Network-AI EUVD-2026-45938

Exploitation requires that Network-AI (before 5.13.4) is running with the default local verifier active in APSAdapter - the shipped default configuration - and that the attacker can reach the APS delegation endpoint over the network. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no user interaction, and no special attack requirement is needed, so any client able to submit an APS payload can forge tokens by supplying any non-empty signature string. The main limiting factors are network reachability of the delegation endpoint and whether an operator has replaced the default local verifier with a real key-based verifier; environments that isolate the APS endpoint or have already configured a proper verifier are not exposed.

The signals are largely consistent and point to genuine priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L/VI:H/VA:L, base 8.8) describes a network-reachable, low-complexity, unauthenticated attack with high integrity impact - matching the description that any attacker can forge tokens. The high-integrity, lower-confidentiality/availability weighting is coherent: the core harm is unauthorized issuance of privileged grants rather than direct data theft or crashes, though SHELL_EXEC grants could obviously escalate. No EPSS score, KEV entry, or POC reference was supplied, so real-world exploitation frequency is UNKNOWN and cannot be asserted; the absence of an EPSS value means probabilistic exploitation likelihood is unavailable rather than low. There is no SSVC decision data in the input. Net: a low-effort, unauthenticated auth-bypass with a plausible path to command execution should be treated as high priority despite the lack of confirmed in-the-wild activity.

An unauthenticated attacker who can reach the Network-AI APS endpoint crafts a delegation payload requesting the SHELL_EXEC scope and attaches any arbitrary non-empty string as the signature. Because the default local verifier accepts it, the server returns a validly signed permission-grant token, which the attacker then presents to invoke privileged actions such as shell execution. No public exploit code has been identified at time of analysis, but the described logic requires no cryptographic effort to reproduce.