CVE-2023-26258: Arcserve UDP

Critical severity, CVSS 9.8. EPSS: 39.8% chance of exploitation in the next 30 days.

Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute any task as administrator.

Affected products

• Arcserve UDP: up to and including 9.0.6034

Published 2023-07-03. Last modified 2026-06-17.