What is the CVSS score of CVE-2026-44926?

CVE-2026-44926 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Veritas InfoScale are affected by CVE-2026-44926?

Veritas InfoScale CmdServer versions prior to 7.4.2 contain a privilege escalation vulnerability (CVE-2026-44926, CVSS 8.8) enabling authenticated remote attackers to bypass access controls and…

How to fix or mitigate CVE-2026-44926?

Within 24 hours: Identify all Veritas InfoScale CmdServer installations and document current versions; contact Veritas support for patch availability timeline for version 7.4.2. Within 7 days: Implement network segmentation and firewall rules to restrict CmdServer access; enforce principle of least privilege for user accounts; enable comprehensive audit logging. Within 30 days: Apply vendor patch to version 7.4.2 upon release, or escalate timeline if patch is delayed beyond acceptable risk window.

Veritas InfoScale CVE-2026-44926

EUVD-2026-31133 HIGH

Improper Access Control (CWE-284)

2026-05-20 mitre

GHSA-4pmv-rc9x-737p

Authentication Bypass N A

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 20:23 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

May 20, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

InfoScale CmdServer before 7.4.2 mishandles access control.

AnalysisAI

Privilege escalation in Veritas InfoScale CmdServer prior to version 7.4.2 allows authenticated remote attackers to bypass access control restrictions and achieve full compromise of confidentiality, integrity, and availability on the targeted host. The flaw is tagged as an authentication bypass by intelligence sources and carries a CVSS 8.8 (High) rating; no public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Veritas (now Cohesity/Arctera) InfoScale is an enterprise software-defined storage and high-availability clustering suite widely deployed for mission-critical workloads across UNIX, Linux, and Windows. The CmdServer (Command Server) is the component that receives and dispatches administrative commands across nodes in an InfoScale cluster. CWE-284 (Improper Access Control) indicates the CmdServer fails to correctly enforce authorization checks on incoming requests, meaning a principal that holds some level of access can perform operations beyond its intended privilege boundary. Combined with the 'Authentication Bypass' tag from intelligence feeds, the root cause is likely an authorization decision that trusts client-supplied state or skips a check on a privileged code path.

RemediationAI

Upgrade Veritas InfoScale to version 7.4.2 or later, which contains the vendor-released patch addressing the access control flaw - see the Veritas advisory at https://www.veritas.com/support/en_US/doc/109864724-141543588-0/v141217547-141543588 and the Cloud Software Group KB at https://supportinfoscale.cloud.com/support-home/kbsearch/article?articleNumber=1000766081 for download links and platform-specific instructions. If immediate patching is not feasible, restrict network reachability of the CmdServer port to the dedicated cluster administration network using host-based firewalls or network ACLs, and audit which accounts hold any level of InfoScale administrative credentials since PR:L means an existing low-privileged user is the realistic abuse path; note that overly aggressive firewall rules can disrupt legitimate inter-node cluster communication and trigger failovers, so changes should be staged. Enable and centrally collect CmdServer audit logs to detect anomalous command dispatch while remediation is rolled out.