SiteServer SSCMS EUVD-2026-68176

The Agent Installation Workflow component must be accessible over the network, and the SecurityKey-based authorization pathway within it must be reachable. High attack complexity (AC:H from the CVSS 4.0 vector) means the attacker must overcome a non-trivial precondition - likely correct knowledge of request structure, timing, or a partial secret - and the description explicitly states 'exploitation is known to be difficult.' Passive user interaction (UI:P) requires a legitimate user to perform some action before or during exploitation, such as initiating an agent installation session. Exploitation is specific to the Agent Installation Workflow; other SSCMS components are not implicated by available data. What limits exploitation: the high complexity bar, the interaction dependency, and the low-impact ceiling - unauthorized access does not appear to yield full system compromise based on the VC:L/VI:L/VA:L ratings.

The CVSS 4.0 score of 2.3 is low, and the limiting factors embedded in the vector are meaningful: AC:H (high attack complexity) signals the exploit cannot be trivially reproduced, and UI:P (passive user interaction) introduces a dependency on victim behavior that reduces automation potential. All CIA impacts are rated Low (VC:L/VI:L/VA:L), and there is no subsequent-system impact (SC:N/SI:N/SA:N). No EPSS data is available to supplement the CVSS signal, and the vulnerability is not listed in CISA KEV. No public exploit or POC has been identified. The VulDB 'Authentication Bypass' tag suggests the security consequence is qualitatively meaningful - bypassing an installation workflow's authorization could enable unauthorized agent registration - but the high complexity and interaction requirements substantially constrain real-world risk. The absence of a vendor response to the disclosure is a concern for defenders who cannot rely on a patched baseline.

An attacker targeting an internet-accessible SSCMS 7.4.0 deployment crafts a request to the Agent Installation Workflow with a specially constructed or replayed SecurityKey value designed to satisfy the access control check without valid authorization. Successful exploitation requires inducing a passive interaction from a legitimate user - possibly through a timing, session, or request-chaining mechanism - consistent with the UI:P requirement. No public exploit code has been identified, making this scenario dependent on attacker-developed tooling.