CVE-2026-14551— Local Privilege Escalation in servereye client (sensorhub)
Possible ATT&CK Techniques 2AI
T1547.001 · Registry Run Keys / Startup Folder T1068 · Exploitation for Privilege EscalationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| servereye GmbH | servereye Windows Agent (Sensorhub) | ≤ 20.15 | affected |
20.16 | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14551
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Local Privilege Escalation in servereye client (sensorhub)
Source: CVE Program / CVE List V5
Vulnerability Description
The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodically monitors the directory %ProgramData%\ServerEye3\update\ for a trigger file named "update_available". Due to insufficient access restrictions on this directory, a local standard user can create the trigger file and provide a path to a directory containing malicious JSON instructions. The service subsequently executes the utility UpdaterAction.exe with SYSTEM privileges, which parses the instructions and performs an unvalidated file copy from a user-controlled source to a protected system destination (e.g., overwriting a service binary). This leads to full system compromise as the service automatically restarts the overwritten binary with SYSTEM privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在具有不安全权限的目录中创建临时文件
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| servereye GmbH | servereye Windows Agent (Sensorhub) | 0 ~ 20.15 | - |
II. Public POCs for CVE-2026-14551
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14551
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14551 (1)
- 🔗 Security-Bulletin - servereyevendor-advisory
IV. Related Vulnerabilities
Same weakness: CWE-379
- CVE-2026-7539
HP Dock Accessory WMI Provider Installer Security Update - CVE-2026-54328
Pi: Predictable temporary extension install paths allow loca - CVE-2026-42191
OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry def - CVE-2019-25677
WinRAR 5.61 Denial of Service via Malformed Language File - CVE-2025-10279
Privilege Escalation in mlflow/mlflow
V. Comments for CVE-2026-14551
No comments yet