CVE-2025-32919 Privilege Escalation in Windows License plugin for Checkmk Windows Agent

What is CVE-2025-32919?

CVE-2025-32919 is a high-severity vulnerability in Checkmk Checkmk, published on 9 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Use of an insecure temporary directory in the Windows License plugin for the Checkmk Windows Agent allows Privilege Escalation. This issue affects Checkmk: from 2.4.0 before 2.4.0p13, from 2.3.0 before 2.3.0p38, from 2.2.0 before 2.2.0p46, and all versions of 2.1.0 (EOL).

Weakness: CWE-427

Which versions are affected by CVE-2025-32919?

It affects 1 product.

Products include Checkmk Checkmk.

How do I fix CVE-2025-32919?

No fix has been published for CVE-2025-32919 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-32919 being exploited?

There is no known exploitation of CVE-2025-32919 in the wild and no public exploit code.

Other vulnerabilities in Checkmk Checkmk

• CVE-2025-39666 omd: Local privilege escalation when executing omd commands as root Critical 9.3
• CVE-2024-8606 Fix 2FA bypass via RestAPI Critical 9.2
• CVE-2022-46836 PHP code injection in watolib Critical 9.1
• CVE-2024-28827 Privilege escalation in Windows agent High 8.8
• CVE-2024-28828 1-Click compromize via CSRF High 8.8

All Checkmk Checkmk vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qrq7-92h2-m9mx.