Arc Enterprise CVE-2026-48106

Exploitation requires Arc to be deployed and actively running in cluster mode - standalone Arc instances are completely unaffected. The attacker must obtain access to the cluster replication network; because TLS/mTLS secures the transport channel, this means the attacker must either possess valid TLS peer credentials, have compromised an existing cluster member node, or have achieved a network-level foothold within the cluster trust boundary. Once on the cluster network with a TLS-authenticated connection, no additional authentication is required to inject MsgReplicateSync payloads - this is the exact gap described by CWE-306. Exploitation is limited to integrity impact (data injection and replay); there is no confidentiality impact (VC:N) and no availability impact (VA:N), meaning an attacker cannot exfiltrate data or crash the service through this vector alone. The PR:L rating in the CVSS 4.0 vector confirms that unauthenticated external exploitation from the open internet is not possible.

The vendor-assigned CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N) captures high integrity impact across both the vulnerable node and subsequent cluster peers, with low privilege requirements and no user interaction. The PR:L rating is consistent with the TLS/mTLS transport requirement - exploitation is not open to anonymous internet attackers, but requires cluster network access or possession of valid TLS peer credentials. No EPSS score was included in the source intelligence, which is a notable gap; without it, exploitation probability cannot be quantified independently of CVSS. This CVE does not appear on the CISA KEV catalog, and no public exploit code has been identified, suggesting current risk is theoretical rather than opportunistic at scale. The most realistic threat actor is a compromised cluster peer or a malicious insider with existing cluster network access, not an external attacker scanning the internet. Organizations not running Arc in cluster mode are entirely unaffected, which substantially limits the real-world exposure surface. The combination of a high base score, absent EPSS data, no KEV listing, and the TLS transport prerequisite means this is a genuine priority for cluster deployments but not an emergency for the broader security community.

An attacker who has compromised an existing Arc cluster node, or who has obtained valid TLS peer credentials through a separate attack, connects to the cluster replication receiver and transmits crafted MsgReplicateSync messages that pass envelope validation but carry tampered or replayed data payloads. Because no HMAC or signature is checked at the application layer, the injected messages are accepted and replicated across all cluster peers, silently corrupting the telemetry dataset. No public exploit code has been identified; successful exploitation requires cluster network presence rather than open internet access.