CVE-2026-45174: Idira Endpoint Privilege Manager Linux Agent: Potential bypass of Agent Daemon Initialization

Synopsis

An authentication bypass (agent daemon initialization bypass) affects the Idira Endpoint Privilege Manager Linux Agent in versions 26.0 through 26.4. The vulnerability is exploited locally by an attacker who already holds a low-privilege account on the host, requiring no network access and no interaction from another user. Successful exploitation gives the attacker full read, write, and availability impact on the host, effectively compromising the privilege-management agent itself. A patched-image rebuild at version 26.5 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or root credentials to trigger the vulnerability.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker can exploit the flaw unilaterally.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory-layout dependencies, or special environmental configuration are required.

Blast Radius

• Reads sensitive data managed or protected by the privilege-manager agent, including credentials and policy configuration stored on the host.
• Writes to or tampers with agent-controlled files and policy state, allowing privilege escalation or policy suppression.
• Disrupts agent daemon availability, disabling endpoint privilege controls and leaving the host unprotected.