CVE-2026-27788

Local Authenticated Privilege Escalation via Improper Permission Assignment in ServerView Agents

Published Jun 1, 2026 CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Description

Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerability is exploited, a local authenticated attacker who can log in to the server where the affected product is installed may obtain SYSTEM privilege.

Analysis

Technical impact

The ServerView Agents for Windows contain an incorrect permission assignment for a critical resource that allows a local authenticated attacker to elevate privileges to SYSTEM. This constitutes an access‑control flaw (CWE‑732) that can give an attacker full control of the target server, enabling tampering, data exfiltration, and persistence operations.

Affected Systems

The vulnerability affects Fsas Technologies Inc.’s ServerView Agents for Windows version V11.60.04 and all earlier releases.

Risk and Exploitability

The CVSS score of 8.5 indicates a high severity vulnerability, and although an EPSS score is not available, the attack requires only local authentication and can be performed on any server where the agent is installed. As the vulnerability is not listed in the CISA KEV catalog, zero‑day risk is currently unknown, yet the impact of achieving SYSTEM level remains critical.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Fsas Technologies Inc.

ServerView Agents for Windows

affected

Version	Status	Constraints
`V11.60.04 and earlier`	affected	—

No data.

Vendor Product Versions

Fsastech

Serverview Agents For Windows

Version	Status	Scheme	Platform
`[0,V11.60.04]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest official patch for ServerView Agents for Windows, as detailed in the FSAS advisory at https://www.fsastech.com/ja-jp/resources/security/2026/0529.html
If an immediate patch is unavailable, restrict the account and service permissions used by the agent to the minimum required, removing unnecessary SYSTEM or administrative rights
Perform a system audit to verify that no privileged processes are running under the agent’s service account and that the service is not configured to run with SYSTEM privileges

Generated by OpenCVE AI on June 1, 2026 at 11:22 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.097% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://jvn.jp/en/jp/JVN67883085/
https://www.fsastech.com/ja-jp/resources/security/2026/0529.html

History

Jun 3, 2026 2:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Fsastech Fsastech serverview Agents For Windows
Vendors & Products		Fsastech Fsastech serverview Agents For Windows

Jun 1, 2026 1:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 1, 2026 11:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		Local Authenticated Privilege Escalation via Improper Permission Assignment in ServerView Agents

Jun 1, 2026 9:15 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerability is exploited, a local authenticated attacker who can log in to the server where the affected product is installed may obtain SYSTEM privilege.
Weaknesses		CWE-732
References		https://jvn.jp/en/jp/JVN67883085/ https://www.fsastech.com/ja-jp/resources/security/2026/0529.html
Metrics		cvssV3_0 `{'score': 7.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`