Affected Product: Servereye Client (Sensorhub) (vulnerable versions: <= 20.15)
Vulnerability Type: Local Privilege Escalation (LPE)
Severity: High (CVSS:3.1/AV/AC/PR/UI/S/C/I/A)
CVE: CVE-2026-14551 (https://www.cve.org/CVERecord?id=CVE-2026-14551)
Privileges Required: Low Privileged User
Configuration Requirement: None
Fixed Version: 20.16

Description#

Servereye is a widely used Remote Monitoring and Management (RMM) and IT monitoring platform in the DACH (Germany, Austria, Switzerland) region. It is designed to provide IT professionals with a centralized sensorhub for managed services, including patch management and system health monitoring.

The Servereye Windows Client (Sensorhub) architecture relies on several interconnected services running as NT AUTHORITY\SYSTEM:

SE3Recovery (EmergencyRecoveryService.exe): A watchdog service responsible for the self-healing and recovery of other agent components.
CCService (ClientAgentContainerService.exe): The primary sensorhub service that executes monitoring tasks.
UpdaterAction.exe: A privileged utility invoked by the recovery service to perform file-system operations during updates.

By default, the directory %ProgramData%\ServerEye3\update\ is created with insecure permissions, allowing standard users to append data and create files. Due to a vulnerability in the SE3Recovery service, any user on a Windows system is able to manipulate this IPC channel to force the service to perform arbitrary file copies to protected system locations. This primitive can be leveraged to achieve Local Privilege Escalation (LPE) by hijacking the CCService binary. This issue affects all Servereye Windows Client versions below version 20.16.

Disclosure Timeline#

Date	Event
2026‑05‑04	Initial contact with Servereye support.
2026‑05‑08	Initial contact with the NCSC.
2026‑05‑27	Initial contact from the NCSC to Servereye.
2026‑06‑12	The NCSC has contacted the BSI in Germany for assistance in establishing contact with Servereye.
2026‑06‑22	NCSC has confirmed that the vendor has released a hotfix.
2026‑07‑02	Response to the initial contact from Servereye, confirmation of the vulnerability and confirmation of the hotfix release.
2026‑07‑03	Reservation of CVE‑2026‑14551 by the NCSC.
2026‑07‑22	Public disclosure of vulnerability details.

Technical details#

Insecure ACLs#

A simple icacls check, confirms that a standard user can create files in the update folder under %ProgramData%\ServerEye3\, which is the control center for the watchdog’s IPC:

The 10-Second Heartbeat#

The vulnerability is rooted in the automated self-healing loop found in EmergencyRecoveryService.exe. A static analysis of the decompiled Local.cs reveals a hardcoded 10-second timer (RUN_INTERVAL_LOCAL) that triggers the recovery() routine. Every 10 seconds, the watchdog checks for a specific trigger file named update_available:

public class EmergencyRecoveryService : ServiceBase
{
    private const int RUN_INTERVAL_LOCAL = 10000; // 10 seconds
    private Local local;

    public EmergencyRecoveryService()
    {
        // ... 
        local = new Local(10000); // Heartbeat is initialized here
    }
}

The minorUpdatePending() method in Local.cs determines if the recovery logic should proceed:

private bool minorUpdatePending()
{
    // C:\ProgramData\ServerEye3\update\update_available
    if (File.Exists(Path.Combine(getUpdateV2Path(), "update_available")))
    {
        return true;
    }
    return false;
}

If the trigger file is present, the service invokes performMinorUpdate(). This method is designed to stop the CCService (Servereye Sensorhub), thereby releasing the file lock on the primary agent binary, ClientAgentContainerService.exe. The actual file operation is handled by UpdaterAction.exe. This utility reads the content of the update_available file and interprets it as a path to a directory containing JSON instructions:

private void performMinorUpdate()
{
    Stopper stopper = new Stopper();
    Starter starter = new Starter();

    stopper.action("cc"); // STOPS CCService (releasing ClientAgentContainerService.exe)

    // Calls UpdaterAction.exe to perform the arbitrary copy
    updaterV.action("update"); 

    starter.action("cc"); // Starts as NT\SYSTEM
}

Inside UpdaterAction.cs, the processUpdateItem method parses the JSON instructions and executes a File.Copy as SYSTEM without any path validation or signature verification:

JObject jObject = JObject.Parse(File.ReadAllText(item));
text = jObject.Value<string>("downloadedFile");
text2 = jObject.Value<string>("destinationFile");
File.Copy(text, text2, overwrite: true); // PRIVILEGED WRITE

Because the SE3Recovery watchdog restarts the CCService immediately after this operation, an attacker can replace the sensorhub binary with a malicious payload, resulting in code execution with the highest possible local privileges.

Proof of Concept#

To demonstrate the transition from an arbitrary file-copy primitive to a full system compromise, a Service Binary Hijacking attack is performed against the CCService.

Payload Staging#

The attack begins with the creation of a malicious payload. Using PowerShell’s Add-Type functionality, a minimalist C# application is compiled on the fly. This poc.exe is designed to execute a local privilege escalation: it invokes cmd.exe to create a new user, IGLocalAdmin, and adds that user to the local Administrators group. The payload is staged in a directory accessible to standard users, such as C:\Windows\Tasks\:

Instruction Injection#

A payload directory (e.g., C:\Users\Public\SE_Payload) is prepared to hold the attack instructions. A task.json file is generated within this folder, defining the source (the malicious poc.exe) and the target destination. The core of the exploit involves targeting the versioned service directory. By setting the destinationFile to the path of the ClientAgentContainerService.exe binary, the attacker ensures that the high-privileged watchdog will overwrite a critical system component.

The exploitation is initiated by writing the path of the payload directory to the trigger file: C:\ProgramData\ServerEye3\update\update_available. The use of the .NET method [System.IO.File]::WriteAllText is utilized here to ensure the string is written without trailing newlines or whitespace, which could interfere with the service’s path parsing logic.

Final Proof of NT\System rights#

Upon the expiration of the 10-second polling interval, the SE3Recovery watchdog detects the trigger, stops the CCService (releasing the file lock), executes the privileged copy via UpdaterAction.exe, and subsequently restarts the service. Because the legitimate ClientAgentContainerService.exe has been replaced by the malicious poc.exe, the service executes the payload within the security context of the service account: NT AUTHORITY\SYSTEM.

Verification of the attack is achieved by inspecting the local users. While the initial session is restricted to a standard user account, a subsequent check confirms the presence of the IGLocalAdmin account and its membership in the BUILTIN\Administrators group. This confirms the successful local privilege escalation:

Remediation#

The vulnerability is remediated in the installer version 20.16, which was automatically rolled out to all online reachable systems.