# Security Fix for Privilege Manager on Windows

> CapaOne Agent 1.2.207 fixes a local privilege escalation vulnerability in Privilege Manager (formerly AdminOnDemand) on Windows.

Source: https://docs.capaone.com/capaone/reference/security-fix-for-privilege-manager-on-windows/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

CapaOne Agent 1.2.207 for Windows fixes a local privilege escalation vulnerability in Privilege
Manager (formerly AdminOnDemand). The fix was released on July 6, 2026, and existing agents update
to it automatically.

## Vulnerability details

| | |
|---|---|
| **Type** | Missing authorization (CWE-862) |
| **Severity** | CVSS 3.1 base score 7.8, High (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`) |
| **CVE ID** | Pending |
| **Affected** | CapaOne Agent for Windows, versions earlier than 1.2.207 |
| **Fixed** | CapaOne Agent for Windows 1.2.207 |

The Privilege Manager component of the CapaOne Agent didn't perform server-side authorization checks
on messages sent to the `\\.\pipe\CapaOnePipe` named pipe. An authenticated local user without
administrator rights could send a crafted message to the pipe and add themselves to the local
Administrators group. This bypassed the Privilege Manager policy validation and approval workflow.

## What you need to do

Make sure your Windows endpoints run CapaOne Agent 1.2.207 or later. Agents update automatically,
so endpoints that have been online since July 6, 2026 already have the fix.

## Credits

The vulnerability was reported through responsible disclosure by Filip Magic and Christoffer Olsen
of the TDC NET Security Testing & Advisory team.