CVE-2026-39118 describes a local privilege escalation vulnerability in the Kandji Agent software from Iru, Inc. The issue arises from insufficient client validation, which permits a local attacker to invoke restricted functionality of the agent, potentially leading to elevated privileges. The vulnerability affects versions prior to 4.7.5 (5374). There is no available CVSS score or detailed vendor advisory to clarify the scope or exploitation details. Patch status is not confirmed.

The vulnerability enables a local attacker to escalate privileges on the affected system by exploiting a validation gap in the Kandji Agent. This could allow unauthorized execution of restricted agent functions, potentially compromising system integrity or security controls managed by the agent. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for unusual activity related to the Kandji Agent. Avoid deploying untrusted code or scripts that could leverage this vulnerability.