SAProuter CVE-2026-0487

Exploitation requires local ability to place a malicious DLL in a location that the Windows SAProuter process searches when resolving a library by name (CWE-427), and that SAProuter subsequently load that library (typically at process start or restart). Per the CVSS vector no in-application authentication (PR:N) and no user interaction (UI:N) are needed, but the AV:L attack vector limits this to attackers who already have local access or control over a writable directory in the DLL search path - it is not remotely exploitable over the network against a default install. Limiting factors: the attacker needs an appropriately writable/search-order-favorable directory and a service load/restart event; a properly ACL'd installation directory and correct DLL search order substantially reduce feasibility.

The signals are mixed and should be read together rather than off the headline score. The CVSS 8.4 is driven by AV:L (local attack vector) combined with PR:N/UI:N and C:H/I:H/A:H - meaning that once an attacker can influence the DLL search path locally, no authentication or user interaction is needed and impact is total. The description's phrase 'unauthenticated attacker' is consistent with PR:N but must be read alongside AV:L: this is not a remote, over-the-network drive-by; it requires local ability to place a DLL in a location SAProuter searches, which in practice implies existing local access or a writable directory in the search path. No EPSS score, no KEV listing, and no POC were provided, so real-world exploitation pressure appears low today and any exploitation would be targeted rather than mass/automated. SSVC-style reading: exploitation = none observed, technical impact = total, automatable = likely no (local prerequisite). Net: a genuine high-severity issue for hosts where untrusted local write access is plausible, but the local vector meaningfully constrains it below a remotely-wormable critical.

An attacker who already has a foothold on the SAProuter host - or who can write to a directory in SAProuter's DLL search path - drops a malicious DLL using the name of a library SAProuter loads. When the SAProuter process starts or reloads and resolves that library by name, it loads the attacker's DLL instead of the legitimate one, executing arbitrary code in the process context; no public exploit code has been identified, and the AV:L/AC:L profile means the technique is straightforward once local write access is obtained.