CowAgent EUVD-2026-97038

Exploitation requires an authenticated low-privilege session on the CowAgent Web Console (CVSS PR:L) and network reachability of that console; the attacker specifically targets the 'read' function of the /upload endpoint in the Web Console component. No user interaction is needed (UI:N). The key limiting factors are: valid credentials/authenticated access to the console are mandatory (this is not an unauthenticated internet-wide exploit), the affected product is CowAgent at or below version 2.1.6, and impact is restricted to denial of service with partial integrity - there is no confidentiality exposure or remote code execution. No vendor-supplied fix is confirmed, so remediation currently depends on restricting console access to trusted users.

This is a low-to-moderate real-world risk that should not be prioritized ahead of more impactful issues. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity attack, but it requires PR:L - the attacker must already hold low-level authenticated access to the Web Console, which substantially limits the exploit population to insiders or attackers who have already obtained valid credentials. Impact is confined to availability and partial integrity (VC:N/VI:L/VA:L); there is no confidentiality loss and no code execution, consistent with the CWE-404 (improper resource release) denial-of-service classification. Positive signals are limited: a public POC exists (GitHub, via VulDB submission) and the 4.0 vector carries E:P (proof-of-concept exploit maturity), but the vulnerability is NOT on the CISA KEV list and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. The signals are internally consistent rather than conflicting - a credentialed DoS with a public PoC but no in-the-wild activity. Note the data originates solely from VulDB (a single CNA/aggregator) with no independent vendor advisory, and the vendor explicitly did not respond to disclosure, so affected-version boundaries and a fix are unverified.

An authenticated low-privilege user of the CowAgent Web Console sends a crafted request to the /upload endpoint, abusing the file 'read' function so that a resource is improperly handled or never released, exhausting server resources and rendering the console unavailable to legitimate users. A public proof-of-concept for this directory/file upload DoS is available on GitHub, lowering the skill required to reproduce the condition. Because exploitation only degrades availability (and minor integrity) without granting data access or code execution, impact is limited to service disruption.