CVE-2016-0916

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-06-10 · updated 2026-06-17
Weakness: CWE-287

Description

EMC NetWorker 8.2.1.x and 8.2.2.x before 8.2.2.6 and 9.x before 9.0.0.6 mishandles authentication, which allows remote attackers to execute arbitrary commands by leveraging access to a different NetWorker instance.

Affected products

EMC NetWorker prior to 8.2.4.9, 9.0.x (all supported versions), prior to 9.1.1.3, prior to 9.2.0.4: from 8.2.1.0 through 8.2.1.8; from 8.2.2.0 before 8.2.2.6; from 9.0.0.0 before 9.0.0.6 — fixed in 8.2.2.6, 9.0.0.6

How to fix

Upgrade to a fixed version: EMC NetWorker prior to 8.2.4.9, 9.0.x (all supported versions), prior to 9.1.1.3, prior to 9.2.0.4 8.2.2.6, 9.0.0.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2016-0916 or the next vulnerability affects your stack