EUVD-2026-92471
GHSA-c2jx-m2vj-6vr7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-facing .NET deserialization (CWE-502) yielding SYSTEM-level RCE with no stated auth or interaction supports AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.
AnalysisAI
Remote code execution in dormakaba evolo Service (all versions) allows an unauthenticated network attacker to execute arbitrary code as SYSTEM via a .NET deserialization flaw, per a 9.8 CVSS vector. The service is typically deployed on internal access-control administration hosts, so exploitation generally requires access to the management network segment, and pre-auth reachability is asserted by the CVSS vector rather than the description. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to the TCP endpoint exposed by the dormakaba evolo Service (the Windows service hosting the vulnerable .NET component that performs object deserialization); per the CVSS vector no authentication (PR:N) or user interaction (UI:N) is needed and complexity is low (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict in a telling way. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory, with no exact fixed version specified in the provided data: consult DKSA-26-31-031_evolo_Service_1.pdf and the dormakaba security advisories page for the patched build and apply it as the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
No vendor-released patch identified at time of analysis; within 24 hours, inventory all instances of dormakaba evolo Service (all versions), isolate their management-network access to trusted jump hosts, and review authentication and process-creation logs for anomalous .NET deserialization activity; within 7 days, enforce firewall ACLs and network segmentation so only authorized administrators can reach the service, disable unused endpoints or integrations, and request mitigation guidance and patch timeline from dormakaba support; within 30 days, deploy the vendor-released patch once available, validate it in a test environment, apply compensating controls until then, and perform threat hunting across access-control administration hosts for signs of compromise.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today