CVE-2026-35099

HIGH

MEDIUM Priority: 0.01 BB Relevance: 40/100

Published: 2026-04-01 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local

AC: High

PR: None

UI: None

S: Unchanged

C: High

I: High

A: High

Description

Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM. The fixed versions are 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15.

Weakness Classification (1)

CWE-362

References & Advisories (4)

https://documentation.lakesidesoftware.com/en/Content/Release%20Notes/Agent/11.2.1.28%20Hotfix%20Agent%20Release%20Notes.htm?tocpath=Release%20Notes%7CAgent%7C_____8

https://documentation.lakesidesoftware.com/en/Content/Release%20Notes/Agent/11_3_xxx%20Hotfix%20Agent%20Release%20Notes.htm?tocpath=Release%20Notes%7CAgent%7C_____6

https://documentation.lakesidesoftware.com/en/Content/Release%20Notes/Agent/11_4_xxx%20Hotfix%20Agent%20Release%20Notes.htm?tocpath=Release%20Notes%7CAgent%7C_____4

https://documentation.lakesidesoftware.com/en/Content/Release%20Notes/Agent/11_5_xxx%20Hotfix%20Agent%20Release%20Notes.htm?tocpath=Release%20Notes%7CAgent%7C_____2

Bug Bounty Relevance

40 / 100

✓ No authentication
✓ No user interaction

CVSS Score

7.4 / 10.0 v3.1

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.13%

Raw Score 0.001300

Percentile 2.6%

Date 2026-10-29

EPSS Trend

2026-10-29

0.00130

2026-10-28

0.00125

Intelligence Sources

nvd ref →

External Links

NVD (NIST) CVE Details FIRST EPSS API OSV.dev