# CVE-2026-14551

## Summary

- **CVE ID:** CVE-2026-14551
- **Severity:** HIGH
- **CVSS Score:** 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- **CWE:** CWE-379, CWE-269, CWE-73
- **Published:** Jul 22, 2026
- **Last Modified:** Jul 22, 2026

## Description

The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodically monitors the directory %ProgramData%\ServerEye3\update\ for a trigger file named "update_available". Due to insufficient access restrictions on this directory, a local standard user can create the trigger file and provide a path to a directory containing malicious JSON instructions. The service subsequently executes the utility UpdaterAction.exe with SYSTEM privileges, which parses the instructions and performs an unvalidated file copy from a user-controlled source to a protected system destination (e.g., overwriting a service binary). This leads to full system compromise as the service automatically restarts the overwritten binary with SYSTEM privileges.

## Affected Products

- servereye GmbH — servereye Windows Agent (Sensorhub) (0)
- servereye GmbH — servereye Windows Agent (Sensorhub) (20.16)

## References

- [CNA](https://www.servereye.de/security-bulletins/2026-001/)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.14%
- **EPSS Percentile:** 3.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._