Netdata's Windows Agent MSI repair function is intended to maintain package integrity, but from version 2.0.0 through 2.10.4 it launches powershell.exe and wevtutil.exe as elevated interactive processes within the user’s desktop session. A local user with low privileges who triggers a repair can interact with those visible process windows or hijack them, allowing the execution of arbitrary commands with SYSTEM privileges. The flaw enables a local privilege escalation attack against the host running the Netdata agent.

Vendors affected are Netdata, specifically the Netdata Windows Agent component. The vulnerability applies to installations of Netdata version 2.0.0 up to but not including 2.10.4. Users running those versions of the agent on Windows systems are at risk until they update to a fixed release.

The CVSS score for this issue is 7, indicating high severity, while the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a local user who can trigger the MSI repair process; such a user can then manipulate the elevated PowerShell or wevtutil windows to run arbitrary commands as SYSTEM. Exploitation requires no external network access and does not depend on a complex chain of events, so the practical risk remains significant for environments where the vulnerable Netdata installer is in use.