CVE-2026-10847: Local Privilege Escalation vulnerability in Check Point Identity Agent Full for Windows OS

Synopsis

A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user on the affected host can exploit improper executable resolution during the log collection process to run arbitrary code with SYSTEM privileges, requiring no network access and no interaction from another user. Successful exploitation gives the attacker full control over the affected Windows endpoint, including read and write access to all data and the ability to disrupt any running service. No fix version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to attempt exploitation; no administrative credentials are needed.

• Victim interactionNot required

  No action from another user is required; the attacker can trigger the vulnerable log collection path entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layout, or environmental dependencies are noted in the CVSS vector.

Blast Radius

• The attacker executes arbitrary code under the SYSTEM account, gaining the highest privilege level on the Windows endpoint.
• All files, credentials, and secrets stored on the host become readable, including those belonging to other users and services.
• The attacker can modify, overwrite, or delete any persisted data on the endpoint, including security tooling and audit logs.
• Any running service on the host can be stopped or replaced, disrupting endpoint availability and any workload dependent on it.