What is the CVSS score of EUVD-2026-40170?

EUVD-2026-40170 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

Which versions of Gigamon GVOS are affected by EUVD-2026-40170?

Gigamon GigaVUE-OS versions 5.16.1 and earlier contain an unauthenticated path traversal vulnerability in the H-VUE management interface allowing attackers to remotely read sensitive system files.

How to fix or mitigate EUVD-2026-40170?

Within 24 hours: identify all Gigamon GigaVUE-OS deployments and assess whether H-VUE management interfaces are reachable from untrusted networks. Within 7 days: restrict H-VUE access to authorized networks via firewall rules and network segmentation; contact Gigamon for patch ETA and mitigation guidance. Within 30 days: review GVOS system file permissions, implement enhanced audit logging for file access, and establish upgrade plan for when patches become available.

Gigamon GVOS EUVD-2026-40170

| CVE-2026-36848 HIGH

Path Traversal (CWE-22)

2026-06-29 cve@mitre.org

GHSA-9926-qcxh-376f

Path Traversal Gigavue Os Gigamon

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable H-VUE web interface with no auth or interaction (AV:N/AC:L/PR:N/UI:N); arbitrary file read yields high confidentiality loss but no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 20:30 vuln.today

CVSS changed

Jun 29, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 29, 2026 - 18:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Gigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem.

AnalysisAI

Path traversal in the H-VUE web management subsystem of Gigamon GigaVUE-OS (GVOS) versions 5.16.1 and earlier allows remote attackers to read arbitrary files outside the intended web root, exposing sensitive system data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation with high confidentiality impact but no integrity or availability effect. A researcher GitHub repository tracking this CVE suggests proof-of-concept material may exist, but there is no public exploit explicitly confirmed and no CISA KEV listing at time of analysis.

Technical ContextAI

GVOS (GigaVUE-OS) is the operating system that runs on Gigamon's network visibility and traffic-aggregation appliances (GigaVUE H-series and related fabric nodes), and H-VUE is its web-based administration GUI. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), meaning the H-VUE subsystem accepts user-supplied path input - typically a filename or resource parameter in an HTTP request - without properly canonicalizing or constraining it, permitting sequences such as '../' to escape the intended directory and resolve to arbitrary files on the underlying appliance filesystem. Because the CVSS impact is confidentiality-only (C:H, I:N, A:N), the flaw is consistent with arbitrary file read/disclosure rather than file write or code execution.

RemediationAI

No specific vendor-released fixed version is identified in the available data, so no exact upgrade target can be cited; consult Gigamon support and the GigaVUE-OS release notes for a patched build above 5.16.1 and apply it once confirmed. As primary compensating controls, restrict access to the H-VUE web management interface to a dedicated out-of-band management VLAN or trusted admin hosts only and block it from general user and internet-facing networks (trade-off: legitimate remote administrators must use VPN/jump-host access). Place a reverse proxy or WAF in front of H-VUE to normalize paths and reject requests containing traversal sequences such as '../' or encoded variants like '%2e%2e%2f' (trade-off: risk of breaking legitimate parameterized requests, so test rules before enforcing). Review the Gigamon EOL policy page (https://www.gigamon.com/support/policies/eol-policy.html) to confirm whether affected versions are still supported, since end-of-life builds may not receive a patch and should be prioritized for upgrade or decommissioning.