The Icinga 2 MSI installer for Windows sets incorrect ACLs on the %ProgramData%\icinga2\var folder in versions before 2.13.14, 2.14.8, and 2.15.2. This misconfiguration allows any local user to read the folder’s contents, including the service’s private key and synchronized configuration. As a result, sensitive credentials and configuration data are exposed, potentially enabling an attacker to impersonate the monitoring service or tamper with monitoring information. The weakness is classified as CWE‑276.

All Windows installations of Icinga 2 running affected versions are vulnerable. Specifically, Icinga 2 versions earlier than 2.13.14, 2.14.8, or 2.15.2 have the misconfigured ACLs, as do Icinga for Windows packages older than v1.13.4, v1.12.4, or v1.11.2. The issue also extends to the PowerShell framework certificate directory used by the Windows agent.

The CVSS score of 6.8 indicates medium severity, while the EPSS score of less than 1 % suggests a low likelihood of commercial exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local user access; an attacker with local privileges can simply read the protected folder. Remote exploitation is not feasible without local access. In environments where local accounts have elevated privileges or where lateral movement is possible, the exposure of private keys could be critical.