Armatura One EUVD-2026-91831

Exploitation requires (1) local access to the host operating system running Armatura One, and (2) sufficient privileges to read the log file where the backup/restore routine records the full database connection command; it is further contingent on a backup or restore operation having actually been executed, since that is what writes the superuser password into the log in plaintext. Limiting factors: this is not remotely reachable (AV:L), requires some level of local privilege (PR:L), and yields credentials that are only useful where the attacker can reach the database - so the realistic risk is post-compromise privilege escalation or insider abuse rather than external attack.

This is a credible but access-gated risk rather than a drive-by critical. The authoritative CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 8.5 because, once the precondition of local host access is met, the payoff is total: VC:H/VI:H/VA:H reflect disclosure of the database superuser password, which grants full read/write/destroy control of the backing database. The gating factors are significant, however - AV:L means the attacker must already have access to the server operating system, and PR:L means some local privilege is required, so this is a privilege-escalation / post-compromise lateral-movement finding, not a remote entry point. No EPSS score, KEV listing, or public POC was provided; per the signals available this is 'no public exploit identified at time of analysis,' and the description itself notes the disclosed credentials are only usable 'when access to the server operating system is available,' which is consistent with the local attack vector and argues against mass or remote exploitation. Net: a real priority for environments where Armatura One is deployed and where OS-level access by lower-privileged users or a prior foothold is plausible, but lower urgency than its 8.5 base score implies for internet-facing triage because it is not remotely reachable.

An attacker or low-privileged insider who has already gained access to the host operating system (for example via a separate foothold or an over-permissioned service account) reads the plaintext backup/restore log file, extracts the database superuser password recorded there, and then authenticates directly to the database with full administrative control. No public exploit code is required - the attack is simply reading a log file, consistent with the local attack vector and low complexity.