CVE-2022-23511: Privilege Escalation Vector in Amazon CloudWatch Agent for Windows
Summary
CVE-2022-23511: Amazon CloudWatch Agent for Windows has Privilege Escalation Vector in github.com/aws/amazon-cloudwatch-agent. Affects github.com/aws/amazon-cloudwatch-agent versions < 1.247355.0. Fixed in 1.247355.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Amazon CloudWatch Agent for Windows is a component of the Amazon CloudWatch service that allows users to collect and monitor system and application logs on Windows instances. It provides a unified interface for collecting custom metrics, logs, and system-level metrics from Windows servers. The agent is written in Go and is widely used in various applications and services.
Vulnerability Detail
The Amazon CloudWatch Agent for Windows is vulnerable to privilege escalation. This vulnerability allows an attacker to escalate their privileges and gain unauthorized access to sensitive system resources. The vulnerability originates from a flaw in the code of the agent, specifically in the github.com/aws/amazon-cloudwatch-agent package. Attackers can exploit this vulnerability to execute arbitrary code with elevated privileges, potentially leading to further compromise of the system and unauthorized access to sensitive data.
How To Fix
Latest published version: v1.3000030.2 as of 23 Oct 2026
go get github.com/aws/amazon-cloudwatch-agent@v1.3000030.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.247355.0
This is the first release that contains the fix.
go get github.com/aws/amazon-cloudwatch-agent@v1.247355.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is essential to update the agent to the latest version as soon as possible to mitigate the risk of privilege escalation.
Conclusion
The privilege escalation vector in the Amazon CloudWatch Agent for Windows poses a significant security risk, allowing attackers to gain unauthorized access to sensitive system resources. It is crucial to update the agent to the latest version to mitigate this vulnerability and ensure the security of the system.
See every vulnerability recorded for github.com/aws/amazon-cloudwatch-agent →
FAQ
This vulnerability allows attackers to escalate their privileges and gain unauthorized access to sensitive system resources. It can lead to further compromise of the system and unauthorized access to sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file.
Yes, a patch is available for this vulnerability. It is recommended to update the Amazon CloudWatch Agent for Windows to version 1.247355.0 or later.
There are currently no known exploits for this vulnerability. However, it is crucial to update the agent to the latest version to mitigate the risk.
No, this vulnerability cannot be exploited remotely. An attacker would need local access to the system to exploit this privilege escalation vector.
