Delinea Privilege Manager agent: Unauthenticated remote code execution
Summary
The Delinea Privilege Manager Windows agent contains a flaw that allows a remote, unauthenticated attacker to execute arbitrary code as LocalSystem under certain conditions. Successful exploitation would give the attacker full control over the affected endpoint. The enabling conditions are not publicly described, and the CVSS vector (High privileges required, active user interaction) conflicts with the 'unauthenticated' claim, so the advisory needs to be verified.
Affected
- Privilege Manager (on-prem and cloud) from 10.1.0 through 12.0.5796
- Privilege Manager from 13.0.0 through 13.0.1058
- Versions below 10.1.0: Unknown.
Fixed in
- Windows agent above 12.0.5796: upgrade to 13.0.2064
- Windows agent 12.0.5796 or lower: upgrade to 12.0.5804
Workaround
- Cloud customers and on-prem customers unable to upgrade: follow the mitigation steps in the Delinea release notes. Specific steps: Unknown.
- Not vendor-verified (VulDB advice): restrict network access to the agent to trusted management subnets.
Exploitation
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- No public proof-of-concept or exploit known.
- Not listed in KEV according to Strix. No evidence of exploitation in the wild.
Our recommendation
- Check whether Privilege Manager agents are installed and record the agent build on each endpoint.
- Upgrade to 13.0.2064 (above 12.0.5796) or 12.0.5804 (12.0.5796 or lower).
- Until patched, restrict network reachability of the agent to the management network.
- Monitor for unexpected child processes spawned by Delinea services.
- Confirm the fixed versions and the exploit conditions in the Delinea advisory, because the sources conflict.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
isukasanuj/CVE-2026-92744
Research sources
- Delinea Security Advisories delinea.com
- Delinea Privilege Manager software downloads docs.delinea.com
- VulDB CVE-2026-92744 vuldb.com
- VulDB entry 428796 vuldb.com
- Strix CVE-2026-92744 www.strix.ai
- OffSeq radar: CVE-2026-92744 (exploitation status) radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:34.
Original description (NVD)
Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.