CVE-2014-9113: CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak permissions (Auth...

Security readout for executives and security teams

This is a local privilege escalation in CCH Wolters Kluwer ProSystem fx Engagement 7.1 and earlier. Weak file permissions let an authenticated local user replace service-related files and potentially gain LocalSystem control. It matters most on shared workstations, terminal servers, or compromised endpoints running the software. Exposure is limited to systems running CCH Wolters Kluwer ProSystem fx Engagement, also called PFX Engagement, version 7.1 or earlier. The vulnerability requires local authenticated access, so risk increases where many users share the host or where attackers may already have low-privilege access. Prioritize remediation on shared or sensitive finance/accounting systems because successful exploitation can turn ordinary local access into full system control. If the software is no longer supported, treat replacement or isolation as the practical risk-reduction path. Mitigation focus: Inventory hosts for ProSystem fx Engagement or PFX Engagement 7.1 and earlier.; Check Wolters Kluwer guidance for supported fixed versions or vendor-approved remediation.; Remove Authenticated Users Modify/Write access from affected service files where vendor-supported..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.