CVE-2026-83597: Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-22 · updated 2026-09-23
Weakness: CWE-269

Description

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or hijack those visible process windows to execute arbitrary commands with SYSTEM privileges. This issue is fixed in stable version 2.10.4.

Affected products

netdata: from 2.0.0, < 2.10.4

References

https://github.com/netdata/netdata/commit/d762782697623a98b51b4e41f7fe2d12404f0662
https://github.com/netdata/netdata/pull/22751
https://github.com/netdata/netdata/releases/tag/v2.10.4
https://github.com/netdata/netdata/security/advisories/GHSA-jmv4-pq25-crvv
https://github.com/netdata/netdata/security/advisories/GHSA-jmv4-pq25-crvv

Get alerted when CVE-2026-83597 or the next vulnerability affects your stack