Which versions of ArubaSign are affected by CVE-2026-12602?

ArubaSign versions prior to 4.6.6 contain a vulnerability allowing standard users to gain administrative control of affected Windows systems.. A patch is available.

How to fix or mitigate CVE-2026-12602?

24 hours: Identify all systems running ArubaSign prior to v4.6.6; prioritize systems with high-value data or sensitive access. 7 days: Restrict write permissions on C:\Program Files\ArubaSign to administrators only and enable file integrity monitoring on ArubaSign binaries. 30 days: Establish upgrade plan to ArubaSign v4.6.6 or later; coordinate with vendor for patch availability timeline.

ArubaSign CVE-2026-12602

Q: What is the CVSS score of CVE-2026-12602?

CVE-2026-12602 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-38230 HIGH

Incorrect Default Permissions (CWE-276)

2026-06-22 INCIBE

GHSA-58j4-vm73-hgvh

Privilege Escalation RCE Aruba Arubasign

8.8

CVSS 4.0 · Vendor: INCIBE

Severity by source

Vendor (INCIBE) PRIMARY

8.8 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Local attack by an authenticated low-priv user (AV:L/PR:L); requires a higher-privileged user to run the trojanized binary (UI:R); full CIA impact on the host once executed.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (INCIBE).

CVSS VectorVendor: INCIBE

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 22, 2026 - 15:02 EUVD

Analysis Generated

Jun 22, 2026 - 14:01 vuln.today

DescriptionCVE.org

Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assignment of inappropriate permissions during the software’s default installation, whereby the main executable and other programme files located in C:\Program Files have excessive permissions for the ‘Everyone’ group. This could allow an unprivileged user to replace the main executable and/or its components with a malicious file, thereby enabling the execution of arbitrary code. In the worst-case scenario, if the malicious code is executed with elevated privileges (such as those of Administrator or SYSTEM), the attacker could escalate privileges and gain full control of the system, compromising both security and data integrity.

AnalysisAI

Local privilege escalation in ArubaSign prior to v4.6.6 stems from overly permissive ACLs applied at installation, granting the 'Everyone' group write access to the main executable and supporting files under C:\Program Files. An unprivileged local user can swap these binaries for malicious payloads that subsequently execute under the privileges of any user (potentially Administrator or SYSTEM) who later launches the application. No public exploit identified at time of analysis and the issue is not on CISA KEV.

Technical ContextAI

ArubaSign is a Windows desktop digital signature client developed by Aruba (the Italian trust services provider). The flaw is a textbook CWE-276 (Incorrect Default Permissions) issue: the MSI/installer applies DACLs that grant the built-in 'Everyone' principal write/modify rights on files placed in the protected C:\Program Files directory, instead of inheriting the default restrictive ACL that limits writes to Administrators and SYSTEM. Because Windows resolves executables by path at launch time, any standard user can overwrite the on-disk binary and have their replacement run inside the next invoking user's security context - a classic 'trojanized binary' privilege escalation primitive.

RemediationAI

Vendor-released patch: ArubaSign v4.6.6 - upgrade all installations to this version or later, which corrects the installer ACLs. As an interim workaround on systems that cannot be upgraded immediately, administrators should manually tighten the DACL on the ArubaSign installation directory using icacls (e.g. remove the 'Everyone' (S-1-1-0) ACE and inherit the default Program Files ACL) and verify that only Administrators and SYSTEM retain modify rights on the executables; the trade-off is that the change may be reverted by an installer repair or auto-update, so the ACL hardening should be re-validated after any patch cycle. Refer to the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-permissions-arubasign-aruba for coordinator details.