Elevated Command Execution Vulnerability in Netdata Windows Agent
CVE-2026-83597

7HIGH

Key Information:

Vendor

Netdata

Status
Netdata
Vendor
CVE Published:
22 September 2026

What is CVE-2026-83597?

The Netdata Windows Agent, from versions 2.0.0 to 2.10.4, has a vulnerability where the MSI repair process launches powershell.exe and wevtutil.exe as elevated interactive processes. This flaw allows a low-privileged local user to potentially interact with these running processes, facilitating arbitrary command execution with SYSTEM-level privileges. The issue can be exploited by a user triggering the repair, compromising system security. The vulnerability has been addressed in the stable version 2.10.4.

Affected Version(s)

netdata >= 2.0.0, < 2.10.4

References

https://github.com/netdata/netdata/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/netdata/netdata/pull/22751
x_refsource_MISC
https://github.com/netdata/netdata/commit/d762782697623a9...
x_refsource_MISC

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.