A local user who can write to the Oracle client library directory of an Oracle home listed in the 'oratab' file, or to the 'oratab' itself, may trigger the 'mk-oracle' plugin in a Checkmk agent. When this plugin is enabled, the agent will load the compromised library, allowing the attacker to execute arbitrary code with root privileges. The flaw is rooted in CWE-426 (Untrusted Search Path) and CWE-829 (Improper Restriction of Operations). The vulnerability is limited to local access but results in complete control of the affected system because code can run as root. The description explicitly states that successful exploitation would elevate local user privileges to root, thereby compromising confidentiality, integrity and availability of all services on that host.

Checkmk GmbH’s Checkmk monitoring product is vulnerable when it runs version 2.5.0p14. The attack is limited to installations where the 'mk-oracle' plugin is enabled and the local machine has write access to the Oracle library path or to the 'oratab' file. No other vendor or product versions are listed as affected.

The CVSS score of 5.2 indicates a moderate severity. The EPSS score is not available, so the current scarcity of exploitation data cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, which means it is not known to be actively exploited in the wild as of the data snapshot. Because the flaw requires local administrative or write access to the Oracle library directory or the oratab file, the attack surface is fairly narrow; however once accessed, the attacker can gain root privileges and run arbitrary code, making the risk significant for any system with exposed local users.