Executive brief
Netdata is an open-source observability and monitoring tool that runs on Windows systems. When a low-privileged user triggers a repair of the Windows installer (MSI), the tool launches system processes with elevated privileges in a way that allows the user to intercept and hijack them to execute arbitrary commands with SYSTEM-level access. This provides a complete takeover of the affected Windows system.
Technical details
The vulnerability exists in Netdata Windows Agent MSI repair logic (versions 2.0.0–2.10.3), which launches powershell.exe and wevtutil.exe as elevated interactive processes visible in the initiating user's desktop session. A local attacker can interact with or hijack these process windows to execute arbitrary commands with SYSTEM privileges, bypassing access controls. The fix was applied in version 2.10.4 by hardening the MSI custom actions.
Affected products
- Netdata Windows Agent 2.0.0 through 2.10.3
Timeline
- 2026-09-22: disclosed: CVE-2026-83597 published
- 2026-06-17: patched: Fix merged in version 2.10.4