EUVD-2026-64193Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires valid TLS peer credentials or cluster network foothold raising AC to High; PR:L for required transport-layer access; S:C because integrity corruption propagates to all cluster peers via replication.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at internal/cluster/replication/receiver.go validates only the wire-format envelope (length, opcode) of inbound messages. The MsgReplicateSync payload itself is accepted without any application-layer authentication - no HMAC, no signature, no per-message nonce. The replication stream is protected at the transport layer by TLS / mTLS, but there is no protection against application-layer message tampering or replay once a peer is on the cluster network. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit replication logs for unexpected MsgReplicateSync traffic, and/or disable cluster mode until the fix is available.
AnalysisAI
Missing application-layer authentication in Arc Enterprise's cluster replication receiver (prior to version 2026.06.1) allows any peer with access to the cluster network to inject or replay MsgReplicateSync messages, silently corrupting replicated telemetry data across all cluster nodes. The CVSS 4.0 score of 8.3 reflects high integrity impact on both the vulnerable system and subsequent cluster peers (VI:H, SI:H) with only low privilege requirements, scoped to cluster-mode deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires Arc to be deployed and actively running in cluster mode - standalone Arc instances are completely unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N) captures high integrity impact across both the vulnerable node and subsequent cluster peers, with low privilege requirements and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is upgrading to Arc Enterprise version 2026.06.1 or later, which introduces application-layer authentication for MsgReplicateSync payloads. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: restrict cluster network access to authorized systems only and review recent audit logs for evidence of unauthorized replication messages. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF). Rated high severity (CVSS 7
Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permi
Path traversal in Arc Enterprise's Raft finite state machine allows low-privileged cluster peers to register arbitrary f
Path traversal in Nozomi Networks Arc's local web interface allows a local administrator to delete arbitrary files on th
The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perfor
Nozomi Networks Arc for Windows installs the Npcap packet capture driver with its access restriction option left at the
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today