What’s Vulnerable › Vulnerabilities

CVE-2023-26258

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 40.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-07-03 · updated 2026-06-17
• Weakness: CWE-863

Description

Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute any task as administrator.

Affected products

• Arcserve Unified Data Protection (UDP): through 9.0.6034

References

• https://support.arcserve.com/s/article/KB000015720?language=en_US
• https://www.arcserve.com/products/arcserve-udp
• https://www.mdsec.co.uk/2023/06/cve-2023-26258-remote-code-execution-in-arcserve-udp-backup/
• https://support.arcserve.com/s/article/KB000015720?language=en_US
• https://www.arcserve.com/products/arcserve-udp
• https://www.mdsec.co.uk/2023/06/cve-2023-26258-remote-code-execution-in-arcserve-udp-backup/

Get alerted when CVE-2023-26258 or the next vulnerability affects your stack