isukasanuj/cve-2026-92744Disclosure write-up for CVE-2026-92744, an unauthenticated RCE in the Delinea Privilege Manager Windows agent via an empty WCF certificate validator, with root-cause analysis and reproduction.
CVE-2026-92744 · disclosure write-up 株式会社CyberCrew (CyberCrew Inc.)
| Field | Value |
|---|---|
| CVE ID | CVE-2026-92744 (CNA: Delinea, Inc.) |
| Title | Delinea Privilege Manager agent unauthenticated remote code execution vulnerability |
| Class | CWE-306 Missing Authentication for Critical Function (primary); CWE-295 Improper Certificate Validation (mechanism) |
| Affected | Privilege Manager Windows Core agent 10.1.0 → 12.0.5796 and 13.0.0 → 13.0.1058 |
| Fixed in | Agent 12.0.5804 (v12) and 13.0.2064 (v13); shipped with Privilege Manager 13.0.2, 28 Oct 2026 |
| Published CVSS | 8.7 High (CVSS 4.0) — CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| Our assessment | 9.8 Critical (network, inferred) / 7.8 High (local, demonstrated) — see §6 |
| Researchers | Isuka Sanuj (lead) · Ishan Nim (contributor) — both 株式会社CyberCrew |
| Vendor case | #01416021 (related: 01418441) |
| Tested build | 13.0.1041.338 (PMAgents_13_0_1041.exe), SHA-256 9ED7660B9D994620B3ECADC524EB10122C42E3A932CCFD2988F16A5D76FF0457, Authenticode valid (CN=Delinea Inc.) |
| Status | Reported 14 Sep 2026 · fixed, published, and researcher credit applied by vendor — closed |
The Privilege Manager Windows agent exposes a WCF duplex callback endpoint on TCP 5593, bound to all interfaces, with an inbound firewall rule the installer opens for the Domain, Private and Public profiles. The endpoint nominally requires a client certificate, but the validator that is supposed to check it — AmsServerCertValidator.Validate() — has an empty body, and the contract declares ProtectionLevel.None, removing message-layer signing. The net effect is that every operation on the contract accepts a caller presenting a certificate the caller generated seconds earlier.
Two of those operations chain into full compromise:
OnRegistrationComplete writes attacker-supplied certificates into LocalMachine\Ams — the store the agent uses to verify policy signatures — and removes the legitimate ones.OnClientTaskQueued drives the agent to fetch a command from its configured server and run it in a PowerShell runspace as nt authority\system, with ExecutionPolicy.Bypass explicitly set.The full chain was reproduced end to end on a clean default install in Windows Sandbox (Windows 11 build 26200) on 12 Sep 2026, producing a captured nt authority\system execution proof. No credentials, prior local access, or user interaction were required.
Because the product's entire purpose is to decide which processes may run elevated, this is not merely code execution on a host — it is control of the security decision itself.
The finding was reported to Delinea on 14 Sep 2026, fixed in the 28 Oct 2026 release, and assigned CVE-2026-92744 (published 29 Oct 2026). Following a credit request, Delinea added the agreed researcher acknowledgment to the public record. The disclosure is now closed. See §8–§10.
| Product | Affected | Fixed |
|---|---|---|
| Privilege Manager Windows Core agent (v12) | 10.1.0 → 12.0.5796 | 12.0.5804 |
| Privilege Manager Windows Core agent (v13) | 13.0.0 → 13.0.1058 | 13.0.2064 |
The fix shipped with Privilege Manager 13.0.2 on 28 Oct 2026. For customers who cannot immediately upgrade, Delinea's documented mitigation is to block inbound TCP 5593 (stated as causing no loss of function; agents fall back to pulling updates from the server on a schedule).
The agent runs as System and hosts the callback listener on all interfaces, with the installer-created firewall rule covering the Public profile:
--- listeners ---
:::5593 pid=4 proc=System <- all interfaces (http.sys)
--- firewall ---
[Domain, Private, Public] Arellia Agent (SSTP-In) | dir=Inbound action=Allow port=5593 prog=System
The configuration under test was the pristine installer default — nothing was weakened:
HKLM\SOFTWARE\Policies\Arellia\AMS
BaseUrl = https://localhost/TMS/
InstallCode = testinstallcode
BaseUrlOverride = https://localhost/TMS/
ValidateServerCertificate and ValidateCertChain are both absent (installed default). The endpoint presents a self-signed certificate named for the host (CN=7D20AF86-E474-4).
A single validator class with an empty Validate() governs three trust decisions:
internal class AmsServerCertValidator : X509CertificateValidator
{
public override void Validate(X509Certificate2 certificate)
{
}
}
| Site | Path governed |
|---|---|
_serviceHost.Credentials.ClientCertificate.Authentication.CustomCertificateValidator | inbound callback callers |
AgentRegistration2Client.CreateClient(...) | outbound registration |
ClientBaseFactory.CreateClient<ClientItems2Client, ...> | outbound policy fetch |
The inbound host wires that validator in as a custom validation mode, which replaces WCF's default chain validation with the empty method:
wSHttpBinding.Security.Message.ClientCredentialType = MessageCredentialType.Certificate;
wSHttpBinding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
wSHttpBinding.Security.Message.EstablishSecurityContext = false;
...
_serviceHost.Credentials.ClientCertificate.Authentication.CertificateValidationMode
= X509CertificateValidationMode.Custom;
_serviceHost.Credentials.ClientCertificate.Authentication.CustomCertificateValidator
= new AmsServerCertValidator();
[ServiceContract(Namespace = "http://schemas.arellia.com/agent/services/",
Name = "IAgentRegistration",
SessionMode = SessionMode.NotAllowed,
ProtectionLevel = ProtectionLevel.None)]
public interface IAgentRegistrationCallback
{
void OnRegistrationComplete(PlatformRegistration platformDetails);
void OnApplicablePolicyChange(ClientItemDigest[] applicablePolicyDigests);
void OnClientTaskQueued(PendingTaskExecutionInstance[] pendingTasks);
void OnBadRegistration(Guid suggestedNewId);
}
ProtectionLevel.None removes message signing, leaving the client certificate as the only caller check — and that check is the empty method above. All four declared operations were confirmed reachable by a self-signed caller (OnRegistrationComplete, OnClientTaskQueued, OnApplicablePolicyChange, OnBadRegistration — all accepted=True).
OnRegistrationComplete)On registration completion the agent ingests every certificate in the server's response and saves it into the Ams store with no chain build, no pinning, and no comparison against previously known certificates:
foreach (string serverCertificate in platformDetails.ServerCertificates)
{
byte[] raw = Convert.FromBase64String(serverCertificate);
ICertificate2 certificate2 = _cert2Factory.Create(raw);
list.Add(certificate2);
}
_certMgr.SaveServerCertificates(list);
The only catch covers malformed base64. SaveServerCertificates opens LocalMachine\Ams read-write and removes every certificate absent from the attacker's list before adding theirs. Reproduced twice on separate clean installs:
[16:21:46] LocalMachine\Ams before: 0 cert(s):
[16:21:52] attacker cert: 13E298FDE814B0B34B1BBB83631BF54276FCF2FC CN=attacker.invalid
[16:21:53] --- INVOKING OnRegistrationComplete with our certificate ---
[16:21:54] call returned without exception
[16:22:06] LocalMachine\Ams after: 1 cert(s): 13E298FDE814B0B34B1BBB83631BF54276FCF2FC