Read the docs
TI-2026-71598 Aliases CVE-2026-101020GHSA-vqwh-j4hj-53p9

Hammock AssetView flaw lets local users gain SYSTEM privileges

Priority LOW 38CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Hammock Corporation AssetView, AssetView CLOUD and AssetView Cloud + contain an incorrect permission assignment for a critical resource (CWE-732). A local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal runs may gain SYSTEM privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00104 1st percentileScored 2026-11-07
Fix Fixed AssetView (Hammock Corporation): Ver 13.2.7BAssetView CLOUD (Hammock Corporation): Ver 13.2.7B (13.2 series), Ver 13.3.7 (13.3 series)+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hammock CorporationAssetView—Ver 13.2.7BPatch availableCNA
Hammock CorporationAssetView CLOUD—Ver 13.2.7B (13.2 series), Ver 13.3.7 (13.3 series)Patch availableCNA
Hammock CorporationAssetView Cloud +—Ver 2600.201.11Patch availableCNA
  • AssetView VendorHammock Corporation Affected — Fixed in Ver 13.2.7B Patch available CNA
  • AssetView CLOUD VendorHammock Corporation Affected — Fixed in Ver 13.2.7B (13.2 series), Ver 13.3.7 (13.3 series) Patch available CNA
  • AssetView Cloud + VendorHammock Corporation Affected — Fixed in Ver 2600.201.11 Patch available CNA

Remediation

Update AssetView to Ver 13.2.7B. Update AssetView CLOUD to Ver 13.2.7B (13.2 series) or Ver 13.3.7 (13.3 series). Update AssetView Cloud + to Ver 2600.201.11.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA AssetView (Hammock Corporation) Fixed in Ver 13.2.7B
  • Fix · CNA AssetView CLOUD (Hammock Corporation) Fixed in Ver 13.2.7B (13.2 series), Ver 13.3.7 (13.3 series)
  • Fix · CNA AssetView Cloud + (Hammock Corporation) Fixed in Ver 2600.201.11

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-101020
  2. 2026-10-13 Alias added: GHSA-vqwh-j4hj-53p9
  3. 2026-10-13 Priority changed: MEDIUM → LOW
  4. 2026-10-16 CISA SSVC decision points changed

References

Other 2

  • TI-2022-11361 Missing authentication in Hammock Corporation AssetView CVSS 3.1CRITICAL 9.8
  • TI-2025-18729 Missing authentication in Hammock Corporation AssetView CVSS 3.0HIGH 8.2
  • TI-2017-01530 Path traversal in Hammock Corporation AssetView for MacOS CVSS 3.0MEDIUM 6.5
  • TI-2024-30539 Cross-site request forgery in Alps System Integration Co., Ltd. InterSafe WebFilter CVSS 3.1MEDIUM 6.5
  • TI-2017-01531 SQL injection in Hammock Corporation AssetView for MacOS CVSS 3.0MEDIUM 6.3
  • TI-2025-20094 AssetView and AssetView CLOUD contain an issue with acquiring sensitive information from… CVSS 3.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences