Read the docs

Arcserve

Records20All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

Arcserve records in CISA KEV
TI-2015-03429 Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability Priority CRITICAL 98KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Udp 16 records CRITICAL Arcserve Unified Data Protection 1 record MEDIUM Brightstor 1 record LOW D2d 1 record HIGH

Records

20 records

TI-2015-03429 CVE-2015-4068 · GHSA-rcg3-4524-mq7j

Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote…

Priority CRITICAL 98KEV

Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) expor…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.63643 Published 2015-05-29 No fix listed CWE-22
TI-2024-00736 CVE-2024-0799 · GHSA-82qq-qr66-5pc5

Authentication Bypass via wizardLogin in Arcserve Unified Data Protection

Priority HIGH 82

An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin() function within wizardLo…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04342 Published 2024-03-13 No fix listed CWE-287
TI-2024-00737 CVE-2024-0800 · GHSA-2473-36w3-q5h4

Authentication Bypass via wizardLogin in Arcserve Unified Data Protection

Priority HIGH 79

A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01034 Published 2024-03-13 No fix listed CWE-434
TI-2020-16926 CVE-2020-27858 · GHSA-9rc6-x736-5w53

XML external entity injection in Arcserve D2D

Priority HIGH 71

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D 16.5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.73828 Published 2021-01-20 No fix listed CWE-611
TI-2024-00738 CVE-2024-0801 · GHSA-2x3m-8px8-74hr

Unauthenticated DoS in Arcserve Unified Data Protection

Priority HIGH 67

A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.41843 Published 2024-03-13 No fix listed CWE-75
TI-2023-22379 CVE-2023-41998 · GHSA-q5h6-hfv2-xr6w

Arcserve UDP Unauthenticated RCE

Priority MEDIUM 58

Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.15274 Published 2023-11-27 Fixed in 9.2 CWE-434
TI-2023-22381 CVE-2023-42000 · GHSA-4xpq-wqf9-p6mv

Arcserve UDP Agent Unauthenticated Path Traversal File Upload

Priority MEDIUM 45

Arcserve UDP prior to 9.2 contains a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload().

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01471 Published 2023-11-27 Fixed in 9.2 CWE-22
TI-2023-22380 CVE-2023-41999 · GHSA-5mpg-rwcj-r8cj

Arcserve UDP Management Authentication Bypass

Priority MEDIUM 45

An authentication bypass exists in Arcserve UDP prior to version 9.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01438 Published 2023-11-27 Fixed in 9.2 CWE-287
TI-2025-24547 CVE-2025-34523 · GHSA-5xjx-j6c2-6ghq

Arcserve UDP < 10.2 Pre-Authentication Heap Overflow

Priority MEDIUM 42

A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP).

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0053 Published 2025-08-27 Fixed in 10.2 CWE-122
TI-2025-24546 CVE-2025-34522 · GHSA-vvg7-q6v7-c4xg

Arcserve UDP < 10.2 Pre-Authentication Heap Overflow

Priority MEDIUM 42

A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Data Protection (UDP).

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00556 Published 2025-08-27 Fixed in 10.2 CWE-122
TI-2006-06385 CVE-2006-6641 · GHSA-4hvj-64cx-35mp

Unspecified vulnerability in CA CleverPath Portal before maintenance version…

Priority LOW 38

Unspecified vulnerability in CA CleverPath Portal before maintenance version 4.71.001_179_060830, as used in multiple products including BrightStor Portal r11.1, CleverPath Aion BPM r10 through r10.2, eTrust Security Com…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02588 Published 2006-12-20 No fix listed
TI-2025-24544 CVE-2025-34520 · GHSA-27qr-6rgm-2f59

Arcserve UDP < 10.2 Authentication Bypass

Priority LOW 36

An authentication bypass vulnerability in Arcserve Unified Data Protection (UDP) allows unauthenticated attackers to gain unauthorized access to protected functionality or user accounts.

CVSS 4.0HIGH 7.7 Adjacent network No auth No interaction EPSS 0.00369 Published 2025-08-27 Fixed in 10.2 CWE-288
TI-2025-24545 CVE-2025-34521 · GHSA-h6g8-8gr5-822r

Arcserve UDP < 10.2 Reflected Cross-Site Scripting (XSS)

Priority LOW 21

A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the Arcserve Unified Data Protection (UDP), where unsanitized user input is improperly reflected in HTTP responses.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00217 Published 2025-08-27 Fixed in 10.2 CWE-79
Open these records in search →