CVE-2026-9776
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
A Directory Traversal vulnerability in the writeFileToHttpServletResponse method in ATEN Unizon allows remote attackers to disclose sensitive information without authentication. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations.
Risk Assessment
An attacker can read arbitrary files in the SYSTEM context, leading to the leakage of sensitive data such as passwords, configurations, or user data.
Recommendation
Update ATEN Unizon to the latest version that includes a fix for CVE-2026-9776. Until the update is applied, restrict access to the system to trusted networks only.
Other vulnerabilities in ATEN Unizon
See all- CVE-2026-5057High
Vulnerability in ATEN Unizon RpcProvider allows a remote attacker to cause a denial-of-service (DoS) without authentication. Lack of authentication before accessing RpcProvider functionality enables system overload.
- CVE-2026-9778High
A directory traversal vulnerability in the ImportDeviceList method of ATEN Unizon allows remote code execution. The issue stems from improper validation of a user-supplied path before using it in file operations. Authentication is required for exploitation.
- CVE-2026-9774Medium
The vulnerability in the updateLicense method of ATEN Unizon software allows a remote authenticated attacker to delete arbitrary files on the system. The issue stems from the lack of proper validation of a user-supplied path before using it in file operations.
Original NVD description (English source)
ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability. The specific flaw exists within the writeFileToHttpServletResponse method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-28505.