What is the CVSS score of EUVD-2026-36237?

EUVD-2026-36237 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of LimRAD NAC are affected by EUVD-2026-36237?

Limatek LimRAD Network Access Control appliances prior to version 5.5.7.3.9 are vulnerable to unauthenticated remote code execution, allowing attackers to upload malicious files without…. A patch is available.

How to fix or mitigate EUVD-2026-36237?

24 hours: Verify current LimRAD NAC version; if running versions prior to 5.5.7.3.9, restrict network access to the appliance and contact Limatek for emergency mitigation guidance. 7 days: Implement network segmentation to isolate NAC appliances; enable enhanced monitoring and alerting for suspicious activity. 30 days: Upgrade to LimRAD NAC version 5.5.7.3.9 or later when vendor patch becomes available; conduct comprehensive audit of NAC access controls and historical access logs.

LimRAD NAC EUVD-2026-36237

| CVE-2026-7852 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-11 TR-CERT

GHSA-3746-gq88-gwxx

File Upload Limrad Nac

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (TR-CERT) PRIMARY

CRITICAL

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Advisory describes unauthenticated network-reachable upload yielding code inclusion with no user interaction, so AV:N/AC:L/PR:N/UI:N and full C/I/A:H on the same appliance.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 11, 2026 - 14:01 EUVD

Analysis Generated

Jun 11, 2026 - 13:15 vuln.today

DescriptionNVD

Unrestricted upload of file with dangerous type vulnerability in Limatek System Inc. LimRAD NAC allows Remote Code Inclusion.

This issue affects LimRAD NAC: before 5.5.7.3.9.

AnalysisAI

Remote code execution in Limatek System Inc. LimRAD NAC versions prior to 5.5.7.3.9 allows unauthenticated remote attackers to upload dangerous file types and achieve Remote Code Inclusion. The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating reflects an internet-reachable, no-interaction exploitation path against a network access control appliance, though no public exploit identified at time of analysis. The vulnerability was disclosed by TR-CERT and tracked in Turkish national vulnerability advisory TR-26-0366.

Technical ContextAI

LimRAD NAC is a Network Access Control product from Turkish vendor Limatek System Inc., typically deployed at the network edge to enforce device admission policies. The flaw is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), meaning the upload handler does not validate file extension, MIME type, or content against an allowlist before storing or processing the file. The CPE string cpe:2.3:a:limatek_system_inc.:limrad_nac:*:*:*:*:*:*:*:* covers all versions of the product up to the fixed release. Because the advisory describes the outcome as 'Remote Code Inclusion', the uploaded file is rendered or included by a server-side interpreter (e.g., a web language runtime hosting the management UI), turning an upload primitive into arbitrary code execution within the appliance.

RemediationAI

Vendor-released patch: upgrade LimRAD NAC to version 5.5.7.3.9 or later, which is the fixed release identified in the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0366. Until the upgrade can be staged, restrict reachability of the LimRAD NAC management and any file-upload endpoints to a dedicated administrative VLAN or jump host (trade-off: legitimate remote administration must move through that path), and place a reverse proxy or WAF rule in front of the appliance that blocks multipart/form-data POSTs containing executable extensions such as .php, .jsp, .asp, .aspx, or double-extension uploads (trade-off: may break legitimate file imports if the appliance accepts those for policy uploads). Monitor the appliance's webroot and upload directory for unexpected newly written files and review web server access logs for POSTs to upload handlers from non-administrative source IPs.