations using Checkmk to monitor SAP HANA environments where the monitoring plugin is configured to run with elevated permissions.

Quick answers

Is CVE-2026-14852 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14852 being exploited in the wild.
How severe is CVE-2026-14852?: Informational severity, with a CVSS score of 5.2, published 14 July 2026.
Which products and versions are affected?: Checkmk GmbH Checkmk 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, 2.2.0 (EOL).
Is there a fix for CVE-2026-14852?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14852 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-14852?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in the mk_sap_hana agent plugin of Checkmk. When no explicit database configuration is provided, the plugin automatically discovers SAP HANA instances by scanning the system process list for 'sapstartsrv'. Because local users can control their own process names, an attacker can craft a process name containing malicious shell commands. If the plugin is configured to run as root (typically via RUNAS=agent), it extracts the instance identifier from the spoofed process name and incorporates it into a command string executed with elevated privileges. The fix implements strict validation to ensure instance identifiers match the expected format of genuine SAP HANA instances.

Affected products

Checkmk GmbH Checkmk 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, 2.2.0 (EOL)

Timeline

2026-07-07: advisory: Vendor advisory Werk #20104 published
2026-07-14: disclosed: CVE published to NVD

References

https://checkmk.com/werk/20104

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.