GPM LIGHT EUVD-2026-85814

No special conditions - remote unauthenticated exploitation against network-reachable deployments of GPM LIGHT (ezGlobal). Per the description and CVSS PR:N/UI:N/AC:L, an attacker needs only network access to the instance's log-serving endpoint; no credentials, no user interaction, and no special configuration are required. The primary limiting factor is exposure: the instance must be reachable by the attacker (internet-facing or on the attacker's network segment), and the practical impact depends on whether the exposed system logs actually contain sensitive data such as credentials, tokens, or PII versus benign operational messages. Affected versions are unspecified (wildcard CPE), so all deployments should be treated as potentially vulnerable until vendor version guidance is available.

This is a moderate-severity information-disclosure issue whose real-world priority is limited. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivially reachable, unauthenticated, network-based exploitation with no user interaction - the ideal conditions for opportunistic scanning. However, the impact is bounded: only VC:L (low confidentiality), with no integrity (VI:N) or availability (VA:N) effect and no scope change (SC/SI/SA:N), which is why the vendor score lands at 6.9 rather than higher. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no positive signal of active or automated exploitation. The exposed data is 'system logs,' which are useful for reconnaissance (host details, paths, tokens, internal errors) but do not directly grant access. Net assessment: a genuine but not urgent finding - patch in normal cycles, prioritize higher if the logs are known to contain credentials or session data. Missing SSVC data (automatable/technical-impact) and EPSS mean exploitation-likelihood signals are absent rather than reassuringly low.

An unauthenticated attacker discovers a GPM LIGHT instance exposed to the network and sends a direct request to the log-serving endpoint, retrieving system logs without any credentials. The disclosed log contents (internal paths, error traces, and potentially tokens or user data) are then mined for reconnaissance to support follow-on attacks. No public exploit code has been identified at time of analysis, though the low attack complexity makes reproduction straightforward.