CVE-2023-26258

Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute any task as administrator.

• CWE-863

• https://support.arcserve.com/s/article/KB000015720?language=en_US
• https://www.arcserve.com/products/arcserve-udpProduct
• https://www.mdsec.co.uk/2023/06/cve-2023-26258-remote-code-execution-in-arcserve-udp-backup/Exploit, Technical Description, Third Party Advisory
• https://support.arcserve.com/s/article/KB000015720?language=en_US
• https://www.arcserve.com/products/arcserve-udpProduct
• https://www.mdsec.co.uk/2023/06/cve-2023-26258-remote-code-execution-in-arcserve-udp-backup/Exploit, Technical Description, Third Party Advisory

Published

Jul 3, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26249Knot Resolver before 5.6.0 enables attackers to consume its …7.5
• CVE-2023-2625A vulnerability exists that can be exploited by an authentic…8
• CVE-2023-26253In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/sr…7.5
• CVE-2023-26255An unauthenticated path traversal vulnerability affects the …7.5
• CVE-2023-26256An unauthenticated path traversal vulnerability affects the …7.5
• CVE-2023-26257An issue was discovered in the Connected Vehicle Systems All…7.5
• CVE-2023-2626There exists an authentication bypass vulnerability in OpenT…8.8
• CVE-2023-26260OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows …5.4
• CVE-2023-26261In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath inje…9.8
• CVE-2023-26262An issue was discovered in Sitecore XP/XM 10.3. As an authen…7.2
• CVE-2023-26263All versions of Talend Data Catalog before 8.0-20230110 are …5.5
• CVE-2023-26264All versions of Talend Data Catalog before 8.0-20220907 are …5.5