Automic Automation Agent CVE-2026-8370

Attacker must already have local, authenticated low-privileged shell access (CVSS AV:L/PR:L) on a Unix host running a vulnerable Automic Automation Agent (Linux x64, Linux Power 64 BE/LE, zLinux, AIX, Solaris x64, or Solaris Sparc 64) at a version below 24.4.4 HF1, and the agent must be configured to invoke or be reachable by target programs running with elevated privileges - the core trigger per the description is the agent's execution with unnecessary privileges combined with the presence of elevated-privilege target programs it can act upon. Exploitation is limited by the requirement for a pre-existing local account on the agent host and is not reachable over the network in the default vector; remote attackers would first need to obtain a shell through a separate weakness.

Real-world risk is moderately high but bounded by the local attack vector. The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H confirms an authenticated local user with low privileges can fully compromise confidentiality, integrity, and availability with low complexity and no user interaction, and the subsequent system scope impacts (SC:L/SI:L/SA:L) indicate limited spill-over to other components. No EPSS score, KEV listing, or POC was provided in the intelligence set, and the CVE is not flagged as actively exploited, suggesting opportunistic rather than mass-exploited risk. Priority should be elevated on hosts where the Automic agent is reachable by low-trust local accounts (e.g., shared batch hosts or jump boxes) and lower where only operators have shell access; missing EPSS and exploit-maturity data (E:X) means real-world exploitation likelihood cannot be independently quantified from the supplied data.

A low-privileged local user on a Solaris or Linux host where the Automic Automation Agent is deployed leverages the agent's unnecessary privileges to coerce it into launching or influencing a target program that runs with elevated rights, escalating to that program's identity (often root or a service account). With no public exploit identified at time of analysis, the attack would currently require independent vulnerability research, but the low attack complexity and absence of user interaction make weaponization straightforward once internals are understood.