CVE-2026-10847: Check Point Identity Agent Privilege Escalation Vulnerability (7.8 CVSS)

Technical summary

CVE-2026-10847 is a local privilege escalation vulnerability (CWE-427: Uncontrolled Search Path Element) affecting Check Point Identity Agent Full on Windows. The vulnerability exists in the executable resolution mechanism used by the log collection functionality. An authenticated local user can manipulate this process to achieve arbitrary code execution with SYSTEM privileges. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation requires local access and valid credentials, but no user interaction, and grants complete confidentiality, integrity, and availability impact.

Business impact

A successful exploit grants an attacker SYSTEM-level access to Windows endpoints running Check Point Identity Agent Full. This allows complete compromise of the affected system: installation of persistent malware, lateral movement to other network assets, credential theft, sensitive data exfiltration, and destruction of audit trails. For organizations relying on Check Point's identity management agent for security policy enforcement, this represents a critical endpoint security gap that could undermine broader identity and access control programs.

Affected systems

Check Point Identity Agent Full for Windows OS is affected. The vendor_products field in authoritative sources is empty, which may indicate either that specific version details are still being confirmed or that all current versions are in scope. Organizations should check Check Point's official advisory for precise version information and patch availability. The vulnerability requires local authentication, so it affects systems where untrusted or compromised users have login access.

Exploitability

Exploitation requires an authenticated local user account on the Windows machine—no network access is needed, and no user interaction is required once the attacker is logged in. The low attack complexity means the vulnerability is straightforward to exploit. However, the local and authentication requirement does limit the immediate attack surface to insiders, compromised local accounts, or attackers with prior system access. The flaw is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the latest update, though that does not guarantee active exploitation is not occurring in the wild.

Remediation

Apply the security patch issued by Check Point for Identity Agent Full on Windows as soon as it becomes available. Verify the exact patched version numbers against Check Point's official security advisory. Until patching is complete, mitigate risk by restricting local login access to trusted administrators only, enforcing strong authentication (multi-factor authentication where possible), and monitoring for suspicious process execution with SYSTEM privileges originating from the Identity Agent log collection process.

Patch guidance

Consult Check Point's official security advisory for CVE-2026-10847 to identify the fixed version(s) of Identity Agent Full. After applying the patch, verify the update was successful and validate that the log collection process functions correctly. Test in a non-production environment first if possible. Schedule patching during a maintenance window to minimize disruption to identity services, and coordinate with teams relying on the agent for policy enforcement to ensure continuity.

Detection guidance

Monitor Windows Event Viewer for unexpected SYSTEM-level process creation initiated by the Identity Agent (or its log collection sub-process). Watch for anomalous execution of system binaries or scripts from unusual paths that may indicate DLL hijacking or path manipulation. Check endpoint detection and response (EDR) solutions for suspicious privilege escalation events correlated with Identity Agent activity. Audit access to the Identity Agent installation directory and log collection configuration files for unauthorized modifications.

Why prioritize this

This vulnerability scores HIGH (7.8 CVSS) due to the combination of high impact (full system compromise via SYSTEM access) and relatively low exploitation barriers (local authentication with no user interaction required). While the local-only attack vector narrows the initial attack surface, the presence of the flaw in a privileged security agent used organization-wide makes it a strong candidate for rapid patching. The risk is especially acute in environments with shared systems, remote access, or where user privilege isolation is weak.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector (Local) and low Attack Complexity mean the vulnerability is easy to exploit given local access; Privileges Required (Low) and no User Interaction mean any authenticated user can trigger it without social engineering; and the impact metrics (Confidentiality, Integrity, Availability all High) indicate complete system compromise. The Scope is Unchanged because exploitation does not break out of the affected system's security boundary, yet the severity remains HIGH because the resulting access is unrestricted.

Frequently asked questions