CVE-2015-4068

Arcserve UDP vulnerable versions:

CVE-2024-0799

Arcserve UDP (Arcserve Unified Data Protection) 8.1–9.2 is affected by an authentication bypass in edge-app-base-webui.jar, specifically EdgeLoginServiceImpl.doLogin() within wizardLogin. The vulnerability enables bypassing authentication and unauthorized access. Documented impacted versions: 8.1...

CVE-2023-26258

Arcserve UDP

CVE-2023-41998

Summary: CVE-2023-41998 affects Arcserve UDP prior to 9.2 via the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine allows uploading and executing arbitrary files, enabling unauthenticated remote exploitation as described in multiple sources. Affected product/version: Arcserv...

CVE-2024-0801

CVE-2024-0801 affects Arcserve Unified Data Protection (UDP) in the ASNative.dll component. The connected documents specify a denial-of-service (DoS) vulnerability exploitable in UDP versions 8.1 through 9.2, caused by issues in ASNative.dll. Reported impact is system unavailability or crashes, l...

CVE-2018-18659

Arcserve UDP (Arcserve Unified Data Protection) up to version 6.5 Update 4 contains an unauthenticated XML External Entity (XXE) issue in the /management/UdpHttpService endpoint (DDI-VRT-2018-19). This vulnerability is documented across multiple sources and affects UDP 6.5 Update 4 and earlier ve...

CVE-2023-42000

CVE-2023-42000 affects Arcserve UDP, with a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload() that allows unauthenticated remote attackers to upload arbitrary files to locations on the UDP agent’s file system. Affected: Arcserve UDP prior to 9.2. Imp...

CVE-2018-18658

Arcserve UDP before and including 6.5 Update 4 is affected by an unauthenticated information disclosure via the file path /UDPUpdates/Config/FullUpdateSettings.xml (DDI-VRT-2018-20). This CVE (CVE-2018-18658) enables an unauthenticated disclosure of sensitive information in the affected deploymen...

CVE-2018-18657

Arcserve UDP up to 6.5 Update 4 is affected by an unauthenticated information disclosure via the EdgeServiceImpl endpoint (/gateway/services/EdgeServiceImpl). The issue, DDI-VRT-2018-18, allows disclosure of sensitive information without authentication. Affected product: Arcserve Unified Data Pro...

CVE-2018-18660

Arcserve UDP (Arcserve Unified Data Protection) up to 6.5 Update 4 is affected by a reflected Cross-Site Scripting (XSS) in /authenticationendpoint/domain.jsp (DDI-VRT-2018-21). Root cause is input handling leading to script injection; this is a client-side vulnerability that could affect users i...

CVE-2023-41999

Summary: CVE-2023-41999 affects Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier, allowing authentication to the management console and action on authenticated tasks. What’s affected: Arcserve UDP (management console) before v9.2....

CVE-2024-0800

CVE-2024-0800 affects Arcserve Unified Data Protection versions 8.1–9.2. The issue is a path traversal in edge-app-base-webui.jar, specifically ImportNodeServlet, allowing traversal of filesystem paths. Impact details are consistent across sources (high severity per CVSS metrics). PT-Security not...

CVE-2025-34520

CVE-2025-34520 describes an authentication bypass in Arcserve Unified Data Protection (UDP). The issue allows unauthenticated attackers to access administrator-level features by manipulating request parameters or exploiting a logic flaw. Affected: UDP versions prior to 10.2. Patches exist in 10.2...

CVE-2025-34523

CVE-2025-34523 / CVE-2025-34522 (Arcserve UDP) describe heap-based buffer overflow vulnerabilities in the network-facing/input parsing routines of Arcserve Unified Data Protection (UDP). The flaws are pre-authentication and triggered by attacker-controlled input with improper bounds checking, all...

CVE-2025-34522

Arcserve UDP contains a pre-auth heap-based buffer overflow in its input parsing logic (UDP

CVE-2025-34521

CVE-2025-34521 – Arcserve UDP XSS : A reflected cross-site scripting vulnerability exists in the Arcserve Unified Data Protection web interface, where unsanitized input is reflected in HTTP responses. This can allow remote attackers with low privileges to craft malicious links that, when a user v...