CVE-2022-36122 in Automox
Summary
by MITRE • 10/21/2022
The Automox Agent before 40 on Windows incorrectly sets permissions on key files.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/16/2026
The Automox Agent vulnerability CVE-2022-36122 represents a critical access control flaw affecting versions prior to 40 on Windows systems. This issue stems from improper permission configuration on essential agent files, creating potential security risks that could be exploited by malicious actors. The vulnerability specifically impacts the Windows implementation of the Automox endpoint management solution, which is widely used for automating software updates and security patches across enterprise environments.
The technical flaw manifests in the agent's file system permission handling mechanism where key files are not properly secured with restrictive access controls. This misconfiguration allows unauthorized users or processes to potentially access, modify, or execute sensitive agent components that should remain protected. The improper permissions create a pathway for privilege escalation attacks and could enable adversaries to gain elevated system access or manipulate the agent's functionality. According to CWE classification, this vulnerability maps to CWE-276: Incorrect Permission Assignment for Critical Resources, which directly addresses improper access control mechanisms.
The operational impact of this vulnerability extends beyond simple permission issues as it undermines the security posture of managed endpoints. Attackers who exploit this flaw could potentially compromise the integrity of the endpoint management system, leading to unauthorized software installations, configuration changes, or data exfiltration. The vulnerability affects organizations that rely on Automox for critical security operations, as compromised agents could provide attackers with persistent access to target systems. This risk is particularly concerning in enterprise environments where the agent serves as a gateway for security policies and patch management operations.
Security professionals should consider this vulnerability in relation to ATT&CK techniques such as T1068: Exploitation for Privilege Escalation and T1059: Command and Scripting Interpreter, as the improper file permissions could facilitate these attack vectors. The vulnerability's exploitation potential increases when combined with other attack methods that leverage compromised endpoints for lateral movement or persistent access. Organizations using Automox Agent versions prior to 40 should prioritize immediate remediation through the available security update, as the risk of exploitation remains significant. Additionally, system administrators should conduct thorough permission audits on affected systems and implement monitoring for unauthorized access attempts to critical agent files. The vulnerability demonstrates the importance of proper access control implementation in security software and highlights the need for comprehensive security testing of agent-based solutions before deployment in production environments.