Platform EUVD-2026-19634

Attacker must be an all-organization administrator in runZero Platform versions before 4.0.260202.0. Victim interaction required: administrator must click attacker-crafted link or perform action to promote account to superuser status.

Real-world risk is moderate-to-high despite the 8.1 CVSS score. The attack requires network access (AV:N) and low complexity (AC:L), making it technically straightforward to exploit, but demands high privileges (PR:H: organization administrator access) and user interaction (UI:R), significantly limiting the attack surface to trusted insiders or compromised admin accounts. The scope change and high confidentiality/integrity impact reflect serious consequences if exploited-superuser access grants platform-wide control over asset inventory data and security configurations. However, no public exploit identified at time of analysis, and the vulnerability requires pre-existing administrative credentials, reducing likelihood of mass exploitation. EPSS data unavailable, and not listed in CISA KEV, indicating no confirmed active exploitation. Organizations using runZero should prioritize this for patching given the insider threat vector and potential for lateral movement post-compromise, but external attack risk remains constrained by the authentication prerequisite. This is a genuine security concern for runZero deployments but not an internet-wide emergency.

An attacker who has compromised an organization administrator account through phishing or credential theft accesses the runZero Platform web interface. Exploiting the privilege management flaw with low complexity, the attacker navigates to administrative functions and successfully promotes their account (or creates a new account) to superuser status. With superuser privileges across the entire platform, the attacker gains unrestricted access to asset inventory data from all organizations, can modify security policies, disable monitoring, or exfiltrate sensitive network topology information across organizational boundaries. The user interaction requirement (UI:R) suggests the exploit may involve social engineering to trick a legitimate admin into performing the escalation, or requires the attacker to actively use the web interface. No public exploit identified at time of analysis, but the low attack complexity indicates exploitation would be straightforward for attackers with the prerequisite admin access.