CVE-2026-50602
Received Received - Intake

Incorrect File Permissions in Planet9 Background Service Enable Privilege Escalation

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: 8fc372e3-d9c5-46e4-9410-38469745c639

Description
A security vulnerability has been identified in Planet9 due to incorrect file permissions assigned to an application executable used by the Planet9 background service. The service runs with SYSTEM privileges, while the affected executable grants excessive permissions to non-administrative users. As a result, an authenticated local user could potentially modify or replace the executable and execute arbitrary code with SYSTEM privileges when the service starts or the system is restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-50602
EUVD
EUVD-2026-60027

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
planet9 planet9 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Planet9 is caused by incorrect file permissions on an application executable used by the background service. The service runs with SYSTEM privileges, but the executable allows non-administrative users to modify or replace it. An authenticated local attacker could exploit this to execute arbitrary code with SYSTEM privileges when the service starts or the system restarts.

Detection Guidance

Check file permissions of the Planet9 executable using commands like 'icacls <path_to_executable>' on Windows or 'ls -l <path_to_executable>' on Linux. Look for excessive permissions granted to non-administrative users.

Impact Analysis

If you use Planet9, an attacker with local access to your system could gain full control over it. This means they could install malware, steal data, or perform other malicious actions with the highest system privileges, potentially compromising your entire system.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements under GDPR and HIPAA. It may result in legal penalties, loss of trust, and reputational damage due to inadequate security controls protecting sensitive data.

Mitigation Strategies

Restrict file permissions of the affected executable to allow only SYSTEM and administrators. Verify the integrity of the executable and ensure no unauthorized modifications have occurred.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart