ServerEye Client Directory Permissions Enable Local Privilege Escalation

The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodically monitors the directory %ProgramData%\ServerEye3\update\ for a trigger file named "update_available". Due to insufficient access restrictions on this directory, a local standard user can create the trigger file and provide a path to a directory containing malicious JSON instructions. The service subsequently executes the utility UpdaterAction.exe with SYSTEM privileges, which parses the instructions and performs an unvalidated file copy from a user-controlled source to a protected system destination (e.g., overwriting a service binary). This leads to full system compromise as the service automatically restarts the overwritten binary with SYSTEM privileges.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-14551 affects ServerEye client versions 20.15 and earlier through a local privilege escalation vulnerability in the SE3Recovery service. The vulnerability stems from insufficient access controls on the %ProgramData%\ServerEye3\update\ directory, allowing standard users to manipulate a trigger file that the SYSTEM-level EmergencyRecoveryService.exe monitors. This affects organizations using ServerEye for infrastructure monitoring and management, where local attackers can exploit weak directory permissions to escalate privileges and gain complete system control. With a CVSS score of 8.8, this represents a critical risk for enterprises relying on this monitoring solution.

Casky's 224 mapped security skills detect the attack patterns associated with this vulnerability by analyzing MITRE ATT&CK technique TA0004 (Privilege Escalation) through Claude's extended reasoning capabilities. Practitioners using Casky would identify suspicious patterns including: unauthorized file creation in monitored system directories, unexpected triggering of high-privileged services by low-privilege processes, and abnormal access patterns to %ProgramData% locations. The platform's skills specifically flag improper file system permissions (CWE-73), missing access control enforcement (CWE-269), and insecure temporary file handling (CWE-379), correlating these weak controls with exploitation attempts. Detection findings would highlight the exploitation chain—from initial directory access through privilege escalation—enabling practitioners to prioritize remediation and hunt for evidence of active exploitation in their ServerEye deployments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14551.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-14551

Casky has 224 skills that investigate the attack patterns behind CVE-2026-14551. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn