CVE-2026-113461 Checkmk GmbH CVE debrief

Who should care

System administrators and security teams responsible for Checkmk installations, particularly those with the 'mk-oracle' plugin enabled, should assess exposure and verify the configuration to prevent potential privilege escalation.

Why it matters

CVE-2026-113461 is a local privilege escalation vulnerability in Checkmk 2.5.0p14 that allows a local user to execute code as root if an agent has the 'mk-oracle' plugin enabled. Defenders should prioritize verifying the plugin configuration, reviewing the 'oratab' file, and ensuring proper access controls.

• Potential local privilege escalation to root
• Possible code execution as root
• Required verification of 'mk-oracle' plugin configuration
• Need for proper access controls on Oracle client library directories

Technical summary

The vulnerability exists in Checkmk 2.5.0p14 and allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled. The vulnerability is related to insecure Oracle Home library loading. Defenders should focus on verifying the 'mk-oracle' plugin configuration, reviewing the 'oratab' file for sensitive directories, and ensuring proper access controls are in place.

Defensive priority

Defenders should prioritize verifying the 'mk-oracle' plugin configuration, reviewing the 'oratab' file for sensitive directories, and ensuring proper access controls are in place.

Recommended defensive actions

• Verify the 'mk-oracle' plugin configuration and ensure proper access controls are in place.
• Review the 'oratab' file for sensitive directories and restrict access as needed.
• Monitor for suspicious activity related to the 'mk-oracle' plugin and Oracle client library directory.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential impact. However, additional information on exploitation or victim impact is not available. The vulnerability is confirmed to exist in Checkmk 2.5.0p14, and the 'mk-oracle' plugin is a key factor in the potential exploitation. Defenders should verify the plugin configuration and review the 'oratab' file for sensitive directories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.