CVE-2026-35099

Race Condition in Lakeside SysTrack Agent Enables Local Privilege Escalation

Published Apr 1, 2026 CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Description

Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM. The fixed versions are 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15.

Analysis

Technical impact

A race condition exists within Lakeside SysTrack Agent that allows a local attacker to elevate privileges to the SYSTEM account. The flaw arises from a concurrency error (CWE-362) where timing inconsistencies in the agent’s internal operations can be exploited to gain full control over the host, execute arbitrary code, and compromise the entire system.

Affected Systems

The vulnerability affects all instances of Lakeside Software’s SysTrack Agent versions earlier than 11.5.0.15. Fixed releases are 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15; any system running an earlier version remains exposed.

Risk and Exploitability

The CVSS score of 7.4 indicates high severity for users with local access, and EPSS data is not available. The flaw is not listed in major known exploited vulnerabilities catalogs. Attackers would need local presence to trigger the race condition in the agent service, which runs with SYSTEM privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Lakeside Software

SysTrack Agent

unaffected

Version	Status	Constraints
`11`	affected	< 11.2.1.28
`11.3`	affected	< 11.3.0.38
`11.4`	affected	< 11.4.0.24
`11.5`	affected	< 11.5.0.15

No data.

Vendor Product Versions

Lakesidesoftware

Systrack Agent

Version	Status	Scheme	Platform
`[11,11.2.1.28)`	affected	generic	—
`[11.3,11.3.0.38)`	affected	generic	—
`[11.4,11.4.0.24)`	affected	generic	—
`[11.5,11.5.0.15)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade SysTrack Agent to version 11.5.0.15 or later
Verify that the agent service runs with the least privilege necessary
Monitor event logs for unexpected privilege escalation activity
If an upgrade cannot be performed immediately, temporarily disable the agent service until the fix is applied

Generated by OpenCVE AI on April 2, 2026 at 05:11 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.130% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://documentation.lakesidesoftware.com/en/Content/Release%20Notes/Agent/11.2.1.28%20Hotfix%20Agent%20Release%20Notes.htm?tocpath=Release%20Notes%7CAgent%7C_____8
https://documentation.lakesidesoftware.com/en/Content/Release%20Notes/Agent/11_3_xxx%20Hotfix%20Agent%20Release%20Notes.htm?tocpath=Release%20Notes%7CAgent%7C_____6
https://documentation.lakesidesoftware.com/en/Content/Release%20Notes/Agent/11_4_xxx%20Hotfix%20Agent%20Release%20Notes.htm?tocpath=Release%20Notes%7CAgent%7C_____4
https://documentation.lakesidesoftware.com/en/Content/Release%20Notes/Agent/11_5_xxx%20Hotfix%20Agent%20Release%20Notes.htm?tocpath=Release%20Notes%7CAgent%7C_____2

History

Apr 2, 2026 8:30 PM Title updated. First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
Title		Race Condition in Lakeside SysTrack Agent Enables Local Privilege Escalation
First Time appeared		Lakesidesoftware Lakesidesoftware systrack Agent
Vendors & Products		Lakesidesoftware Lakesidesoftware systrack Agent

Apr 1, 2026 11:45 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM. The fixed versions are 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15.
Weaknesses		CWE-362
References		https://documentation.lakesidesoftware.com/en/Content/Release%20Notes/Agent/11.2.1.28%20Hotfix%20Agent%20Release%20Notes.htm?tocpath=Release%20Notes%7CAgent%7C_____8 https://documentation.lakesidesoftware.com/en/Content/Release%20Notes/Agent/11_3_xxx%20Hotfix%20Agent%20Release%20Notes.htm?tocpath=Release%20Notes%7CAgent%7C_____6 https://documentation.lakesidesoftware.com/en/Content/Release%20Notes/Agent/11_4_xxx%20Hotfix%20Agent%20Release%20Notes.htm?tocpath=Release%20Notes%7CAgent%7C_____4 https://documentation.lakesidesoftware.com/en/Content/Release%20Notes/Agent/11_5_xxx%20Hotfix%20Agent%20Release%20Notes.htm?tocpath=Release%20Notes%7CAgent%7C_____2
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`