Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-117372. PoCs published by NF.
AI-analyzed exploit summary This PowerShell script exploits a privilege escalation vulnerability in Kaseya VSA agent <= 9.5 by monitoring the default working directory for script files and appending malicious code to them before execution, leveraging excessive permissions granted to low-privileged users.
Description
Kaseya VSA agent 9.5 - Privilege Escalation
Exploits (1)
exploitdb
WORKING POC
by NF · textlocalwindows
https://www.exploit-db.com/exploits/47341
This PowerShell script exploits a privilege escalation vulnerability in Kaseya VSA agent <= 9.5 by monitoring the default working directory for script files and appending malicious code to them before execution, leveraging excessive permissions granted to low-privileged users.
Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target:
Kaseya VSA agent <= 9.5
Auth required
Prerequisites:
Authenticated access to the system · Kaseya VSA agent installed and running · Default folder permissions on C:\kworking
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026