Horizon Security Analyzer CVE-2026-77654

Exploitation requires (1) a valid local operating-system account on the Linux host running Horizon Security Analyzer - remote unauthenticated exploitation is not possible - and (2) the presence of the specific sudoers configuration entry installed by the Horizon Security Analyzer product, which is the attack requirement reflected by AT:P in the CVSS 4.0 vector. The CVSS PR:L confirms a low-privilege (non-root) account is sufficient; no administrative credentials are needed. The vulnerability is limited to Linux 64-bit deployments running A33.10 (≤build 300), A33.20 (≤build 170), or A33.30 (≤build 110). The vendor's CVSS 4.0 also records UI:A, suggesting some form of user interaction may be required; the specific interaction is not described in available public sources.

The vendor-supplied CVSS 4.0 score of 6.1 reflects the local-only attack vector (AV:L), a specific attack requirement (AT:P - the sudoers entry must be present as installed by the product), and an active user interaction requirement (UI:A). However, the subsequent-system impact metrics of SC:H/SI:H/SA:H indicate that once exploited, the attacker can affect systems beyond the local host - a critical consideration given that Horizon Security Analyzer is a centralized firewall policy management platform whose compromise could allow an attacker to silently modify firewall rules across an entire enterprise network. The moderate base score therefore understates operational risk in most deployments. No EPSS data was provided, and the absence of a KEV listing and public PoC code means real-world exploitation has not been confirmed. The local access prerequisite meaningfully limits opportunistic exploitation but does not mitigate insider-threat or post-compromise lateral-movement scenarios, particularly in shared-administration environments where the security management server is accessed by multiple operations staff.

An attacker with a low-privilege shell account on the Horizon Security Analyzer host reviews /etc/sudoers and identifies a command the product is permitted to run as root - for example, a diagnostic or maintenance utility installed by AlgoSec. The attacker invokes that command via sudo with crafted arguments (such as a path argument containing a shell escape sequence, or a flag that causes the binary to execute an attacker-supplied script) and achieves root execution. With root on the security management platform, the attacker can alter firewall policies across all managed devices, disable security logging, or establish persistence.