CVE-2024-7694: TeamT5 ThreatSonar Anti-Ransomware unrestricted file upload

CVE-2024-7694 · Severity: critical · CVSS 7.2 · Exploited in the wild · Published 2026-02-17

TeamT5 ThreatSonar Anti-Ransomware is a security solution designed to protect corporate endpoints from ransomware attacks. A vulnerability in the platform allows an attacker with administrative access to upload malicious files to the server. If exploited, this could allow the attacker to take full control of the security server, potentially disabling ransomware protections or accessing sensitive internal data.

Technologies: TeamT5 ThreatSonar Anti-Ransomware. Vendors: TeamT5.

Quick answers

Is CVE-2024-7694 exploited in the wild?
Yes. CVE-2024-7694 is known to be exploited in the wild, first recorded on 17 February 2026. Treat it as urgent.
How severe is CVE-2024-7694?
Critical severity, with a CVSS score of 7.2, published 17 February 2026.
Which products and versions are affected?
TeamT5 ThreatSonar Anti-Ransomware versions up to (excluding) 3.5.0.
Is there a fix for CVE-2024-7694?
A patch was published on 2024-09-06: NIST analysis identifies fix in version 3.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-7694 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-7694?
Check whether you run TeamT5 ThreatSonar Anti-Ransomware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability (CWE-434) exists in TeamT5 ThreatSonar Anti-Ransomware due to improper validation of uploaded file content. A remote attacker with high privileges (administrator) can bypass file type restrictions to upload malicious scripts or executables to the product platform. Once uploaded, these files can be executed to achieve arbitrary command execution on the underlying server. This vulnerability has been observed in the wild and is included in the CISA Known Exploited Vulnerabilities (KEV) catalog. The issue is addressed in version 3.5.0.

Affected products

  • TeamT5 ThreatSonar Anti-Ransomware versions up to (excluding) 3.5.0

Timeline

  • 2024-08-12: disclosed: Initial NVD publication
  • 2024-09-06: patched: NIST analysis identifies fix in version 3.5.0
  • 2026-02-17: kev added: Added to CISA Known Exploited Vulnerabilities catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.