CVE-2023-37244 is a TOCTOU race condition in the N-able Automation Manager agent for Windows. The NVD record scores it medium (5.3), while Mandiant rates it 8.8. N-able fixed it in version 2.91.0.0, so check your agent version and upgrade the agent.
What's affected
- Product: N-able AutomationManager Agent for Windows, the AutomationManager.AgentService.exe service.
- Affected versions: 2.80.0.1 and earlier, per the Mandiant disclosure.
- Fixed version: 2.91.0.0. The record says upgrade to that version, and Mandiant's timeline shows the fix shipped on 8 September 2023 after the report on 26 June 2023.
- Severity, two views: the record gives CVSS 5.3 (Medium). The Mandiant disclosure lists CVSS 8.8 (High). Both are stated here because they disagree.
- Exploited in the wild: the record's CISA KEV flag is false.
The record describes a race condition between a check and a use of a file path. Mandiant's write-up says a local, unprivileged user can influence the service so that it performs arbitrary file deletions, and that this can lead to privilege escalation to SYSTEM.
How to check if you're exposed
This affects Windows machines that run the Automation Manager agent. Check the installed agent version in Programs and Features, or read the file version of the service executable:
Get-Package | Where-Object Name -like "*Automation*" | Select-Object Name, Version
If the package name differs on your systems, find the AutomationManager.AgentService.exe file and read its version in file properties. Anything at or below 2.80.0.1 is affected, and 2.91.0.0 is the fixed build.
It is a local issue, so the machines of most concern are shared systems such as terminal servers, where many standard users can sign in.
What to do now
- Find the machines running the Automation Manager agent, using your remote monitoring and management console or software inventory.
- Upgrade the agent to 2.91.0.0 or later.
- Prioritise shared and multi-user Windows hosts, where a standard user account is easy to obtain.
- Limit who can sign in locally to servers that run the agent.
- Confirm the new version after the rollout and keep the agent on a regular update cycle.
Why it matters
The weakness class is CWE-362, a race condition. The service checks something about a location, and then acts on it a moment later. If a lower-privileged user can change what the location points to in between, the service acts on the wrong target with its own higher privileges.
This is why the two scores differ so much. The record's vector rates network reach with high complexity and a confidentiality-only impact, which gives a medium score. Mandiant, who found it, describes a local path to SYSTEM. The practical read: if standard users can log in to the machine, treat it as a high priority patch. If only administrators ever do, urgency is lower.
Safeguard can help with the inventory side of this work. The free in-browser dependency scan at gold.safeguard.sh/scan checks the packages in a manifest against known CVEs, and the Gold directory keeps a page per CVE and per weakness class so you can see related issues in one place. Reachability analysis then helps you separate a package that is merely present from one your code actually calls.
Quick check
Which severity is correct, medium or high?
They come from different sources. The NVD record gives CVSS 5.3 (Medium) and Mandiant lists 8.8 (High). Plan around your own exposure: multi-user Windows hosts deserve the faster patch.
Which version fixes it?
Version 2.91.0.0, released on 8 September 2023 according to the Mandiant disclosure.
Sources
Last reviewed: 19 October 2026.
