What is the CVSS score of EUVD-2026-39117?

EUVD-2026-39117 has a CVSS 3.0 base score of 7.2 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of ATEN Unizon are affected by EUVD-2026-39117?

ATEN Unizon is vulnerable to authenticated remote code execution due to a broken cryptographic signature verification flaw that allows high-privileged attackers to deploy malicious updates and…

How to fix or mitigate EUVD-2026-39117?

Within 24 hours: Inventory all ATEN Unizon deployments and identify systems accessible to high-privileged accounts or internal networks. Within 7 days: Restrict network access to Unizon administrative interfaces using network segmentation or firewall rules; require multi-factor authentication for all administrative accounts; enable detailed logging of update activities and administrative actions. Within 30 days: Establish regular contact with ATEN for patch availability; conduct vulnerability assessment on all connected systems; evaluate alternative solutions if ATEN does not commit to a patch timeline.

ATEN Unizon EUVD-2026-39117

| CVE-2026-9779 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-06-24 zdi

GHSA-2h8c-cmrc-4q5c

RCE Jwt Attack Unizon Aten

7.2

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable management endpoint (AV:N, AC:L) but invoking updateWar requires high-privilege authentication (PR:H); a forged update yields full SYSTEM code execution, so C/I/A all High.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 22:25 vuln.today

DescriptionCVE.org

ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.

The specific flaw exists within the updateWar method. The issue results from an incorrect implementation of cryptographic signature verification. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-28590.

AnalysisAI

Authenticated remote code execution in ATEN Unizon stems from a broken cryptographic signature check in the updateWar method (reachable via doCryptoHugeFileToFile), letting a high-privileged remote attacker push a forged WAR update and run arbitrary code as SYSTEM. The flaw (CWE-347) was reported by Trend Micro ZDI as ZDI-CAN-28590 and carries a CVSS 3.0 base score of 7.2; no public exploit identified at time of analysis.

Technical ContextAI

ATEN Unizon is ATEN's centralized management platform for KVM/console and data-center access appliances, built as a Java web application (evidenced by the WAR-file update mechanism). The vulnerability is a CWE-347 Improper Verification of Cryptographic Signature: the updateWar routine is meant to validate the digital signature of an uploaded application/firmware update package before deploying it, but the verification is implemented incorrectly. Because the tags reference a 'Jwt Attack', the integrity check likely relies on a JWT or token-based signature that can be bypassed (e.g., algorithm confusion, unverified signature, or an attacker-controlled key). The affected CPE is cpe:2.3:a:aten:unizon for all enumerated versions. Since the deployed WAR executes in the context of the Java service account, which runs as SYSTEM, a forged package yields full host compromise.

RemediationAI

Apply the fixed release referenced in ATEN's security advisory (https://www.aten.com/global/en/supportcenter/info/security-advisory/32/) once the exact build is identified - Patch available per vendor advisory, but no specific fix version is given in the provided data, so verify the patched version directly with ATEN. Until patched, restrict network access to the Unizon management interface to a dedicated administrative VLAN behind a VPN, which limits who can reach the vulnerable updateWar endpoint at the cost of remote administrative convenience. Tighten privileged accounts (rotate credentials, enforce MFA, remove unnecessary admin/operator roles) since exploitation requires high privileges; this reduces but does not eliminate risk from a legitimately compromised admin. As a detective control, monitor for unexpected WAR/application update uploads and anomalous SYSTEM-context process creation. Cross-reference the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-26-383/) for further detail.