CVE-2018-18659

An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-19 Unauthenticated XXE in /management/UdpHttpService issue.

• CWE-611

• https://support.arcserve.com/s/article/360001392563?language=en_USPatch, Vendor Advisory
• https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UDP-and-fixes-for-them?language=en_USPatch, Vendor Advisory
• https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/152033Third Party Advisory
• https://support.arcserve.com/s/article/360001392563?language=en_USPatch, Vendor Advisory
• https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UDP-and-fixes-for-them?language=en_USPatch, Vendor Advisory
• https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/Third Party Advisory

Published

Oct 26, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-18653The Linux kernel, as used in Ubuntu 18.10 and when booted wi…
• CVE-2018-18654Crossroads 2.81 does not properly handle the /tmp directory …
• CVE-2018-18655Prayer through 1.3.5 sends a Referer header, containing a us…
• CVE-2018-18656The PureVPN client before 6.1.0 for Windows stores Login Cre…
• CVE-2018-18657An issue was discovered in Arcserve Unified Data Protection …
• CVE-2018-18658An issue was discovered in Arcserve Unified Data Protection …
• CVE-2018-18660An issue was discovered in Arcserve Unified Data Protection …6.1
• CVE-2018-18661An issue was discovered in LibTIFF 4.0.9. There is a NULL po…
• CVE-2018-18662There is an out-of-bounds read in fz_run_t3_glyph in fitz/fo…
• CVE-2018-18665The mintToken function of Nexxus (NXX) aka NexxusToken, an E…
• CVE-2018-18666The mintToken function of SwftCoin (SWFTC) aka SwftCoin, an …
• CVE-2018-18667The mintToken function of Pylon (PYLNT) aka PylonToken, an E…