Autonomous Digital Experience Manager EUVD-2026-21898

The CVSS v4.0 score of 2.0 reflects the physical adjacency constraint (AV:P) that significantly reduces real-world exploitability in most enterprise environments where the manager is segmented behind firewalls or air-gapped. However, the impact vector is severe: confidentiality, integrity, and availability are all fully compromised (VC:H, VI:H, VA:H) if adjacency is achieved. The attack has low complexity (AC:L) and requires no user interaction (UI:N). The practical risk depends on deployment topology-if the manager is accessible from untrusted or semi-trusted network segments (e.g., guest networks, supply chain partners), risk escalates significantly. No KEV status or public exploit code has been identified, suggesting limited active exploitation to date. Organizations in segmented network architectures face lower immediate risk; those with flat networks or cloud deployments where adjacency is easier to achieve should prioritize patching.

An attacker on an adjacent network segment (e.g., via rogue access point, compromised router, or lateral movement within a flat enterprise network) crafts a malicious TLS handshake that exploits the insufficient certificate validation in the manager. The manager accepts the connection without properly verifying the certificate, allowing the attacker to send specially crafted protocol messages that trigger arbitrary code execution. The attacker then gains control of the manager process running as NT AUTHORITY\SYSTEM and can compromise the entire Windows host and connected endpoints managed by the tool.