EUVD-2026-19634
GHSA-jc2w-m6fm-mc3g
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
3Tags
Description
An issue that allowed all-organization administrators to promote accounts to superuser status has been resolved. This is an instance of CWE-269: Improper Privilege Management, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N (8.1 High). This issue was fixed in version 4.0.260202.0 of the runZero Platform.
Analysis
Improper privilege management in runZero Platform allows organization administrators to escalate privileges to superuser status. Authenticated admin users with high privileges (PR:H) can exploit this network-accessible flaw (AV:N) with user interaction (UI:R) to gain unauthorized superuser access, potentially compromising confidentiality and integrity across organizational boundaries (scope changed to C). …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: identify all runZero Platform instances in your environment and document current versions. Within 7 days: upgrade all instances to version 4.0.260202.0 or later per vendor advisory. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today