CVE-2026-83597: Netdata Windows Agent Privilege Escalation

CVE-2026-83597 Overview

Netdata is an open source observability tool used for real-time system and application monitoring. A privilege escalation vulnerability affects the Netdata Windows Agent from version 2.0.0 through 2.10.3. During MSI repair, the installer launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with the visible process windows and execute arbitrary commands with SYSTEM privileges. The issue is tracked as [CWE-269: Improper Privilege Management] and is fixed in stable release 2.10.4.

Critical Impact
Local low-privileged users can hijack elevated interactive processes spawned during MSI repair to obtain SYSTEM-level code execution on Windows hosts running vulnerable Netdata Agent builds.

Affected Products

Netdata Windows Agent 2.0.0 through 2.10.3
Windows endpoints with Netdata MSI installer permitting user-initiated repair
Fixed in Netdata stable version 2.10.4

Discovery Timeline

2026-09-22 - CVE-2026-83597 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-83597

Vulnerability Analysis

The vulnerability resides in the Windows Installer (MSI) custom actions defined in packaging/windows/netdata.wxs.in. When a user triggers MSI repair, the installer executes deferred custom actions with elevated privileges. Two of these actions spawn powershell.exe and wevtutil.exe interactively in the calling user's desktop session rather than in an isolated non-interactive context. Because the child processes run as SYSTEM yet display visible windows on the invoking user's desktop, a local attacker can attach to those windows and inject commands through the interactive UI. The result is a straightforward SYSTEM-level shell for any local user permitted to invoke MSI repair.

Root Cause

The root cause is improper privilege management ([CWE-269]) in the WiX installer definition. The original CustomAction invoked powershell.exe with Impersonate="no" and Execute="deferred", meaning it ran under the LocalSystem account while remaining attached to the user's interactive desktop session. Windows MSI does not automatically isolate the graphical session of deferred custom actions, so an unprivileged user who initiated repair could observe and interact with those elevated windows.

Attack Vector

Exploitation requires only local access and standard user privileges. The attacker initiates MSI repair through the Windows control panel or the msiexec /f command against the installed Netdata product. When powershell.exe or wevtutil.exe appears on the desktop under the SYSTEM security context, the attacker uses interactive session hijacking techniques to send keystrokes, paste command input, or otherwise drive the elevated process to execute attacker-controlled commands.

text

            </InstallExecuteSequence>

            <!-- Add new files (stream.conf and netdata.conf) -->
-            <CustomAction Id="NDCreateNewFiles" Directory="USRLIBEXECNETDATADIR" ExeCommand='powershell.exe -NoProfile -ExecutionPolicy Bypass -NonInteractive -File "[USRLIBEXECNETDATADIR]\copy_files.ps1"' Execute="deferred" Return="ignore" Impersonate="no"/>
+            <SetProperty
+                Id="NDCreateNewFiles"
+                Value=""[System64Folder]WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -NonInteractive -File "[USRLIBEXECNETDATADIR]\copy_files.ps1""
+                Before="NDCreateNewFiles"
+                Sequence="execute"
+            />
+            <CustomAction
+                Id="NDCreateNewFiles"
+                BinaryRef="Wix4UtilCA_$(sys.BUILDARCHSHORT)"
+                DllEntry="WixQuietExec"
+                Execute="deferred"
+                Return="ignore"
+                Impersonate="no"
+            />
            <InstallExecuteSequence>
                <Custom Action="NDCreateNewFiles" Before="InstallFinalize" />
            </InstallExecuteSequence>

Source: Netdata patch commit d762782. The fix replaces the direct powershell.exe invocation with WixQuietExec, which runs the command through a non-interactive utility custom action rather than spawning a visible window in the user session.

Detection Methods for CVE-2026-83597

Indicators of Compromise

Unexpected powershell.exe or wevtutil.exe processes with parent msiexec.exe running as NT AUTHORITY\SYSTEM on Windows endpoints with Netdata installed.
MSI repair events for the Netdata product initiated by non-administrative users, visible in the Windows Application event log with source MsiInstaller.
Child processes of the elevated PowerShell instance that spawn command interpreters, network utilities, or credential dumping tools.

Detection Strategies

Hunt for msiexec.exe command lines containing /f or REINSTALL flags targeting the Netdata product code, particularly when invoked by standard users.
Correlate SYSTEM-level PowerShell executions with immediately preceding interactive logon events for non-privileged accounts.
Flag any interactive window creation for processes running under the LocalSystem account, which should never occur on hardened endpoints.

Monitoring Recommendations

Enable Windows Installer verbose logging via the Logging registry value under HKLM\Software\Policies\Microsoft\Windows\Installer to capture repair operations.
Ingest Sysmon Event ID 1 (Process Create) and Event ID 11 (File Create) into a SIEM to trace child processes of msiexec.exe.
Alert on execution of copy_files.ps1 outside of legitimate installation or upgrade windows.

How to Mitigate CVE-2026-83597

Immediate Actions Required

Upgrade all Windows Netdata Agent installations to stable version 2.10.4 or later.
Inventory Windows hosts running Netdata 2.0.0 through 2.10.3 and prioritize systems accessible to multiple local users.
Restrict local user permissions to invoke MSI repair on affected products until patching completes.

Patch Information

The vendor fix is available in Netdata release v2.10.4. Technical details are documented in GitHub Security Advisory GHSA-jmv4-pq25-crvv and the corresponding Netdata Pull Request #22751. The patch replaces interactive CustomAction invocations with WixQuietExec calls that execute deferred actions without a visible desktop window.

Workarounds

Apply Group Policy to disable user-initiated MSI repair by setting DisableUserInstalls and AlwaysInstallElevated policies to values that block non-administrator repair.
Remove standard user access from Windows hosts where Netdata cannot be immediately patched.
Monitor for and terminate any interactive SYSTEM-owned PowerShell windows spawned by msiexec.exe until the upgrade is deployed.

bash

# Verify installed Netdata version on Windows (PowerShell)
Get-Package -Name "Netdata*" | Select-Object Name, Version

# Restrict non-admin MSI repair via registry policy
reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v DisableUserInstalls /t REG_DWORD /d 1 /f