Koozali SME Server EUVD-2026-104069

Requires high-privilege authenticated access to the SME Server web/management interface's domain creation function (PR:H) - this is the exact prerequisite, not generic network access. The attacker supplies input that is written as reserved Apache directives into httpd.conf; the resulting DoS is NOT immediate and only manifests after a subsequent server reboot (reflected by UI:P/R:A), which is the primary limiting factor. Additional limits: exploitation is confined to administrators of the affected product, impact is availability/integrity only (no data disclosure), and it affects koozali SME Server 11.0rc1-215.

The CVSS 4.0 base score of 6.9 (Medium) is driven mainly by the high availability impact (VA:H) and the automatable flag (AU:Y), but it is strongly tempered by the PR:H requirement: the attacker must already hold high-privilege (administrator) access to the SME Server management interface, so this is effectively a privileged-insider or post-compromise DoS rather than a remotely exploitable breach. The vector shows AV:N/AC:L (reachable over the network, low complexity) but also UI:P and R:A - exploitation only becomes effective after a server reboot, and recovery is described as automatic/attended, which further lowers urgency. The CVSS 4.0 exploit-maturity metric is E:P (Proof-of-Concept), indicating demonstrated exploitability but NOT confirmed active exploitation; no KEV listing and no EPSS score were provided in the input, so widespread opportunistic exploitation cannot be asserted. Signals are internally consistent rather than conflicting: a privilege-gated availability-only flaw in a niche product. Net assessment - this is a real but low-priority issue for most environments; prioritize only where untrusted or semi-trusted administrators have access to domain creation.

A malicious or compromised SME Server administrator uses the domain creation functionality to inject reserved Apache configuration directives, which are written into httpd.conf and corrupt it. The damage stays dormant until the next server reboot, at which point Apache fails to start and the web server plus all hosted virtual hosts go offline. The CVSS 4.0 E:P metric indicates a proof-of-concept for this technique exists.