What is the CVSS score of EUVD-2026-37681?

EUVD-2026-37681 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.3%.

Which versions of Quanos SCHEMA ST4 are affected by EUVD-2026-37681?

Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability (CVE-2026-11857, CVSS 8.4) in the Client Update Service that allows authenticated local users to gain SYSTEM-level…

How to fix or mitigate EUVD-2026-37681?

Within 24 hours: Inventory all SCHEMA ST4 on-premises deployments and identify users with local system access; implement immediate restrictions on local logon privileges and remote desktop access to affected systems. Within 7 days: Disable the Client Update Service if operationally feasible, or implement mandatory access controls restricting the named pipe endpoint to service accounts only. Within 30 days: Monitor vendor advisory channels for security patch release; if no patch available, conduct risk assessment and evaluate alternative solutions or network segmentation strategies.

Quanos SCHEMA ST4 EUVD-2026-37681

| CVE-2026-11857 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 SEC-VLab

Privilege Escalation Deserialization RCE Schema St4

8.4

CVSS 4.0 · Vendor: SEC-VLab

Severity by source

Vendor (SEC-VLab) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

vuln.today AI

7.8 HIGH

Local named-pipe access requires an authenticated low-priv session (AV:L, PR:L, AC:L); SYSTEM-level code execution yields full host compromise, so C:H/I:H/A:H within the same scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (SEC-VLab).

CVSS VectorVendor: SEC-VLab

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 13:16 vuln.today

DescriptionCVE.org

Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service due to insecure deserialization in the .NET Remoting service. The service is configured with TypeFilterLevel.Full and is bound to local interfaces only through named pipes. A local authenticated attacker can connect to the local named pipe, obtain the .NET Remoting endpoint, and send specially crafted serialized objects. Successful exploitation results in arbitrary code execution in the context of the update process with NT AUTHORITY\SYSTEM privileges. Network-only exploitation is not possible and local host access with an authenticated user session is required.

AnalysisAI

Local privilege escalation in Quanos SCHEMA ST4 on-premises allows an authenticated local user to gain NT AUTHORITY\SYSTEM by abusing insecure .NET Remoting deserialization in the Client Update Service. The endpoint, reachable through a local named pipe with TypeFilterLevel.Full, accepts attacker-controlled serialized objects and yields arbitrary code execution in the update process context. No public exploit identified at time of analysis, though a SEC-Consult/SEC-VLab advisory documents the issue.

Technical ContextAI

The flaw resides in the Client Update Service component of SCHEMA ST4, which exposes a .NET Remoting endpoint over a Windows named pipe. .NET Remoting is a legacy Microsoft IPC framework Microsoft itself deprecated and warned against using with untrusted input; configuring it with TypeFilterLevel.Full enables 'full trust' serialization, allowing arbitrary types (including known dangerous BinaryFormatter gadgets) to be deserialized. This maps to CWE-502 (Deserialization of Untrusted Data): the server reconstructs attacker-supplied object graphs that trigger gadget chains during deserialization. The vulnerable product is identified by CPE cpe:2.3:a:quanos_solutions_gmbh:schema_st4:*:*:*:*:*:*:*:* (wildcard version, indicating no specific fixed version is encoded in NVD CPE).

RemediationAI

Patch status is not specified in the supplied input, so apply the most specific guidance available: consult the SEC-Consult advisory at https://r.sec-consult.com/quanos and the Quanos vendor advisory it references to identify and deploy the fixed SCHEMA ST4 release. Until an upgrade is applied, restrict local logon rights to the affected hosts (the only attack vector is a local authenticated session), avoid running SCHEMA ST4 on shared/terminal-server systems where untrusted users have sessions, and monitor the Client Update Service's named-pipe endpoint for unexpected connections; an aggressive compensating control is to stop or disable the Client Update Service entirely, with the trade-off that automatic client updates will no longer function and must be delivered out of band.