runZero Platform superuser privilege escalation

The primary impact of CVE-2026-5373 is the potential for unauthorized access and control within the runZero Platform. An attacker, posing as an all-organization administrator, could exploit this vulnerability to promote any account to superuser status. This grants them complete administrative privileges, enabling them to modify configurations, access sensitive data, and potentially compromise the entire environment. The blast radius extends to any data or systems managed by the runZero Platform, as a superuser has unrestricted access. This vulnerability highlights a critical failure in privilege management, allowing for significant lateral movement within the platform.

Organizations heavily reliant on runZero Platform for asset discovery and management are at significant risk. Specifically, deployments with a large number of all-organization administrators or those lacking robust access control policies are particularly vulnerable. Shared hosting environments utilizing runZero also pose an increased risk due to potential cross-tenant access.

1. 2026-04-07Disclosure

   disclosure

1. Reserviert2026-04-01
2. Veröffentlicht2026-04-07
3. EPSS aktualisiert2026-04-15

The primary mitigation for CVE-2026-5373 is to immediately upgrade the runZero Platform to version 4.0.260202.0 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing stricter access controls and multi-factor authentication for all administrator accounts to limit the potential impact of a compromised account. Regularly review user permissions and audit logs for any suspicious activity. While a WAF or proxy cannot directly mitigate this vulnerability, they can help detect and block malicious requests attempting to exploit it.