EUVD-2026-38230
GHSA-58j4-vm73-hgvh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-priv local logon
-
DeliveryLocate ArubaSign install path
-
ExploitOverwrite executable with malicious binary
-
ExecutionWait for admin to launch ArubaSign
-
PersistPayload executes as Administrator/SYSTEM
-
ImpactEstablish persistence and full host control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Default permission hardening
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local interactive or remote-shell access to a Windows host with ArubaSign < 4.6.6 installed under C:\Program Files using the default installer-set ACLs (which grant 'Everyone' write access). Exploitation also requires a second, higher-privileged user (Administrator or SYSTEM) to subsequently launch the tampered binary - reflected by UI:P and AT:P in the CVSS 4.0 vector - so the flaw does not yield privilege escalation on single-user, never-elevated installations. The attacker needs no credentials or special configuration beyond a normal logon session; remote network exploitation is not possible (AV:L). |
| Impact | The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:P, base 8.8) accurately reflects a local attack that needs no prior privileges but does require a higher-privileged user to subsequently run the tampered binary (UI:P, AT:P). There is no EPSS score, KEV listing, or public PoC provided, so real-world exploitation pressure appears low and opportunistic rather than mass-exploited. The risk is concentrated in multi-user Windows endpoints - particularly shared workstations or terminal/RDS hosts - where a low-privileged user can plant a payload and wait for an administrator to launch ArubaSign; on single-user laptops the practical impact is much smaller. No conflicting signals were observed in the input, but absence of an EPSS value and the single-reference (INCIBE only) sourcing means exploitability data is thin. |
| Exploit ScenarioDerived | On a shared Windows workstation, a standard-user attacker overwrites C:\Program Files\ArubaSign\ArubaSign.exe with a malicious binary that drops a backdoor and then chain-loads the legitimate code. When a domain administrator later launches ArubaSign to sign a document, the planted payload executes in the admin's context, yielding SYSTEM-level control after a routine UAC elevation. No public exploit identified at time of analysis, but the technique is trivial and well-known for CWE-276 issues. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 22, 2026
Local privilege escalation in ArubaSign prior to v4.6.6 stems from overly permissive ACLs applied at installation, granting the 'Everyone' group write access to the main executable and supporting files under C:\Program Files. An unprivileged local user can swap these binaries for malicious payloads that subsequently execute under the privileges of any user (potentially Administrator or SYSTEM) who later launches the application. No public exploit identified at time of analysis and the issue is not on CISA KEV.
RemediationAI
Vendor-released patch: ArubaSign v4.6.6 - upgrade all installations to this version or later, which corrects the installer ACLs. As an interim workaround on systems that cannot be upgraded immediately, administrators should manually tighten the DACL on the ArubaSign installation directory using icacls (e.g. remove the 'Everyone' (S-1-1-0) ACE and inherit the default Program Files ACL) and verify that only Administrators and SYSTEM retain modify rights on the executables; the trade-off is that the change may be reverted by an installer repair or auto-update, so the ACL hardening should be re-validated after any patch cycle. Refer to the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-permissions-arubasign-aruba for coordinator details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ArubaSign is a Windows desktop digital signature client developed by Aruba (the Italian trust services provider). The flaw is a textbook CWE-276 (Incorrect Default Permissions) issue: the MSI/installer applies DACLs that grant the built-in 'Everyone' principal write/modify rights on files placed in the protected C:\Program Files directory, instead of inheriting the default restrictive ACL that limits writes to Administrators and SYSTEM. Because Windows resolves executables by path at launch time, any standard user can overwrite the on-disk binary and have their replacement run inside the next invoking user's security context - a classic 'trojanized binary' privilege escalation primitive.
Know when Arubasign gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Local attack by an authenticated low-priv user (AV:L/PR:L); requires a higher-privileged user to run the trojanized binary (UI:R); full CIA impact on the host once executed.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
Lifecycle Timeline
1DescriptionCVE.org
Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assignment of inappropriate permissions during the software’s default installation, whereby the main executable and other programme files located in C:\Program Files have excessive permissions for the ‘Everyone’ group. This could allow an unprivileged user to replace the main executable and/or its components with a malicious file, thereby enabling the execution of arbitrary code. In the worst-case scenario, if the malicious code is executed with elevated privileges (such as those of Administrator or SYSTEM), the attacker could escalate privileges and gain full control of the system, compromising both security and data integrity.
Executive ViewAI
ArubaSign versions prior to 4.6.6 contain a vulnerability allowing standard users to gain administrative control of affected Windows systems. While no public exploit has been identified at time of analysis, organizations face risk of unauthorized data access, system compromise, and potential lateral movement from affected workstations.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce administrative-only write permissions on C:\Program Files\ArubaSign via ACLs; (2) Deploy file integrity monitoring for ArubaSign binaries; (3) Implement AppLocker or Windows Code Integrity policies to restrict execution of unsigned or modified binaries; (4) Limit local interactive logon rights to trusted personnel; (5) Monitor for suspicious process execution and privilege escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB