Arc Database CVE-2026-48105

Exploitation requires Arc Enterprise to be deployed and actively running in cluster mode - the vulnerability exists solely in the Raft consensus subsystem and standalone Arc deployments are not affected. The attacker must hold low-privilege cluster peer access (CVSS PR:L), meaning they must be able to submit Raft proposals to the cluster, which typically requires valid peer authentication credentials or membership in the cluster's trusted peer list. The cluster's Raft port must be network-reachable by the attacker (AV:N). Exploitation is bounded by: (1) the mandatory requirement for cluster peer credentials or a pre-compromised cluster member; (2) cluster mode being enabled; (3) the Arc version being older than 2026.06.1. No user interaction is required once cluster peer access is established. Applying firewall restrictions to limit which hosts can reach the Raft port is the most effective compensating control absent a patch.

The CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N) reflects a network-reachable, low-complexity flaw requiring low privileges with no user interaction. Integrity impact is rated High on both the vulnerable and subsequent systems while confidentiality and availability are unaffected, making this a data-integrity threat rather than a service-disruption or data-exfiltration risk. No CISA KEV listing exists and no public exploit code has been identified, so exploitation is currently assessed as opportunistic-to-targeted rather than widespread. The most significant real-world constraint is PR:L: an attacker must first possess valid cluster peer credentials or occupy a pre-compromised cluster member, which materially raises the exploitation bar beyond what the raw score implies. EPSS data is absent from the provided intelligence; given the product's niche deployment footprint and the PR:L access barrier, real-world exploitation probability is assessed as low despite the high CVSS score. The lack of a confidentiality impact vector means sensitive data disclosure is not a direct consequence, though an attacker writing to arbitrary paths could stage secondary attacks.

An attacker who has obtained valid Arc cluster peer credentials - through a compromised node, stolen peer certificates, or insider access - connects to the cluster network and submits a crafted Raft manifest-registration proposal containing a path such as '../../etc/cron.d/backdoor' or an s3:// URI pointing to an attacker-controlled bucket. The applyRegisterFile FSM handler accepts the proposal without path validation, registering the malicious path in the cluster manifest. Subsequent cluster write operations then place data segment files at the injected location, enabling arbitrary local filesystem writes or silent data redirection to an external storage endpoint.