sar2html EUVD-2026-101623

Requires a network-reachable sar2html 4.0.0 instance whose web interface (sar2html.py) is exposed to the attacker; the deleteHost/deleteRange/deleteAll functions perform their destructive operations without any authentication check, so no credentials, user interaction, or special configuration are needed (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is exposure: sar2html is typically an internal reporting tool, so impact is constrained to environments that deploy it and make the interface reachable to the attacker, and impact is limited to integrity/availability of monitoring data (no confidentiality exposure).

This is a genuinely medium-severity, low-priority issue rather than a critical threat, and the signals are internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly describes a remotely reachable, unauthenticated, low-complexity flaw, but the impact metrics are deliberately limited: VC:N/VI:L/VA:L with no subsequent-system impact (SC:N/SI:N/SA:N), yielding a base score of 5.5. The E:P (Proof-of-Concept) threat metric aligns with the description's statement that an exploit has been publicly disclosed. There is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active, widespread exploitation - exploitation status is limited to 'publicly available exploit code exists.' The missing-authentication weakness (CWE-287) on delete operations means the real-world harm is data destruction/tampering in the monitoring tool, not code execution or data theft. The most material risk-reducing factor is product prevalence: sar2html is an obscure open-source sysstat-to-HTML reporting utility with a tiny footprint, and the project itself has not responded to the issue report, so expect no coordinated patch. Net: do not treat as an emergency; prioritize only if sar2html is actually exposed in your environment.

An attacker who can reach the sar2html web interface over the network, with no credentials, invokes the deleteHost, deleteRange, or deleteAll functionality directly and removes stored host/report data from the monitoring tool. Because the delete endpoints lack authentication (AV:N/PR:N/UI:N), this requires only a crafted HTTP request to the exposed instance. Public exploit/disclosure details exist, lowering the skill needed to reproduce it.