Delinea Privilege Manager Agent Remote Code Execution (CVE-2026-92744)

Delinea Privilege Manager Windows agents (v12.x and v13.x) contain a critical vulnerability (CVE-2026-92744) in the WCF duplex callback service listening on TCP 5593. The agent fails to validate client certificates due to an empty custom validator method and uses 'ProtectionLevel.None', allowing unauthenticated remote callers to interact with the service. Exploitation enables an attacker to overwrite the 'LocalMachine\Ams' trust store and trigger task execution as 'NT AUTHORITY\SYSTEM' via PowerShell. This vulnerability was reported by CyberCrew and fixed in version 12.0.5804 and 13.0.2064.

Attack Chain

1. Attacker performs network reconnaissance to identify Privilege Manager agents listening on TCP 5593.
2. Attacker initiates a connection to the WCF duplex callback endpoint on the target agent.
3. Attacker presents a self-signed, attacker-generated certificate, which the agent accepts due to an empty 'AmsServerCertValidator.Validate()' method.
4. Attacker calls the 'OnRegistrationComplete' operation, providing a malicious server certificate payload.
5. Agent service overwrites the 'LocalMachine\Ams' certificate store with the attacker-provided certificate, effectively becoming the trusted policy authority for the agent.
6. Attacker calls 'OnClientTaskQueued' with a synthetic 'CommandId' to force the agent to fetch a malicious task.
7. Agent executes the attacker-defined PowerShell command in a runspace as 'NT AUTHORITY\SYSTEM'.

Impact

Successful exploitation grants an attacker full control over the agent host with 'SYSTEM' privileges. Since the agent governs process elevation and policy enforcement, the attacker can manipulate security decisions and execute arbitrary code.

Recommendation

• Upgrade Privilege Manager Windows Core agent to version 12.0.5804 (for v12 environments) or 13.0.2064 (for v13 environments).
• Apply the documented Delinea mitigation immediately: block all inbound traffic to TCP 5593 on all agent hosts.
• Monitor host-based firewall logs for inbound connections to TCP 5593 originating from unauthorized IP addresses.
• Hunt for unexpected PowerShell execution by the 'Delinea Privilege Manager' service process or child processes spawned by the agent.