CVE-2023-41999: Arcserve UDP

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that allows them to authenticate to the management console and perform tasks that require authentication.

Affected products

• Arcserve UDP: before 9.2 (fixed in 9.2)

Published 2023-11-27. Last modified 2026-06-17.