CVE-2026-4761: Panorama Suite Privilege Escalation Flaw

CVE-2026-4761 Overview

CVE-2026-4761 is an Insecure Permissions vulnerability affecting Codra Panorama Suite's Network and Security tool. When a certificate and its private key are installed in the Windows machine certificate store using this tool, access rights to the private key are unnecessarily granted to the operator group, potentially exposing sensitive cryptographic material to unauthorized users.

Critical Impact

Private key exposure through overly permissive access controls could allow unauthorized operators to access, export, or misuse certificates intended for secure system operations.

Affected Products

• Panorama Suite 2025 (25.00.004) without update PS-2500-00-0357 or higher
• Panorama Suite Network and Security Tool

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-4761 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-4761

Vulnerability Analysis

This vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource). The core issue lies in how the Network and Security tool within Panorama Suite handles access control lists (ACLs) when installing certificates with private keys into the Windows machine certificate store.

When certificates are installed through the affected tool, the underlying process fails to properly restrict private key access permissions. Instead of limiting access to only necessary system accounts and administrators, the tool grants read access to the operator group. This represents a violation of the principle of least privilege, as operator-level users typically should not require direct access to private key material.

The vulnerability requires local access to exploit, meaning an attacker would need to have an authenticated session on the affected Windows system with operator-level privileges. Once exploited, the attacker could potentially read sensitive private keys, enabling them to impersonate services, decrypt protected communications, or sign malicious code using compromised certificates.

Root Cause

The root cause is improper permission assignment during the certificate installation workflow. The Network and Security tool applies overly permissive ACLs to the private key file in the Windows certificate store, granting the operator group access rights that should be restricted to administrators and specific system services. This appears to be a configuration or implementation error in the tool's certificate handling logic rather than a fundamental architectural flaw.

Attack Vector

The attack vector is local, requiring an authenticated attacker with operator-level access on the target Windows system. The exploitation flow involves:

1. An attacker with operator group membership logs into the affected Windows system
2. The attacker navigates to the Windows certificate store where certificates were installed via the Network and Security tool
3. Due to the improper permissions, the attacker can access and potentially export private keys
4. These private keys can then be used for unauthorized signing, decryption, or impersonation attacks

The vulnerability does not require complex attack techniques or user interaction beyond initial system access, though it does require specific prerequisite conditions (operator group membership and certificates installed via the vulnerable tool).

Detection Methods for CVE-2026-4761

Indicators of Compromise

• Unexpected access to certificate private keys by operator-level accounts in Windows Security Event logs
• Certificate export operations initiated by non-administrative users
• Anomalous cryptographic operations using machine certificates from operator accounts

Detection Strategies

• Monitor Windows Security Event logs for Event ID 5058 (Key file operation) and Event ID 5061 (Cryptographic operation) from operator group accounts
• Implement PowerShell scripts to audit certificate store permissions and identify certificates with overly permissive private key ACLs
• Deploy endpoint detection rules to alert on certificate export operations from non-privileged accounts

Monitoring Recommendations

• Enable detailed Windows certificate services auditing through Group Policy
• Review the Codra CSIRT Security Bulletin BS-036 for specific monitoring guidance
• Periodically audit certificate store permissions using certutil -store -v to identify improperly secured private keys

How to Mitigate CVE-2026-4761

Immediate Actions Required

• Upgrade to Panorama Suite 2025 Updated Dec. 25 (25.10.007) which is not vulnerable
• For Panorama Suite 2025 (25.00.004) installations, apply update PS-2500-00-0357 or higher immediately
• Review and manually correct private key permissions on certificates installed prior to patching

Patch Information

Codra has released security update PS-2500-00-0357 to address this vulnerability in Panorama Suite 2025 (25.00.004). Installations running Panorama Suite 2025 Updated Dec. 25 (25.10.007) are not affected by this vulnerability. Organizations should refer to Codra CSIRT Security Bulletin BS-036 for detailed patching instructions and additional security guidance.

Workarounds

• Manually reset private key permissions on affected certificates using Windows certificate management tools
• Temporarily revoke and reissue affected certificates through a different installation method until patches can be applied
• Restrict operator group membership to only essential personnel and monitor their activities closely

# Audit certificate private key permissions
# Check machine certificate store for certificates with overly permissive ACLs
Get-ChildItem -Path Cert:\LocalMachine\My | ForEach-Object {
    $cert = $_
    $keyPath = $cert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName
    Write-Host "Certificate: $($cert.Subject)"
    Write-Host "Thumbprint: $($cert.Thumbprint)"
    # Review output for operator group access
}