What is the CVSS score of CVE-2026-5491?

CVE-2026-5491 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 1.5%.

Which versions of DriveLock are affected by CVE-2026-5491?

The DriveLock endpoint-security agent contains an unauthenticated directory traversal vulnerability (CVE-2026-5491, CVSS 7.5) that allows remote attackers to read arbitrary files without…

How to fix or mitigate CVE-2026-5491?

Within 24 hours: Disable the DriveLock web service on TCP 6067 if not operationally required, or implement strict firewall rules restricting access to trusted administrative networks only. Within 7 days: Audit access logs and network telemetry for connections to TCP 6067 from external sources; inventory all DriveLock instances and document their network exposure. Within 30 days: Monitor Trend Micro and DriveLock vendor security advisories for patch availability; evaluate alternative endpoint-security platforms if patches are not released within 60 days; deploy Web Application Firewall or IDS rules to detect directory traversal patterns targeting TCP 6067.

DriveLock CVE-2026-5491

EUVD-2026-50495 HIGH

Path Traversal (CWE-22)

2026-07-29 zdi

GHSA-gcjp-3vgm-hjcx

Information Disclosure Path Traversal Drivelock

7.5

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated single-request file read reachable over the network gives AV:N/AC:L/PR:N/UI:N; disclosure-only impact under the service account yields C:H with I:N/A:N and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 19:52 vuln.today

CVE Published

Jul 29, 2026 - 19:10 cve.org

HIGH 7.5

DescriptionCVE.org

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web service, which listens on TCP port 6067 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28722.

AnalysisAI

Unauthenticated directory traversal in the DriveLock endpoint-security agent's web service (TCP 6067 by default) lets remote attackers read arbitrary files in the context of the service account by supplying a crafted path that is used unvalidated in file operations. Discovered and reported through Trend Micro's Zero Day Initiative (ZDI-26-287 / ZDI-CAN-28722), it carries a CVSS 3.0 base score of 7.5 with high confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

DriveLock is a Windows endpoint-security / device-control and data-protection suite whose components expose a management web service listening on TCP 6067. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): the service accepts a user-supplied path and uses it in a file operation without canonicalizing or constraining it to an intended base directory, so sequences such as ../ resolve outside the web root. Because the read occurs under the service account - typically a highly privileged local/SYSTEM-level context on the endpoint - any file readable by that account can be disclosed. The single CPE cpe:2.3:a:drivelock:drivelock:*:*:*:*:*:*:*:* indicates the affected product line without pinning specific fixed versions.

RemediationAI

Patch available per vendor advisory - apply the DriveLock update referenced in security bulletin 26-003 (PathValidation) at https://www.drivelock.help/sb/Content/SecurityBulletins/26-003-PathValidation.htm; the provided data does not include an exact fixed version number, so confirm the precise build with DriveLock before rollout and consult https://www.zerodayinitiative.com/advisories/ZDI-26-287/ for advisory context. As a compensating control until patched, restrict inbound access to TCP 6067 with host and network firewall rules so that only authorized DriveLock management infrastructure can reach the endpoint web service - the trade-off is that overly broad blocking may interfere with legitimate agent-to-management communication, so scope the allowlist to known management hosts. Network-segment the endpoints so the agent port is not reachable across untrusted VLANs or from the internet, and monitor 6067 for anomalous path-traversal patterns (requests containing ../ or absolute paths).