PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-105331 Checkmk GmbH CVE debrief

CVE-2026-105331 is a local privilege escalation vulnerability in Checkmk 2.5.0 before 2.5.0p10, allowing users with access to edit Oracle Instant Client referenced by the 'mk-oracle' agent plugin to escalate privileges if an agent has this plugin enabled. This vulnerability can lead to potential lateral movement and increased risk of compromised credentials or unauthorized access within the network. Defenders responsible for Checkmk systems, especially those using the 'mk-oracle' plugin, should assess exposure and prioritize remediation. The CVE record and source item provide details on the vulnerability, but additional verification is required to confirm affected systems and apply

Vendor
Checkmk GmbH
Product
Checkmk
CVSS
MEDIUM 5.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-08
Original CVE updated
2026-10-08
Advisory published
2026-10-08
Advisory updated
2026-10-08

Who should care

Defenders responsible for Checkmk systems, especially those using the 'mk-oracle' plugin, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-105331 is a local privilege escalation vulnerability in Checkmk 2.5.0 before 2.5.0p10, allowing users with access to edit Oracle Instant Client to escalate privileges if the 'mk-oracle' plugin is enabled. Defenders should verify and remediate this vulnerability, especially for systems with the 'mk-oracle' plugin enabled.

  • Potential local privilege escalation on Checkmk systems
  • Increased risk for compromised credentials or unauthorized access
  • Possible lateral movement within the network
  • Verification of Checkmk version and 'mk-oracle' plugin usage required

Technical summary

The vulnerability exists in Checkmk 2.5.0 before 2.5.0p10, where a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' can escalate their privileges if an agent has this plugin enabled. This issue arises from insufficient validation of user input, allowing an attacker to manipulate the Oracle Instant Client configuration. Defenders should verify and remediate this vulnerability, especially for systems with the 'mk-oracle' plugin enabled, by applying the vendor-provided patch (Checkmk 2.5.0p10 or later) and restricting

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Checkmk 2.5.0 before 2.5.0p10, especially for systems with the 'mk-oracle' plugin enabled.

Recommended defensive actions

  • Verify Checkmk version and 'mk-oracle' plugin usage
  • Restrict access to Oracle Instant Client configuration
  • Monitor for suspicious activity on agents with 'mk-oracle' enabled
  • Apply vendor-provided patch (Checkmk 2.5.0p10 or later)

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional verification is required to confirm affected systems and remediation steps.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-105331 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-105331

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-105331 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-105331

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.