Critical Zero-Days in Atera Windows Installers Expose Users to Privilege Escalation Attacks

Zero-day vulnerabilities in Windows Installers for the Atera remote monitoring and management software could act as a springboard to launch privilege escalation attacks. The flaws, discovered by Mandiant on February 28, 2023, have been assigned the identifiers CVE-2023-26077 and CVE-2023-26078,...

CVE-2023-26078

CVE-2023-26078 affects Atera Agent for Windows (versions 1.8.4.4 and earlier). Root cause: mishandling of privileged APIs in the MSI installer’s repair functionality, enabling local privilege escalation by executing tasks under NT AUTHORITY\SYSTEM (with potential DLL hijacking as discussed in pub...

CVE-2023-26078

Privilege escalation vulnerability was discovered in Atera Agent 1.8.4.4 and prior on Windows due to mishandling of privileged APIs...