CVE-2026-83597highCWE-269

CVE-2026-83597: fallo de gravedad alta en netdata

Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution

Publicada el

Seguir esta CVE+ Monitorear netdata+ Monitorear netdata

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7epss 0.1%
Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or hijack those visible process windows to execute arbitrary commands with SYSTEM privileges. This issue is fixed in stable version 2.10.4.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
netdata · netdata
CVEs relacionadas — netdata

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-22496HIGHNetdata vulnerable to command injection EPSS 36.2%CVE-2024-32019HIGHndsudo: local privilege escalation via untrusted search pathEPSS 1.2%CVE-2026-83599HIGHNetdata: WebSocket Decompression BombEPSS 0.7%CVE-2023-22497MEDIUMNetdata is vulnerable to improper authenticationEPSS 0.7%CVE-2026-83600MEDIUMNetdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agentEPSS 0.5%CVE-2025-71385MEDIUMNetdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg EndpointEPSS 0.4%