Vatos DLP EUVD-2026-113945

Exploitation requires the attacker to already hold local, low-privileged authenticated access to the system running Vatos DLP (AV:L, PR:L), because the flaw is the recovery of domain credentials that the product stores in plaintext (CWE-256) rather than remote interception. The specific storage location/format of the plaintext credentials is not described in the available sources. Limiting factors: no remote or unauthenticated path (not internet-exploitable on its own), impact is bounded to deployments where domain credentials are actually configured and stored by Vatos DLP, and only versions from 1.1.176 up to (not including) 1.1.243 are affected - upgrading to 1.1.243 removes the condition.

This is a credible but context-limited risk. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 7.1 HIGH) describes a locally-exploitable flaw requiring low-level privileges and no user interaction, where an already-authenticated local user can recover stored plaintext credentials (CWE-256). Because PR:L is specified, exploitation requires an authenticated foothold - this is not remotely reachable by an anonymous attacker, which substantially lowers mass-exploitation potential. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no SSVC machine-readable decision was supplied; the only priority signal is the vuln.today 'this_week' label, consistent with a HIGH-severity finding warranting prompt but non-emergency patching. The sole reference is the TR-CERT (Turkish national CERT) advisory, not a proof-of-concept, so there is no public exploit identified at time of analysis. Net: a genuine privilege-escalation/credential-theft issue for organizations running this specific DLP product, but the local-access prerequisite and absence of any exploitation evidence place it below internet-facing unauthenticated flaws in triage order.

A low-privileged but authenticated local user (or an attacker who has already gained a foothold on the host running Vatos DLP) locates the configuration or data store where domain credentials are retained in plaintext and reads them directly. The recovered known domain credentials can then be reused to authenticate as that account against other domain resources. No public exploit code is identified; the flaw requires local access (AV:L) and low privileges (PR:L) but no user interaction.