[Non-public] Privilege escalation vulnerability in Safetica Client for Windows (on-premises only)

Vulnerability overview

Safetica identified a local privilege escalation vulnerability in Safetica Client for Windows that can be exploited by manipulating the OpenSSL configuration file (openssl.cnf). 

• Severity (CVSS score): 7.8
• Exploitability: local only (cannot be exploited remotely)
• Affected deployments: Safetica On-Prem only
• Cloud-hosted Safetica: Not affected

What an attacker could achieve

If a non-admin user is able to manipulate openssl.cnf in the affected environment, they may be able to escalate privileges locally on the device.

✅ Recommended remediation

We strongly recommend updating to one of the fixed Safetica versions as soon as possible, preferably to the latest Cumulative release.

Temporary mitigation for environments where updating is not possible

If updating to one of the fixed Safetica versions is currently not possible, you can apply a temporary workaround to reduce the risk of exploitation related to OpenSSL configuration file manipulation (openssl.cnf).

What the workaround does

Safetica provides a batch script that must be executed with administrative privileges on all devices running the Safetica Client for Windows (Safetica on-premises only). The script:

• Creates a folder C:\TFS-Git.
• Removes access rights for non-administrative users to that folder.

This prevents non-admin users from exploiting the issue through manipulation of the OpenSSL configuration file (openssl.cnf).

Workaround prerequisites

• Download the Safetica-provided batch script here.
• Local administrator rights on devices (for manual execution) or a central management mechanism that runs scripts with elevated privileges (for remote execution).

Workaround procedure

Option 1: Run locally on a device (manual)

1. Obtain the batch script provided by Safetica.
2. Copy the script to the device.
3. Right-click the script and select Run as administrator.

Option 2: Deploy remotely (recommended for centrally managed environments)

For centrally managed environments, we recommend executing the script remotely, for example via Group Policy (GPO) or another endpoint management solution.

Next steps

• Plan and perform an update to one of the fixed Safetica versions when feasible.
• Keep this workaround in place only as long as needed to bridge the update gap. 

Affected and fixed Safetica versions

The fix is already available in the following Safetica versions.

There are two options for updating: 

• We recommend updating via the XML. Learn how to perform the update here. 

• To update via the Universal Installer, run the installer, select Manual installation, and choose to install Safetica Management Service. 

✅ Recommended: Cumulative release 11.26.19

If you are using a Feature release - Update to 11.29.8 

If you are still using Safetica 10.5.x - Update to 10.5.150: