CVE-2026-27788: Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11

Synopsis

An incorrect permission assignment vulnerability exists in Fsas Technologies ServerView Agents for Windows V11.60.04 and earlier. The flaw is reachable locally and requires a low-privilege authenticated account on the host, meaning an attacker must already have a shell or login session on the affected server. Successful exploitation grants the attacker SYSTEM-level privileges, enabling full control over the operating system including reading and writing any file or process on the host. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or login session on the host; no network-facing exposure is required to trigger the vulnerability.

• AuthenticationRequired

  Any low-privilege account with the ability to log in to the server where ServerView Agents is installed is sufficient to attempt exploitation.

• Victim interactionNot required

  The attacker does not need another user to take any action; exploitation proceeds without victim participation.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layout, or environmental timing are required.

Blast Radius

• A successful attacker elevates to SYSTEM privilege and gains unrestricted read access to all files on the host, including credentials, certificates, and secrets stored on disk.
• The attacker can write or overwrite any file on the system, modify service binaries, and alter configuration that persists across reboots.
• All running processes on the host are reachable for inspection or termination, and new processes can be spawned under SYSTEM context.
• The full integrity and confidentiality of the host operating system is compromised; any data processed or stored on the server is accessible to the attacker.