UID Enterprise Agent CVE-2026-77542

Exploitation requires the attacker to already possess high privileges (CVSS PR:H) and network access (AV:N) to the UID Enterprise Agent; it is therefore not remotely exploitable by an unauthenticated actor against a default install. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once the privilege and network-reach prerequisites are met, triggering the command injection is straightforward. Limiting factors that reduce real-world risk: the mandatory high-privilege authentication, the need for network reachability to the agent, and the specific requirement to reach the improperly-validated input path within the agent.

The signals are partially conflicting: the CVSS base score of 9.1 is high, but the network attack vector (AV:N) is gated by a high-privilege requirement (PR:H), meaning an attacker must already hold elevated access before exploiting the flaw - this substantially narrows the realistic threat population to insiders, compromised admin credentials, or post-exploitation lateral movement rather than opportunistic internet-wide attacks. There is no EPSS score, no POC, and no KEV listing in the provided data, so there is no evidence of active or automatable exploitation; the high score is impact-driven, not exploitability-driven. Given the low barrier once privileges are held (AC:L, UI:N) and full host takeover potential, any operator running UID Enterprise Agent should still prioritize patching promptly, but this reads as an elevated-priority insider/post-compromise risk rather than a mass-exploitation emergency.

An attacker who has already obtained high-privilege access to the UID Enterprise Agent - for example via stolen admin credentials or from an adjacent compromised system - sends crafted input over the network to the agent, which fails to validate it and passes it to a host command. The injected command executes on the host device with the agent's privileges, giving the attacker full control and a pivot point into the environment. No public exploit code is known at time of analysis.