Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.4

Kandji Agent Privilege Escalation on Local System

CVE-2026-39118 · published 4 months ago
Summary

The Kandji Agent from Iru, Inc has a security weakness that could allow a malicious local user to gain elevated access to the system. This means they could potentially access sensitive data or make changes they shouldn't be able to. To protect yourself, update to the latest version of the Kandji Agent, which is v.4.7.5(5374) or later.

Original advisory text
An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke restricted agent functionality.
An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke restricted agent functionality.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published15 Jun 2026
Updated26 Oct 2026
First seen15 Jun 2026
Sources
CVE-2026-39118 · NVD
Track software like this
Free during beta