CVE-2026-105331CWE-426CWE-829

CVE-2026-105331

published October 8, 2026

CVSS
5.2
EPSS
0%
Percentile
0.3
In the wild
Unconfirmed
What it is

Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.

The record
Technical detail
CVSS
5.2 · NONE
CVSS v4.0
5.2 · CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS
0.00084 · 0.3th percentile
Weaknesses
CWE-426 · Untrusted Search Path; CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2026-10-08T19:17Z
References (1)
https://checkmk.com/werk/22619 · [email protected]
EPSS history
Timeline
  • 10 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 08 OCT 14:19Z
    mk-oracle: Local privilege escalation via malicious Oracle Instant Client
    cvelistv5
  • 08 OCT 14:19Z
    mk-oracle: Local privilege escalation via malicious Oracle Instant Client
    cvelistv5