CVE-2026-9774

MediumCVSS 6.5/10Last modified Jun 27, 2026

Description

ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.

The specific flaw exists within the updateLicense method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files or create a denial-of-service condition on the system. Was ZDI-CAN-28502.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jun 24, 2026
Last modified
Jun 27, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-977406.5Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to discCVE-2026-977418.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-977428.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-977436.5Use after free in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-977445.5Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.CVE-2026-977458.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-977468.8Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-977478.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-977488.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-977499.8Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-97756.5ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrCVE-2026-977508.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-9774: Medium severity, CVSS 6.5 | Vulnix