CVE-2026-35099

HighCVSS 7.4/10Last modified Oct 26, 2026

Description

Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM. The fixed versions are 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
Lakeside Software	SysTrack Agent	>= 11, < 11.2.1.28; >= 11.3, < 11.3.0.38; >= 11.4, < 11.4.0.24; >= 11.5, < 11.5.0.15

References

Timeline

Published: Apr 1, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-351024.7HCL AION is affected by an open redirect vulnerability in the navigation bar of the GenAI web interface (Navbar component). The switch-versi CVE-2026-351034.7HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending component). The redirect to th CVE-2026-351044.7HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component). The redirect performed after regist CVE-2026-351054.7HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line CVE-2026-351064.7HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line CVE-2026-351074.7HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component). The redirect to the CVE-2026-351093.7HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies. Sensitive info CVE-2026-35118.6Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthentic CVE-2026-351105.4HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted ove CVE-2026-351114.8HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application r CVE-2026-351124.2HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-orig CVE-2026-351134.8HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin do