CVE-2026-14551 servereye GmbH CVE debrief

Who should care

System administrators and users of servereye client versions 20.15 and earlier should be aware of this vulnerability and take necessary actions to mitigate it. This includes reviewing system configurations, verifying the version of servereye client installed, and applying patches or updates as needed. Additionally, implementing compensating controls and monitoring system logs for suspicious activity can help prevent potential exploitation.

Technical summary

The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodically monitors the directory %ProgramData%5CServerEye3%5Cupdate%5C for a trigger file named 'update_available'. Due to insufficient access restrictions on this directory, a local standard user can create the trigger file and provide a path to a directory containing malicious JSON instructions. The service subsequently executes the utility UpdaterAction.exe with SYSTEM privileges, which parses the instructions and performs an unvalidated file copy from a user-controlled source to a protected system destination (e.g., overwriting a service binary).

Defensive priority

High

Recommended defensive actions

• Inventory and verify the version of servereye client installed on all systems.
• Apply the necessary patches or updates to fix the vulnerability.
• Implement additional security measures to restrict access to the directory %ProgramData%5CServerEye3%5Cupdate%5C.
• Monitor system logs for suspicious activity related to the SE3Recovery service and UpdaterAction.exe utility.
• Consider implementing compensating controls to detect and prevent potential exploitation.

Evidence notes

The CVE record was published on 2026-07-22T10:17:13.810Z and has not been modified since then. The NVD entry is currently Received. Evidence is limited to CVE and NVD data. Defenders should verify system configurations, review logs for SE3Recovery and UpdaterAction.exe activity, and check for unauthorized file modifications.

Official resources