CVE-2026-45176: Idira Endpoint Privilege Manager Agent: Local Privilege Escalation via Internal Communication or File Operation Manipulation

Synopsis

A local privilege escalation vulnerability affects Idira Endpoint Privilege Manager Agent versions from 26.0 up to (but not including) 26.5. An attacker who already has a low-privileged foothold on the host can manipulate an internal communication mechanism or file operation within a high-privileged agent component to bypass permission restrictions and execute arbitrary actions with elevated privileges. No network access or authentication is required beyond the existing local session. A patched-image rebuild at version 26.5 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required to reach the vulnerable component.

• AuthenticationNot required

  No authentication credential is required beyond the attacker's existing low-privileged local session, which is treated as the starting condition rather than a barrier.

• Victim interactionNot required

  Exploitation is fully attacker-driven; no action by another user or administrator is needed to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is rated High, meaning exploitation depends on specific environmental circumstances such as timing, file-system state, or internal IPC conditions that the attacker cannot fully control on demand.

Blast Radius

• Reads sensitive data from the local system with full privileged-process visibility, including credentials, configuration files, and secrets accessible to the agent.
• Modifies files, registry entries, or application state on the host with elevated privileges, potentially altering security policy enforcement enforced by the agent itself.
• Crashes or disrupts the Endpoint Privilege Manager Agent service, disabling privilege-control enforcement on the affected host.
• Achieves lateral movement potential by leveraging elevated local privileges to access credentials or tokens reachable only by high-privileged processes.