CVE-2023-26258

CRITICAL 9.8CVE-2023-26258 · Published 03/07/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
udp arcserve	`≤ 9.0.6034`	No fix yet

Description

Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute any task as administrator.

References

support.arcserve.com/s/article/KB000015720
arcserve.com/products/arcserve-udp · Product
mdsec.co.uk/2023/06/cve-2023-26258-remote-code-execution-in-arcserve-udp-backup · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free