CVE-2026-35099: Lakeside SysTrack Agent Escalation Flaw

CVE-2026-35099 Overview

CVE-2026-35099 is a race condition vulnerability in Lakeside SysTrack Agent 11 that enables local privilege escalation to SYSTEM level. This vulnerability affects multiple versions of the SysTrack Agent prior to the patched releases and represents a significant security risk for organizations using this endpoint management software in their enterprise environments.

Critical Impact

Local attackers can exploit a race condition in Lakeside SysTrack Agent to escalate privileges from a standard user to SYSTEM, potentially gaining complete control over affected Windows systems.

Affected Products

• Lakeside SysTrack Agent 11.2.x versions before 11.2.1.28
• Lakeside SysTrack Agent 11.3.x versions before 11.3.0.38
• Lakeside SysTrack Agent 11.4.x versions before 11.4.0.24
• Lakeside SysTrack Agent 11.5.x versions before 11.5.0.15

Discovery Timeline

• 2026-04-01 - CVE-2026-35099 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-35099

Vulnerability Analysis

This vulnerability is classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), commonly known as a race condition. The Lakeside SysTrack Agent, which runs with elevated SYSTEM privileges to perform endpoint monitoring and management tasks, contains a race condition that can be exploited by a local attacker.

Race conditions occur when the timing or ordering of events affects the correctness of a program's behavior. In this case, an attacker with local access can manipulate the timing of certain operations within the SysTrack Agent to hijack a privileged operation, ultimately achieving code execution with SYSTEM-level privileges.

The local attack vector requires the attacker to have some level of access to the target system. However, no user interaction is required, and the attacker does not need any special privileges beyond local access to initiate the attack. The potential impact includes complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of CVE-2026-35099 is improper synchronization during concurrent execution within the SysTrack Agent. When the agent performs certain privileged operations, there exists a window of opportunity where an attacker can interfere with the operation's execution flow. This Time-of-Check Time-of-Use (TOCTOU) style vulnerability allows the attacker to substitute malicious content or redirect operations after security checks have been performed but before the privileged operation completes.

Attack Vector

The attack requires local access to a system running a vulnerable version of the Lakeside SysTrack Agent. The attacker must time their malicious operation to coincide precisely with the vulnerable window in the agent's execution. While the high complexity of exploiting race conditions typically makes them challenging to weaponize reliably, successful exploitation grants SYSTEM-level privileges.

The attacker could potentially abuse this by:

1. Monitoring for the vulnerable operation to begin
2. Racing to inject malicious content during the brief window between security checks and privileged execution
3. Gaining SYSTEM-level code execution when the privileged operation processes the attacker-controlled content

Since no code examples are available for this vulnerability, organizations should refer to the Lakeside Software Release Notes for technical details about the fix.

Detection Methods for CVE-2026-35099

Indicators of Compromise

• Unexpected process creation with SYSTEM privileges originating from or shortly after SysTrack Agent activity
• Anomalous timing patterns in SysTrack Agent operations that may indicate exploitation attempts
• Suspicious file system or registry modifications coinciding with SysTrack Agent execution windows
• Unusual child processes spawned by the SysTrack Agent service

Detection Strategies

• Monitor for privilege escalation events where non-privileged users gain SYSTEM-level access
• Implement endpoint detection rules for race condition exploitation patterns targeting the SysTrack Agent process
• Track process creation events and parent-child relationships involving the SysTrack Agent service
• Alert on unexpected SYSTEM-level process launches that coincide with SysTrack Agent operations

Monitoring Recommendations

• Enable detailed Windows Security Event logging for privilege use and process creation events (Event IDs 4672, 4688)
• Deploy endpoint detection and response (EDR) solutions capable of behavioral analysis to identify privilege escalation attempts
• Monitor file system activity in directories accessed by the SysTrack Agent for anomalous timing patterns
• Establish baseline behavior for SysTrack Agent operations to identify deviations that may indicate exploitation

How to Mitigate CVE-2026-35099

Immediate Actions Required

• Identify all systems running vulnerable versions of Lakeside SysTrack Agent (versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, or 11.5.0.15)
• Prioritize patching systems that are accessible by untrusted users or in high-risk environments
• Review system logs for signs of exploitation attempts on vulnerable endpoints
• Restrict local access to systems running vulnerable versions where immediate patching is not possible

Patch Information

Lakeside Software has released patched versions that address this race condition vulnerability. Organizations should update to the appropriate fixed version based on their current major version:

• Version 11.2.x: Update to 11.2.1.28 or later - See Lakeside Software Release Notes 11.2
• Version 11.3.x: Update to 11.3.0.38 or later - See Lakeside Software Release Notes 11.3
• Version 11.4.x: Update to 11.4.0.24 or later - See Lakeside Software Release Notes 11.4
• Version 11.5.x: Update to 11.5.0.15 or later - See Lakeside Software Release Notes 11.5

Workarounds

• Limit local access to systems running the SysTrack Agent to trusted administrators only
• Implement application whitelisting to prevent unauthorized executables from running on affected systems
• Apply the principle of least privilege to reduce the number of users with local access to vulnerable endpoints
• Monitor vulnerable systems closely until patches can be applied

# Verify SysTrack Agent version on Windows systems
# Run in PowerShell to check installed agent version
Get-ItemProperty "HKLM:\SOFTWARE\Lakeside Software\SysTrack Agent" -ErrorAction SilentlyContinue | Select-Object -Property Version
# Or check the installed programs
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*SysTrack*" } | Select-Object Name, Version