Which versions of Automic Automation Agent are affected by CVE-2026-8370?

Broadcom Automic Automation Agent contains a local privilege escalation flaw (CVE-2026-8370, CVSS 8.5) affecting versions prior to 24.4.4 HF1 on Unix systems, allowing authenticated low-privilege…. A patch is available.

How to fix or mitigate CVE-2026-8370?

Within 24 hours: identify all Broadcom Automic Automation Agent deployments on Unix systems (Linux, AIX, Solaris, zLinux) and document current versions in use. Within 7 days: restrict local system access to affected installations, implement privileged account monitoring, and disable non-essential automation agents as interim controls. Within 30 days: upgrade all affected systems to Broadcom Automic Automation Agent version 24.4.4 HF1 or later.

Automic Automation Agent CVE-2026-8370

Q: What is the CVSS score of CVE-2026-8370?

CVE-2026-8370 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30970 HIGH

Execution with Unnecessary Privileges (CWE-250)

2026-05-19 ca

GHSA-vmh5-rqqv-q3v3

Broadcom Privilege Escalation

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 19, 2026 - 20:02 EUVD

Analysis Generated

May 19, 2026 - 19:30 vuln.today

CVSS changed

May 19, 2026 - 19:22 NVD

8.5 (HIGH)

DescriptionCVE.org

Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSeries), AIX, Solaris x64, Solaris Sparc 64 allows Privilege Escalation, Target Programs with Elevated Privileges.

This issue affects Automic Automation: < 24.4.4 HF1.

AnalysisAI

Local privilege escalation in Broadcom Automic Automation Agent versions prior to 24.4.4 HF1 allows authenticated low-privileged users on Unix-family systems (Linux x64, Linux Power 64 BE/LE, zLinux, AIX, Solaris x64, Solaris Sparc 64) to abuse the agent's elevated privileges and target programs running with higher rights. The CVSS 4.0 score of 8.5 reflects high confidentiality, integrity, and availability impact achievable from a local foothold, with no public exploit identified at time of analysis.

Technical ContextAI

Automic Automation is Broadcom's enterprise workload automation platform; its Unix agent executes scheduled jobs and orchestrates tasks across heterogeneous server fleets, typically running with elevated rights so it can launch processes as multiple target users. The root cause is classified as CWE-250 (Execution with Unnecessary Privileges), meaning the agent retains or exposes privileges broader than required for its operating context, enabling a local attacker to leverage the agent to invoke or influence privileged target programs. The CPE cpe:2.3:a:broadcom:automic_automation:*:*:*:*:*:*:*:* confirms the flaw is in the application layer across all listed Unix-variant builds rather than in an underlying OS component.

RemediationAI

Vendor-released patch: Automic Automation 24.4.4 HF1 - upgrade all Unix agents to this version or later per the Broadcom Security Advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37512. If immediate patching is not feasible, restrict interactive and SSH access to hosts running the agent so that only trusted operators hold local accounts, audit the UID/GID and setuid configuration the agent runs under to ensure it does not exceed what jobs actually require, and review agent job definitions to remove or scope target-program invocations that run with root or other elevated identities; note that tightening the agent's identity may break workflows that rely on it executing privileged commands, so workload changes should be staged in a test environment first.