CVE-2026-14551: Server Eye Client Privilege Escalation

CVE-2026-14551 Overview

CVE-2026-14551 is a local privilege escalation vulnerability in the servereye client (also known as sensorhub or ClientAgentContainerService) versions 20.15 and earlier. The SE3Recovery service (EmergencyRecoveryService.exe) runs as SYSTEM and monitors %ProgramData%\ServerEye3\update\ for a trigger file. Insufficient access controls on this directory allow a local standard user to plant the trigger and direct the service to execute UpdaterAction.exe against attacker-controlled JSON instructions. The utility then performs an unvalidated file copy to a protected system location, resulting in full SYSTEM compromise. The weakness is classified as external control of a file name or path [CWE-73].

Critical Impact
A local, low-privileged user can overwrite arbitrary service binaries and gain SYSTEM-level code execution on affected hosts.

Affected Products

servereye client (sensorhub / ClientAgentContainerService) version 20.15
servereye client versions prior to 20.15
SE3Recovery service component (EmergencyRecoveryService.exe) and UpdaterAction.exe utility

Discovery Timeline

2026-07-22 - CVE-2026-14551 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-14551

Vulnerability Analysis

The SE3Recovery service performs periodic polling of %ProgramData%\ServerEye3\update\ for a file named update_available. When present, the service reads a referenced path and invokes UpdaterAction.exe under the SYSTEM account. UpdaterAction.exe parses JSON update instructions and performs a file copy from a source path to a destination path with no validation of either endpoint. Because the directory permits writes by standard users, a local attacker controls both the trigger and the instructions consumed by a SYSTEM process. Exploitation results in a scope change from a low-privileged user context to full host compromise.

Root Cause

The root cause is external control of a file path [CWE-73] combined with weak filesystem access control on the update staging directory. The service places implicit trust in files written by any local principal and performs privileged file operations based on user-supplied JSON. Neither the trigger file source, the referenced instruction directory, nor the copy destination is validated against an allow-list or integrity check.

Attack Vector

A local user creates a directory containing crafted JSON update instructions specifying a malicious DLL or executable as the source and a protected service binary as the destination. The user then writes update_available into %ProgramData%\ServerEye3\update\ referencing that directory. SE3Recovery launches UpdaterAction.exe as SYSTEM, which copies the attacker's payload over the target binary. The affected service subsequently restarts and loads the attacker-controlled binary with SYSTEM privileges. Technical details are available in the ServerEye Security Bulletin 2026-001.

Detection Methods for CVE-2026-14551

Indicators of Compromise

Creation of the file update_available inside %ProgramData%\ServerEye3\update\ by a non-administrative user account
UpdaterAction.exe executions launched by EmergencyRecoveryService.exe referencing JSON instruction paths outside the vendor's install directory
Unexpected file writes to protected service binary paths originating from UpdaterAction.exe
Service restart events for servereye components immediately following a file overwrite

Detection Strategies

Monitor filesystem events on %ProgramData%\ServerEye3\update\ for writes by non-privileged Security Identifiers (SIDs)
Alert on UpdaterAction.exe process creations whose parent is EmergencyRecoveryService.exe and whose command line references user-writable paths
Correlate SYSTEM-level file copies into Program Files or service binary directories with preceding low-integrity file writes

Monitoring Recommendations

Enable Windows Sysmon Event IDs 1 (process creation) and 11 (file create) for the servereye update directory and related binaries
Baseline the legitimate hash of UpdaterAction.exe and alert on execution when the JSON source path is outside vendor-controlled locations
Forward endpoint telemetry to a SIEM and review anomalous privilege transitions from standard user activity to SYSTEM process execution

How to Mitigate CVE-2026-14551

Immediate Actions Required

Upgrade the servereye client to a version later than 20.15 as directed by the ServerEye Security Bulletin 2026-001
Restrict Access Control Lists (ACLs) on %ProgramData%\ServerEye3\update\ so that only SYSTEM and administrators can create or modify files
Audit endpoints for existing malicious content in the update staging directory before applying the patch
Limit interactive logon rights on servers running servereye to reduce local attacker exposure

Patch Information

The vendor has published remediation guidance in the ServerEye Security Bulletin 2026-001. Administrators should deploy the fixed servereye client version across all managed endpoints and verify that the update replaces the vulnerable EmergencyRecoveryService.exe and UpdaterAction.exe components.

Workarounds

Apply a hardened ACL to %ProgramData%\ServerEye3\update\ removing write permissions for the Users and Authenticated Users groups until patched
Temporarily disable the SE3Recovery service on hosts where immediate patching is not feasible, accepting the loss of recovery functionality
Enforce application control policies that block execution of UpdaterAction.exe when invoked with instruction paths outside the trusted install directory

bash

# Configuration example: restrict ACLs on the update staging directory
icacls "%ProgramData%\ServerEye3\update" /inheritance:r
icacls "%ProgramData%\ServerEye3\update" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"
icacls "%ProgramData%\ServerEye3\update" /remove "Users" "Authenticated Users"