What is the CVSS score of CVE-2026-9777?

CVE-2026-9777 has a CVSS 3.0 base score of 7.2 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.5%.

Which versions of ATEN Unizon are affected by CVE-2026-9777?

ATEN Unizon contains a directory traversal vulnerability enabling authenticated high-privileged users to execute code with system-level privileges, creating risk of complete infrastructure…

How to fix or mitigate CVE-2026-9777?

Within 24 hours: Identify and inventory all ATEN Unizon installations; restrict administrative access to essential personnel only and implement full audit logging of administrative activities. Within 7 days: Monitor Trend Micro Zero Day Initiative and ATEN security advisories for patch release; audit historical logs for suspicious file restore operations or path traversal attempts by high-privileged accounts. Within 30 days: Apply vendor patch immediately upon release; if no patch becomes available, evaluate alternative products or implement long-term compensating controls; maintain enhanced logging and threat monitoring.

ATEN Unizon CVE-2026-9777

EUVD-2026-39115 HIGH

Path Traversal (CWE-22)

2026-06-24 zdi

GHSA-pqwm-59vh-j99g

RCE Path Traversal Unizon Aten

7.2

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable restore function (AV:N/AC:L) gated by administrative authentication (PR:H), no user interaction, and SYSTEM-context code execution yielding full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 22:24 vuln.today

DescriptionCVE.org

ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.

The specific flaw exists within the restoreDB method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-28578.

AnalysisAI

Authenticated remote code execution in ATEN Unizon arises from a directory traversal flaw in the restoreDB method, where a user-supplied path is used in file operations without validation, letting a high-privileged attacker write or restore files outside the intended directory and run code as SYSTEM. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-28578 / ZDI-26-381) and carries a CVSS 3.0 base score of 7.2 (PR:H). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

ATEN Unizon is ATEN's centralized management and monitoring platform for its KVM, PDU, and IT infrastructure devices, typically deployed as a server-side application with a SYSTEM-level service backend. The vulnerability is a classic CWE-22 Path Traversal (Improper Limitation of a Pathname to a Restricted Directory): the restoreDB function accepts an attacker-controlled path used for database/backup restore file operations but fails to canonicalize or constrain it, so traversal sequences (e.g. ../) let the attacker reference arbitrary filesystem locations. Because the operation runs in the context of the SYSTEM account, escaping the intended restore directory escalates a simple path-handling bug into full code execution. The affected component is identified by CPE cpe:2.3:a:aten:unizon:*:*:*:*:*:*:*:*, indicating all versions are presumed in scope pending the vendor advisory.

RemediationAI

Patch available per vendor advisory - consult the ATEN security advisory at https://www.aten.com/global/en/supportcenter/info/security-advisory/30/ and apply the fixed Unizon release ATEN designates; an exact fix version was not provided in the available data, so verify the target version directly from that advisory. Corroborating technical detail is in the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-381/. Until patching, reduce exposure by restricting network access to the Unizon management interface to a trusted administrative network or VLAN (trade-off: legitimate remote admins must use VPN or a jump host), enforcing strong unique credentials plus MFA on all high-privilege Unizon accounts since exploitation requires PR:H (trade-off: minimal, mainly admin friction), and tightly limiting who holds administrative roles while auditing use of the database restore/backup function for anomalous file paths (trade-off: restore operations may need temporary disabling, which interrupts disaster-recovery workflows).