Log in Start free

Vulnerability · Published Sep 22, 2026 · Assigned by GitHub_M

CVE-2026-83597Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution

High 7.0

In plain English

A high-severity privilege mismanagement in netdata from netdata. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 96.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or hijack those visible process windows to execute arbitrary commands with SYSTEM privileges. This issue is fixed in stable version 2.10.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12netdatano fix listedDEBIAN-CVE-2026-83597
Ubuntu:24.04:LTSnetdatano fix listedUBUNTU-CVE-2026-83597

Affected products (as reported)

VendorProductVersions
netdata netdata >= 2.0.0, < 2.10.4

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References