Platform EUVD-2026-19699

While the CVSS score of 3.0 (Low) reflects the impact constraints-high privilege requirement (PR:H), high attack complexity (AC:H), limited confidentiality impact (C:L), no integrity or availability impact-the real-world risk hinges on organizational deployment context. The requirement for high-privilege credentials significantly limits the threat surface; however, insider threats from administrative users with legitimate platform access represent a credible attack vector. The authentication requirement (PR:H per CVSS vector) reduces likelihood of external exploitation substantially. No EPSS probability data, active exploitation evidence (KEV status not provided), or public proof-of-concept is available, indicating low immediate prioritization. Organizations managing multi-tenant or heavily compartmentalized environments should assess their administrative access governance and monitor for unauthorized record access patterns. This is best characterized as a privilege-boundary-enforcement issue rather than a critical threat.

A high-privilege administrator with legitimate access to runZero Platform's management console could intentionally or inadvertently query MCP endpoints to retrieve asset records, vulnerability data, or configuration information belonging to other organizations within the same platform instance. Due to the high attack complexity (AC:H) and privilege requirement, exploitation requires either deliberate abuse by an insider or a sophisticated social engineering scenario convincing an administrator to execute specific MCP queries. No public exploit code exists to automate this action, limiting the attack surface to knowledgeable internal users or threat actors with compromised administrative credentials.