Security Fix for Privilege Manager on Windows
CapaOne Agent 1.2.207 for Windows fixes a local privilege escalation vulnerability in Privilege Manager (formerly AdminOnDemand). The fix was released on July 6, 2026, and existing agents update to it automatically.
Vulnerability details
Section titled “Vulnerability details”| Type | Missing authorization (CWE-862) |
| Severity | CVSS 3.1 base score 7.8, High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) |
| CVE ID | Pending |
| Affected | CapaOne Agent for Windows, versions earlier than 1.2.207 |
| Fixed | CapaOne Agent for Windows 1.2.207 |
The Privilege Manager component of the CapaOne Agent didn’t perform server-side authorization checks
on messages sent to the \\.\pipe\CapaOnePipe named pipe. An authenticated local user without
administrator rights could send a crafted message to the pipe and add themselves to the local
Administrators group. This bypassed the Privilege Manager policy validation and approval workflow.
What you need to do
Section titled “What you need to do”Make sure your Windows endpoints run CapaOne Agent 1.2.207 or later. Agents update automatically, so endpoints that have been online since July 6, 2026 already have the fix.
Credits
Section titled “Credits”The vulnerability was reported through responsible disclosure by Filip Magic and Christoffer Olsen of the TDC NET Security Testing & Advisory team.