CVE-2026-113461CWE-426CWE-829

CVE-2026-113461

published October 21, 2026

CVSS
5.2
EPSS
0%
Percentile
0.5
In the wild
Unconfirmed
What it is

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled.

The record
Technical detail
CVSS
5.2 · NONE
CVSS v4.0
5.2 · CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS
0.00092 · 0.5th percentile
Weaknesses
CWE-426 · Untrusted Search Path; CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2026-10-21T23:16Z
References (1)
https://checkmk.com/werk/22621 · [email protected]
EPSS history
Timeline
  • 23 OCT 03:55Z
    EPSS moved — → 0%
    epss
  • 21 OCT 18:11Z
    mk-oracle: Local privilege escalation via insecure Oracle Home library loading
    cvelistv5
  • 21 OCT 18:11Z
    mk-oracle: Local privilege escalation via insecure Oracle Home library loading
    cvelistv5