CVE-2026-32325: Privilege chaining issue exists in ServerView Agents for Windows V11

Synopsis

A privilege chaining vulnerability exists in ServerView Agents for Windows V11.60.04 and earlier, a server monitoring agent from Fsas Technologies. The vulnerability requires local access and a low-privilege account on the host; no network exposure is needed. Successful exploitation allows the attacker to escalate to SYSTEM privilege, giving full control over the affected Windows host. No fix version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing interface is required to trigger the vulnerability.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or elevated credentials to begin the exploit chain.

• Victim interactionNot required

  No user interaction or social-engineering step is required; the attacker can execute the privilege escalation independently.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions, race timing, or memory-layout requirements.

Blast Radius

• Escalates the attacker's session to SYSTEM, the highest privilege level on a Windows host, bypassing all user-mode access controls.
• Reads any file or credential material on the host, including secrets stored by the ServerView agent, OS credential stores, and application config files.
• Modifies or deletes system files, agent configuration, and persisted data, allowing tampering with monitoring data or sabotage of the host.
• Crashes or disables services on the host, including the ServerView agent itself, disrupting server health monitoring and alerting pipelines.