Cyber Resilience

CVE-2026-35099

High

Published: 01 April 2026

Published
01 April 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score v3.1 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0001 0.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-35099 is a high-severity Race Condition (CWE-362) vulnerability in Lakesidesoftware (inferred from references). Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-35099 is a race condition vulnerability (CWE-362) affecting Lakeside SysTrack Agent versions 11 before 11.5.0.15. This flaw enables local privilege escalation to SYSTEM privileges and carries a CVSS v3.1 base score of 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on 2026-04-01.

A local attacker can exploit this race condition to achieve privilege escalation from an unprivileged context to SYSTEM level. No prior privileges or user interaction are required, though exploitation demands high attack complexity due to the timing-sensitive nature of the race condition. Successful exploitation grants high-impact control over confidentiality, integrity, and availability.

Mitigation requires upgrading to one of the fixed releases: 11.2.1.28, 11.3.0.38, 11.4.0.24, or 11.5.0.15. Lakeside Software provides details in the corresponding hotfix Agent release notes, accessible at the referenced documentation URLs.

EU & UK References

Vulnerability details

Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM. The fixed versions are 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Race condition in SysTrack Agent directly enables local privilege escalation to SYSTEM (T1068: Exploitation for Privilege Escalation).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-8520Shared CWE-362
CVE-2025-68960Shared CWE-362
CVE-2026-21231Shared CWE-362
CVE-2026-20921Shared CWE-362
CVE-2026-34334Shared CWE-362
CVE-2024-40849Shared CWE-362
CVE-2026-34351Shared CWE-362
CVE-2025-48577Shared CWE-362
CVE-2026-23169Shared CWE-362
CVE-2026-7948Shared CWE-362

Affected Assets

Lakesidesoftware
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly addresses the CVE by requiring identification, reporting, and correction of the race condition flaw through timely patching to fixed SysTrack Agent versions.

detect

Supports prevention by enabling vulnerability scanning to identify systems running vulnerable Lakeside SysTrack Agent versions prior to exploitation.

prevent

Mitigates impact of local privilege escalation by enforcing least privilege on users and processes, limiting damage even if the race condition succeeds.

References