CVE-2026-35099
Published: 01 April 2026
Summary
CVE-2026-35099 is a high-severity Race Condition (CWE-362) vulnerability in Lakesidesoftware (inferred from references). Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-35099 is a race condition vulnerability (CWE-362) affecting Lakeside SysTrack Agent versions 11 before 11.5.0.15. This flaw enables local privilege escalation to SYSTEM privileges and carries a CVSS v3.1 base score of 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on 2026-04-01.
A local attacker can exploit this race condition to achieve privilege escalation from an unprivileged context to SYSTEM level. No prior privileges or user interaction are required, though exploitation demands high attack complexity due to the timing-sensitive nature of the race condition. Successful exploitation grants high-impact control over confidentiality, integrity, and availability.
Mitigation requires upgrading to one of the fixed releases: 11.2.1.28, 11.3.0.38, 11.4.0.24, or 11.5.0.15. Lakeside Software provides details in the corresponding hotfix Agent release notes, accessible at the referenced documentation URLs.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17917
Vulnerability details
Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM. The fixed versions are 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Race condition in SysTrack Agent directly enables local privilege escalation to SYSTEM (T1068: Exploitation for Privilege Escalation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring identification, reporting, and correction of the race condition flaw through timely patching to fixed SysTrack Agent versions.
Supports prevention by enabling vulnerability scanning to identify systems running vulnerable Lakeside SysTrack Agent versions prior to exploitation.
Mitigates impact of local privilege escalation by enforcing least privilege on users and processes, limiting damage even if the race condition succeeds.