CVE-2026-2037

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2037", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2026-02-06T01:12:24.883Z", "datePublished": "2026-02-20T22:13:24.043Z", "dateUpdated": "2026-02-24T15:01:28.418Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-02-20T22:13:24.043Z"}, "title": "GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability", "descriptions": [{"lang": "en", "value": "GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the configuration of the MArc.Core.Remoting.exe process, which listens on port 8017. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-27935."}], "affected": [{"vendor": "GFI", "product": "Archiver", "versions": [{"version": "15.10", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-074/", "name": "ZDI-26-074", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-02-06T01:12:24.899Z", "datePublic": "2026-02-12T21:49:06.136Z", "source": {"lang": "en", "value": "Anonymous"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T15:00:58.731803Z", "id": "CVE-2026-2037", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T15:01:28.418Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2037", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-24T15:00:58.731803Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T15:01:22.661Z"}}], "cna": {"title": "GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability", "source": {"lang": "en", "value": "Anonymous"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "GFI", "product": "Archiver", "versions": [{"status": "affected", "version": "15.10"}], "defaultStatus": "unknown"}], "datePublic": "2026-02-12T21:49:06.136Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-074/", "name": "ZDI-26-074", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-02-06T01:12:24.899Z", "descriptions": [{"lang": "en", "value": "GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the configuration of the MArc.Core.Remoting.exe process, which listens on port 8017. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-27935."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-02-20T22:13:24.043Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2037", "state": "PUBLISHED", "dateUpdated": "2026-02-24T15:01:28.418Z", "dateReserved": "2026-02-06T01:12:24.883Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2026-02-20T22:13:24.043Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Archiver", "vendor": "GFI", "versions": [{"status": "affected", "version": "15.10"}]}], "source": "zdi-disclosures@trendmicro.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gfi:archiver:15.10:*:*:*:*:*:*:*", "matchCriteriaId": "7191FB98-8BE2-4921-8035-6750A76F8491", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the configuration of the MArc.Core.Remoting.exe process, which listens on port 8017. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-27935."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo por deserializaci\u00f3n de datos no confiables en MArc.Core de GFI Archiver. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en instalaciones afectadas de GFI Archiver. Aunque se requiere autenticaci\u00f3n para explotar esta vulnerabilidad, el mecanismo de autenticaci\u00f3n existente puede ser eludido.\n\nLa falla espec\u00edfica existe dentro de la configuraci\u00f3n del proceso MArc.Core.Remoting.exe, que escucha en el puerto 8017. El problema resulta de la falta de validaci\u00f3n adecuada de los datos proporcionados por el usuario, lo que puede resultar en la deserializaci\u00f3n de datos no confiables. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto de SYSTEM. Fue ZDI-CAN-27935."}], "id": "CVE-2026-2037", "lastModified": "2026-06-17T10:30:10.743", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2037", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T15:00:58.731803Z", "version": "2.0.3"}}]}, "published": "2026-02-20T23:16:03.643", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-074/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "15.10"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Archiver", "source": "cna", "vendor": "GFI"}, "product": "archiver", "vendor": "gfi"}], "analysis": {"en": {"generated_at": "2026-04-17T17:05:59.049399+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2019s security patch for GFI Archiver 15.10 to eliminate the deserialization vulnerability.", "Restrict network access to the MArc.Core.Remoting.exe service on port 8017, using firewall or segmentation, to limit exposure to trusted hosts.", "Enforce strong, multi\u2011factor authentication or disable the remote remoting feature until the patch is deployed.", "Review system logs for unusual deserialization or remote connection activity to detect attempts to bypass authentication."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The flaw affects GFI Archiver version 15.10, which runs the MArc.Core.Remoting.exe process listening on port 8017. Only installations of the specified vendor product version are known to be susceptible, and no other versions are listed in the available data.", "description_and_impact": "A deserialization flaw in GFI Archiver\u2019s MArc.Core.Remoting.exe allows an attacker to execute arbitrary code in the context of SYSTEM. The vulnerability arises because the software fails to validate data supplied to the deserialization routine for that component. Exploiting it enables remote execution of attacker\u2011controlled code, potentially compromising the entire host. The weakness is classified as CWE\u2011502, Deserialization of Untrusted Data.", "risk_and_exploitability": "The severity score of 8.8 indicates a high\u2011impact attack, and the exploitation probability, as reflected by an EPSS score of less than 1 percent, suggests that real\u2011world exploitation is currently low. The vulnerability requires authentication, but the input mentions that the existing authentication can be bypassed, implying that an attacker could succeed even without valid credentials. Because the remote endpoint is exposed on port 8017, the attack vector is likely network\u2011based. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, so no documented active exploits are known at this time. Nevertheless, the combination of high impact and potential authentication bypass warrants urgent attention."}}}}, "created": "2026-02-23T14:34:54.573610+00:00", "updated": "2026-04-17T17:15:23.716034+00:00", "vendors": ["gfi", "gfi$PRODUCT$archiver"]}