PowerShell Profile Privilege Escalation in Netdata Windows Agent

Executive Summary

CVE-2026-83598 is a local privilege escalation vulnerability in the Netdata Agent Windows installer. It affects versions from 2.0.0 up to but not including 2.10.4. During the MSI repair process, a SYSTEM-level PowerShell instance is spawned without the -NoProfile flag, causing PowerShell to load the user's profile script. This allows a low-privileged attacker to execute arbitrary code with SYSTEM privileges by placing malicious commands in their profile script.

Useful 0 Not Useful 0

Detection Guidance

Check if Netdata Windows Agent versions between 2.0.0 and 2.10.4 are installed. Inspect the PowerShell profile file at %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 for unauthorized commands. Look for recent repair operations via msiexec.exe logs or process execution logs involving powershell.exe without -NoProfile during MSI repair.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full SYSTEM privileges on a vulnerable Windows system running Netdata. This could lead to complete system compromise, allowing the attacker to install malware, steal data, or perform other malicious activities with the highest possible privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations using vulnerable Netdata versions may face regulatory penalties due to insufficient privilege management controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Netdata Windows Agent to version 2.10.4 or later immediately. Remove any untrusted commands from the PowerShell profile file at %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1. Monitor for unusual SYSTEM-level PowerShell activity during MSI operations.

Useful 0 Not Useful 0