AB Download Manager EUVD-2026-115883

Exploitation requires that the victim is running AB Download Manager (before 1.11.2) with its local browser-integration HTTP server active and unauthenticated - the pre-patch default, since the fix newly adds apiKeyEnforced/API-key enforcement. The attacker does not need credentials (PR:N), but per UI:P the victim must be induced to load an attacker-controlled web page in a browser on the same host; that page sends a text/plain POST to /start-headless-download so the request qualifies as a simple cross-origin request not blocked by a CORS preflight. Practical limiting factors: the integration server must be listening, the user must visit the malicious page, and the demonstrated startup-folder code-execution path only runs the payload at the next user login/reboot rather than immediately. The arbitrary-file-write primitive itself fires on request, but turning it into code execution depends on writable autostart locations on the victim's platform.

This is a genuine priority despite the absence of some signals. The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P) describes a network-reachable, low-complexity flaw in an unauthenticated API, and the vulnerability chains a CWE-352 CSRF into arbitrary file write and ultimately code execution (VC:H/VI:H/VA:H) - a high-impact outcome confirmed by the vendor patch that introduces API-key enforcement. The one mitigating metric is UI:P: a victim must visit an attacker-controlled web page while the product is running, so exploitation is passive-interaction rather than fully autonomous. No EPSS score is present in the input, so empirical exploitation probability cannot be weighed; this is a missing signal, not a low one. The flaw is NOT in CISA KEV and there is no field confirming active exploitation, so it should not be treated as in-the-wild. The vuln.today decision label is 'this_week', which - combined with a working vendor patch, a reputable reporter (VulnCheck), and public source-code/commit detail that materially lowers the bar to building an exploit - argues for prompt remediation this week rather than emergency response. Net: a real, high-impact CSRF-to-RCE that warrants patching this week, held back from the top tier only by the required user interaction and the lack of confirmed active exploitation.

An attacker lures a user who has AB Download Manager (before 1.11.2) running into visiting a malicious web page. That page issues a cross-origin text/plain POST to the local browser-integration endpoint /start-headless-download with attacker-chosen folder and name values, writing a payload into the OS startup folder; the payload then executes the next time the victim logs in. A public GitHub issue (#1489) and the patch commit describe the flaw in detail, but the input does not confirm packaged, working exploit code.