Skip to content
OpenAdvisories

Vendor

Arcserve

12 known vulnerabilities.

Arcserve at a glance

Last 12 months
1
Critical · all time
6
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 1 vulnerability May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202610
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202542
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Unified Data Protection (UDP) 4 Unified Data Protection 3 Arcserve UDP 3 UDP Console 1 D2D 1 Unified Data Protection < 9.2 0

Latest advisories

  • High max 9.2
    WID-SEC-2025-1881 4 CVEs rev. 2

    Arcserve Unified Data Protection: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Arcserve Unified Data Protection ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, beliebigen Code auszuführen oder einen Denial-of-Service-Zustand zu verursachen.

    Arcserve Windows
    first Aug 20, 2025
  • High max 9.2
    NCSC-2025-0271 4 CVEs

    Kwetsbaarheden verholpen in Arcserve Unified Data Protection

    Arcserve heeft kwetsbaarheden verholpen in Arcserve Unified Data Protection (UDP) voor alle versies vóór 10.2.

    Arcserve
  • High max 9.8
    WID-SEC-2024-0635 3 CVEs rev. 2

    Arcserve Unified Data Protection: Mehrere Schwachstellen

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Arcserve Unified Data Protection ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.

    Arcserve Linux Windows
    first Mar 13, 2024
  • High max 9.8
    WID-SEC-2023-3031 3 CVEs rev. 2

    Arcserve Unified Data Protection: Mehrere Schwachstellen

    Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Arcserve Unified Data Protection ausnutzen, um beliebigen Code auszuführen, Dateien zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.

    Arcserve Linux Windows
    first Nov 29, 2023
All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • Medium 6.3
    CVE-2026-40118

    UDP Console provided by Arcserve contains an incorrectly specified destination in a communication channel vulnerability…

    Arcserve UDP Console
  • High 7.7
    CVE-2025-34520

    Arcserve UDP < 10.2 Authentication Bypass

    An authentication bypass vulnerability in Arcserve Unified Data Protection (UDP) allows unauthenticated attackers to gain unauthorized access to protected functionality or user accounts. By manipulating specific request parameters or exploiting a logic flaw, …

    Arcserve Unified Data Protection (UDP)
  • Medium 4.8
    CVE-2025-34521

    Arcserve UDP < 10.2 Reflected Cross-Site Scripting (XSS)

    A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the Arcserve Unified Data Protection (UDP), where unsanitized user input is improperly reflected in HTTP responses. This flaw allows remote attackers with low privileges to cr…

    Arcserve Unified Data Protection (UDP)
  • Critical 9.2
    CVE-2025-34522

    Arcserve UDP < 10.2 Pre-Authentication Heap Overflow

    A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Data Protection (UDP). This flaw can be triggered without authentication by sending specially crafted input to the target system. Improper bounds checking allows …

    Arcserve Unified Data Protection (UDP)
  • Critical 9.2
    CVE-2025-34523

    Arcserve UDP < 10.2 Pre-Authentication Heap Overflow

    A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP). This flaw is reachable without authentication and results from improper bounds checking when processing attacker-control…

    Arcserve Unified Data Protection (UDP)
  • High 7.5
    CVE-2024-0801 EPSS 42%

    Unauthenticated DoS in Arcserve Unified Data Protection

    A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll.

    Arcserve Unified Data Protection
  • High 8.8
    CVE-2024-0800

    Authentication Bypass via wizardLogin in Arcserve Unified Data Protection

    A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet.

    Arcserve Unified Data Protection
  • Critical 9.8
    CVE-2024-0799

    Authentication Bypass via wizardLogin in Arcserve Unified Data Protection

    An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin() function within wizardLogin.

    Arcserve Unified Data Protection
  • Critical 9.8
    CVE-2023-42000

    Arcserve UDP Agent Unauthenticated Path Traversal File Upload

    Arcserve UDP prior to 9.2 contains a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload(). An unauthenticated remote attacker can exploit it to upload arbitrary files to any location on the file system where the UDP…

    Arcserve Arcserve UDP
  • Critical 9.8
    CVE-2023-41999

    Arcserve UDP Management Authentication Bypass

    An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that allows them to authenticate to the management console and perform tasks that require authentication.

    Arcserve Arcserve UDP
  • Critical 9.8
    CVE-2023-41998 EPSS 15%

    Arcserve UDP Unauthenticated RCE

    Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists that allows an attacker to upload and execute arbitrary files.

    Arcserve Arcserve UDP
  • High 7.5
    CVE-2020-27858 EPSS 74%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D…

    Arcserve D2D