What is the CVSS score of EUVD-2026-19634?

EUVD-2026-19634 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Platform are affected by EUVD-2026-19634?

CVE-2026-5373 in runZero Platform enables authenticated administrators to escalate their privileges to superuser status, potentially granting unauthorized access to sensitive organizational data and…. A patch is available.

How to fix or mitigate EUVD-2026-19634?

Within 24 hours: Identify all runZero Platform instances in your environment and document current versions. Within 7 days: Apply vendor patch to runZero Platform version 4.0.260202.0 or later across all deployments; prioritize production and administrative-access instances first. Within 30 days: Conduct privilege access review for all organization administrator accounts post-patching to identify any unauthorized superuser escalations that may have occurred; audit runZero administrative action logs for suspicious privilege changes.

Platform EUVD-2026-19634

| CVE-2026-5373 HIGH

Improper Privilege Management (CWE-269)

2026-04-07 runZero

GHSA-jc2w-m6fm-mc3g

Privilege Escalation Platform Runzero

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 15:22 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:05 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.0.260202.0

EUVD ID Assigned

Apr 07, 2026 - 14:30 euvd

EUVD-2026-19634

Analysis Generated

Apr 07, 2026 - 14:30 vuln.today

CVE Published

Apr 07, 2026 - 14:10 nvd

HIGH 8.1

DescriptionCVE.org

An issue that allowed all-organization administrators to promote accounts to superuser status has been resolved. This is an instance of CWE-269: Improper Privilege Management, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N (8.1 High). This issue was fixed in version 4.0.260202.0 of the runZero Platform.

AnalysisAI

Improper privilege management in runZero Platform allows organization administrators to escalate privileges to superuser status. Authenticated admin users with high privileges (PR:H) can exploit this network-accessible flaw (AV:N) with user interaction (UI:R) to gain unauthorized superuser access, potentially compromising confidentiality and integrity across organizational boundaries (scope changed to C). Fixed in version 4.0.260202.0. EPSS risk data not available; no public exploit identified at time of analysis.

Technical ContextAI

This vulnerability affects the runZero Platform (cpe:2.3:a:runzero:platform), a network discovery and asset inventory solution. The issue stems from CWE-269 (Improper Privilege Management), where the platform failed to properly validate or restrict privilege elevation operations. Organization administrators-users who already possess elevated permissions within their organizational scope-could invoke functionality intended for superuser promotion without adequate authorization checks. The scope change (S:C) in the CVSS vector indicates the vulnerability enables attackers to affect resources beyond their authorized privilege boundary, transitioning from organization-level admin to platform-wide superuser. This represents a classic privilege escalation where horizontal trust boundaries (organization isolation) are violated to achieve vertical escalation (superuser status).

RemediationAI

Vendor-released patch: runZero Platform version 4.0.260202.0. Administrators should immediately upgrade all runZero Platform instances to version 4.0.260202.0 or later, which contains the fix for improper privilege management. The patch eliminates the ability for organization administrators to improperly promote accounts to superuser status. Upgrade instructions and release notes are available at https://help.runzero.com/docs/release-notes/#402602020. As an interim mitigation measure until patching is complete, organizations should audit superuser account creation logs for unauthorized privilege escalations, monitor organization administrator activity for suspicious behavior, and consider temporarily restricting organization administrator permissions if operationally feasible. Review existing superuser accounts to verify legitimacy. No workarounds are provided by the vendor; upgrading to the patched version is the definitive remediation. Full advisory details at https://www.runzero.com/advisories/runzero-platform-su-privesc-cve-2026-5373/.