ZDI 2026-06-24

ZDI-26-378: ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability

CVE-2026-9774

Machine-generated analysis · WAYSCloud LLM

Authentication is required to exploit this directory traversal vulnerability leading to arbitrary file deletion in ATEN Unizon.

Context

The affected product is ATEN Unizon, specifically its updateLicense functionality. The vulnerability is a directory traversal issue that allows remote attackers to delete arbitrary files. Authentication is required to exploit this vulnerability, as stated in the advisory. The ZDI assigned a CVSS rating of 5.5, indicating a medium severity impact.

Operator considerations

Check: Verify if ATEN Unizon instances are deployed and identify the use of the updateLicense function.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.5. The following CVEs are assigned: CVE-2026-9774.

Read the full advisory on ZDI →