CVE-2026-2039

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the configuration of the MArc.Store.Remoting.exe process, which listens on port 8018. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-28597.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-20407.3PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local CVE-2026-204017.5In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected CVE-2026-204026.5In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecCVE-2026-204036.5In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedCVE-2026-204046.5In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecCVE-2026-204056.5In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedCVE-2026-204066.5In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected CVE-2026-204079.3In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilCVE-2026-204088.8In wlan, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of CVE-2026-204097.8In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a maliCVE-2026-20418.8Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers CVE-2026-204106.7In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a mali
CVE-2026-2039: Critical severity, CVSS 9.8 | Vulnix