CVE-2026-14551

The record

The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodically monitors the directory %ProgramData%\ServerEye3\update\ for a trigger file named "update_available". Due to insufficient access restrictions on this directory, a local standard user can create the trigger file and provide a path to a directory containing malicious JSON instructions. The service subsequently executes the utility UpdaterAction.exe with SYSTEM privileges, which parses the instructions and performs an unvalidated file copy from a user-controlled source to a protected system destination (e.g., overwriting a service binary). This leads to full system compromise as the service automatically restarts the overwritten binary with SYSTEM privileges.

Affected packages

Related vulnerabilities

• CVE-2026-119343 Stirling-PDF is a locally hosted web application that facilitates various operations on… CWE-73
• CVE-2026-119328 Immich is a high-performance self-hosted photo and video management solution. CWE-73
• CVE-2026-116249 In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and… CWE-73
• CVE-2026-119298 croc is a tool that allows any two computers to simply and securely transfer files and… CWE-73
• CVE-2026-61738 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-73
• CVE-2026-5461 The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all… CWE-73
• CVE-2026-118561 External Control of File Name or Path vulnerability in Drupal Single Content Sync allows… CWE-73
• CVE-2026-119210 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-73