CVE-2026-14551 in Servereye
Summary
by MITRE • 07/22/2026
The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodically monitors the directory %ProgramData%\ServerEye3\update\ for a trigger file named "update_available". Due to insufficient access restrictions on this directory, a local standard user can create the trigger file and provide a path to a directory containing malicious JSON instructions. The service subsequently executes the utility UpdaterAction.exe with SYSTEM privileges, which parses the instructions and performs an unvalidated file copy from a user-controlled source to a protected system destination (e.g., overwriting a service binary). This leads to full system compromise as the service automatically restarts the overwritten binary with SYSTEM privileges.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability in ServerEye client versions 20.15 and earlier represents a classic local privilege escalation flaw that exploits improper access controls within a legitimate system service. The affected component SE3Recovery, also known as EmergencyRecoveryService.exe, operates with SYSTEM privileges and performs routine monitoring of the %ProgramData%\ServerEye3\update\ directory for a specific trigger file named "update_available". This design pattern creates an attack surface where unauthorized users can manipulate the service's behavior by creating this trigger file in a location they control. The vulnerability stems from inadequate directory permissions that allow standard users to write files to the monitored directory, violating fundamental security principles of least privilege and proper access control enforcement. The flaw manifests as a direct consequence of insufficient input validation and trust assumptions within the system architecture.
The technical execution path begins with a local user creating the "update_available" trigger file in the monitored directory, followed by placing malicious JSON instructions in a user-controlled directory that the service will reference. When the SE3Recovery service processes this trigger file, it executes UpdaterAction.exe with SYSTEM privileges, which then parses the unvalidated JSON instructions without proper sanitization or validation of the source paths. This parsing operation enables an arbitrary file copy from a user-controlled source to protected system destinations, including critical service binaries. The vulnerability is further exacerbated by the fact that the service automatically restarts the overwritten binary with elevated privileges, creating a persistent backdoor mechanism for full system compromise. The attack leverages the trust relationship between components and exploits the lack of proper path validation and privilege separation.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass complete system compromise capabilities. An attacker with local user access can leverage this flaw to overwrite critical system binaries, install persistent backdoors, or modify system configurations without requiring additional attack vectors. The automatic restart functionality ensures that the malicious payload remains active even after system reboots, providing long-term persistence. This vulnerability affects organizations using ServerEye client software and represents a significant risk to system integrity, as it allows attackers to bypass standard security controls and gain unauthorized administrative access. The exploitation requires minimal privileges and can be automated, making it particularly dangerous in environments where local accounts are prevalent.
Mitigation strategies should focus on implementing proper access controls and privilege separation within the affected service architecture. Organizations must ensure that the monitored directory %ProgramData%\ServerEye3\update\ has appropriate discretionary access control lists that prevent standard users from creating files in this location. The service should validate all input paths before executing file operations, implementing strict path validation and sanitization procedures to prevent arbitrary file copy operations. Additionally, privilege escalation mechanisms within the UpdaterAction.exe utility must be reviewed to ensure that it does not execute with unnecessary SYSTEM privileges when performing routine update operations. Security patches should enforce proper directory permissions, implement file integrity monitoring for critical system locations, and establish more robust validation of all user-controlled inputs to prevent similar vulnerabilities from being exploited. The vulnerability aligns with CWE-276 (Incorrect Default Permissions) and represents a violation of ATT&CK technique T1068 (Local Privilege Escalation) through improper privilege management and access control enforcement.