CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.
Affected products
arcserve: udp
References9
- documentation.arcserve.com/Arcserve-UDP/Available/V5/ENU/Booksh… Release NotesVendor Advisory
- documentation.arcserve.com/Arcserve-UDP/Available/V5/ENU/Booksh… Release NotesVendor Advisory
- www.securityfocus.com/bid/74845 Broken LinkThird Party AdvisoryVDB Entry
- www.zerodayinitiative.com/advisories/ZDI-15-241/ Third Party AdvisoryVDB Entry
- www.zerodayinitiative.com/advisories/ZDI-15-242/ Third Party AdvisoryVDB Entry
- www.securityfocus.com/bid/74845 Broken LinkThird Party AdvisoryVDB Entry
- www.zerodayinitiative.com/advisories/ZDI-15-241/ Third Party AdvisoryVDB Entry
- www.zerodayinitiative.com/advisories/ZDI-15-242/ Third Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… US Government Resource
Metrics
- CVSS 3.1
-
9.1
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - EPSS — exploit probability
- 64% percentile: 99 · as of 2 November 2026
- CWE
- CWE-22