Official DMS EUVD-2026-60077

Exploitation requires a valid authenticated account in the Official Document Management System (PR:L per CVSS 4.0 vector) - anonymous or unauthenticated exploitation is not possible. No special administrative privileges or non-default configuration are needed beyond holding any user-level account with access to the file upload feature, which is a core application function. The network attack vector (AV:N) means exploitation can occur remotely over the internet if the application is internet-facing. Limiting factors include: the authentication requirement (credential compromise or insider is a prerequisite), no evidence of automation-friendly exploitation (SSVC Automatable: no), and no current active exploitation per SSVC and CISA KEV absence. Organizations that expose this DMS to external users or the internet face materially higher risk than those restricting access to internal authenticated staff.

The CVSS 4.0 score of 8.7 with total VC/VI/VA impact accurately reflects the severity of post-exploitation access, but several signals moderate the realistic threat level. The PR:L metric confirms that exploitation requires an authenticated account - unauthenticated mass scanning attacks are not feasible. The SSVC assessment reinforces this: Exploitation is rated 'none' (no current in-the-wild activity), and Automatable is 'no', indicating the attack chain is not trivially scriptable at scale, likely due to session management or CSRF controls. Technical Impact is rated 'total', consistent with full server compromise via web shell. EPSS data is not provided in the intelligence feed; absence should not be interpreted as low probability. The combination of no KEV listing, no reported POC, and an available vendor patch places this in a 'patch promptly, not emergency' category for most environments - but organizations where untrusted or external users can authenticate should treat this as higher urgency.

An attacker with a valid low-privileged account authenticates to the document management portal and uses the document upload feature to submit a file with a web shell payload (e.g., a PHP file named with a permitted extension or no extension validation in place). The server stores the file in a web-accessible path and the attacker retrieves it via a direct HTTP request, triggering server-side execution of the shell and gaining interactive OS-level command access. No public exploit code has been reported, but the technique is well-understood and requires no specialized tooling.