{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/privilege-manager-windows-core-agent-13.0.0---13.0.1058/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:delinea:privilege_manager_windows_core_agent:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-92744"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Privilege Manager Windows Core agent (10.1.0 - 12.0.5796)","Privilege Manager Windows Core agent (13.0.0 - 13.0.1058)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","vulnerability","delinea","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Delinea"],"content_html":"\u003cp\u003eDelinea Privilege Manager Windows agents (v12.x and v13.x) contain a critical vulnerability (CVE-2026-92744) in the WCF duplex callback service listening on TCP 5593. The agent fails to validate client certificates due to an empty custom validator method and uses 'ProtectionLevel.None', allowing unauthenticated remote callers to interact with the service. Exploitation enables an attacker to overwrite the 'LocalMachine\\Ams' trust store and trigger task execution as 'NT AUTHORITY\\SYSTEM' via PowerShell. This vulnerability was reported by CyberCrew and fixed in version 12.0.5804 and 13.0.2064.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs network reconnaissance to identify Privilege Manager agents listening on TCP 5593.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a connection to the WCF duplex callback endpoint on the target agent.\u003c/li\u003e\n\u003cli\u003eAttacker presents a self-signed, attacker-generated certificate, which the agent accepts due to an empty 'AmsServerCertValidator.Validate()' method.\u003c/li\u003e\n\u003cli\u003eAttacker calls the 'OnRegistrationComplete' operation, providing a malicious server certificate payload.\u003c/li\u003e\n\u003cli\u003eAgent service overwrites the 'LocalMachine\\Ams' certificate store with the attacker-provided certificate, effectively becoming the trusted policy authority for the agent.\u003c/li\u003e\n\u003cli\u003eAttacker calls 'OnClientTaskQueued' with a synthetic 'CommandId' to force the agent to fetch a malicious task.\u003c/li\u003e\n\u003cli\u003eAgent executes the attacker-defined PowerShell command in a runspace as 'NT AUTHORITY\\SYSTEM'.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an attacker full control over the agent host with 'SYSTEM' privileges. Since the agent governs process elevation and policy enforcement, the attacker can manipulate security decisions and execute arbitrary code.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Privilege Manager Windows Core agent to version 12.0.5804 (for v12 environments) or 13.0.2064 (for v13 environments).\u003c/li\u003e\n\u003cli\u003eApply the documented Delinea mitigation immediately: block all inbound traffic to TCP 5593 on all agent hosts.\u003c/li\u003e\n\u003cli\u003eMonitor host-based firewall logs for inbound connections to TCP 5593 originating from unauthorized IP addresses.\u003c/li\u003e\n\u003cli\u003eHunt for unexpected PowerShell execution by the 'Delinea Privilege Manager' service process or child processes spawned by the agent.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T20:01:24Z","date_published":"2026-10-30T20:01:24Z","id":"https://feed.craftedsignal.io/briefs/2026-10-delinea-privilege-manager-rce/","summary":"An unauthenticated remote code execution vulnerability in the Delinea Privilege Manager Windows agent allows attackers to achieve system-level code execution by exploiting an insecure WCF callback endpoint on TCP 5593.","title":"Delinea Privilege Manager Agent Remote Code Execution (CVE-2026-92744)","url":"https://feed.craftedsignal.io/briefs/2026-10-delinea-privilege-manager-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Privilege Manager Windows Core Agent (13.0.0 - 13.0.1058)","version":"https://jsonfeed.org/version/1.1"}