CVE-2025-39666
Published: 07 April 2026
Summary
CVE-2025-39666 is a critical-severity Untrusted Search Path (CWE-426) vulnerability in Checkmk Checkmk. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-5 (Access Restrictions for Change).
Deeper analysis
CVE-2025-39666 is a local privilege escalation vulnerability affecting Checkmk versions 2.2.0 (end-of-life), 2.3.0 prior to 2.3.0p46, 2.4.0 prior to 2.4.0p25, and 2.5.0 (beta) prior to 2.5.0b3. It stems from CWE-426 (Untrusted Search Path) and CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), enabling a site user to manipulate files within the site context. These files are subsequently processed by the `omd` administrative command executed with root privileges, allowing unauthorized escalation.
An attacker with local access and low privileges (PR:L), such as a site user, can exploit this vulnerability with low attack complexity (AC:L) but requires user interaction (UI:R). Successful exploitation grants root-level access (C:H/I:H/A:H), as indicated by the CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H). No remote access is needed, limiting the attack surface to compromised local accounts.
The Checkmk advisory at https://checkmk.com/werk/18891 details mitigation through patching: upgrade to Checkmk 2.3.0p46 or later, 2.4.0p25 or later, or 2.5.0b3 or later for beta users. Checkmk 2.2.0 users should migrate off the EOL version, as no patches are available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209262
Vulnerability details
Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows a site user to escalate their privileges to root, by manipulating files in the site context that are…
more
processed when the `omd` administrative command is run by root.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local untrusted search path (CWE-426) in root-run omd command directly enables privilege escalation via search-order hijacking of files manipulated by low-privileged site user.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the privilege escalation by requiring timely patching of vulnerable Checkmk versions to versions where manipulated site files no longer lead to root escalation.
Enforces least privilege to prevent site users from having write access to files in the site context processed by the root-privileged omd command.
Restricts changes to files within the site context that are processed by administrative root commands, preventing manipulation by low-privileged users.