CVE-2023-26258observed exploitation

CVE-2023-26258

Published · Updated

Follow this CVE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

72Vexday Risk Score

Patch now. It exploitation observed in the wild and has a working public exploit.

ssvc Actepss 40%
from disclosure to weaponsame day
Published on NVDJul 3
1st PoCJun 28
Observed exploitation+778d
Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute any task as administrator.
Affected products
n/a · n/a