Local Privilege Escalation in Check Point Identity Agent Full for Windows

Successful exploitation allows an authenticated local attacker to elevate privileges from a normal user context to NT AUTHORITY\SYSTEM on the affected Windows host. This enables arbitrary code execution with the highest local privileges, which can lead to full compromise of the endpoint, installation of persistent malware, disabling or tampering with security controls, credential theft, access to sensitive local data, and use of the host for further lateral movement.

If immediate patching is not possible, reduce exposure by limiting local interactive access to trusted users only, restricting the ability of non-administrative users to place or modify executables in locations that could be resolved by privileged processes, monitoring for suspicious child-process creation or unexpected executable launches associated with the Identity Agent log collection workflow, and applying the mitigations recommended by Check Point in its advisory. Specific vendor-prescribed mitigations were not provided in the supplied content.

Upgrade Check Point Identity Agent to version 81.087.0000 or later, as versions prior to 81.087.0000 are identified as affected. Review and apply the vendor guidance in Check Point's advisory and response document for CVE-2026-10847.