CVE-2026-14551
Deferred Deferred - Pending Action

Local Privilege Escalation in servereye ClientAgentContainerService

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Switzerland Government Common Vulnerability Program

Description
The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodically monitors the directory %ProgramData%\ServerEye3\update\ for a trigger file named "update_available". Due to insufficient access restrictions on this directory, a local standard user can create the trigger file and provide a path to a directory containing malicious JSON instructions. The service subsequently executes the utility UpdaterAction.exe with SYSTEM privileges, which parses the instructions and performs an unvalidated file copy from a user-controlled source to a protected system destination (e.g., overwriting a service binary). This leads to full system compromise as the service automatically restarts the overwritten binary with SYSTEM privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-08-11
AI Q&A
2026-07-22
EPSS Evaluated
2026-08-10
NVD
CVE-2026-14551
EUVD
EUVD-2026-47622

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
servereye client to 20.15 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-379 The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability is a Local Privilege Escalation in the servereye client (sensorhub) versions 20.15 and earlier. A high-privileged service called SE3Recovery runs as SYSTEM and monitors a specific directory for a trigger file. Due to weak access controls, a local standard user can create this file and point it to a malicious directory. The service then executes a utility with SYSTEM privileges, which copies files from a user-controlled source to protected system locations, allowing full system compromise.

Detection Guidance

Check for the presence of the vulnerable servereye client by inspecting the directory %ProgramData%\ServerEye3\update\ for the trigger file 'update_available' or suspicious JSON instructions. Monitor for unexpected file modifications in protected system directories or service binaries.

Impact Analysis

This vulnerability allows a local attacker with standard user privileges to escalate to SYSTEM privileges. This could lead to full control over the affected system, enabling installation of malware, data theft, or disruption of services. Attackers could gain persistent access or pivot to other systems in the network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected servereye client versions may face compliance violations, potential fines, and reputational damage due to compromised systems handling regulated data.

Mitigation Strategies

Update the servereye client to a version later than 20.15. Restrict write permissions on %ProgramData%\ServerEye3\update\ to prevent unauthorized file creation. Disable or remove the SE3Recovery service if not required. Monitor for signs of exploitation such as unexpected service restarts or file overwrites.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14551. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart