Executive brief
RayVentory Scan Engine is an IT asset discovery and inventory solution. A vulnerability in its scanning component allows an attacker to gain elevated system privileges by manipulating environment variables to point to malicious files. This could lead to full system takeover, unauthorized data access, or disruption of inventory operations. Note that some vendors dispute this vulnerability, arguing it requires a pre-existing system misconfiguration to exploit.
Technical details
The RayVentory Scan Engine (specifically the rvia and ndtrack binaries) is vulnerable to an uncontrolled search path element (CWE-427). The application invokes system binaries (such as curl, cat, and sh) and loads shared objects (.so files) using relative paths rather than absolute paths. If an attacker can modify the PATH environment variable or place files in the current working directory, they can force the application to execute malicious binaries or load arbitrary shared objects. While the CVSS score is high, the vulnerability is disputed by some because the ability to control environment variables often implies a prior level of access or a specific system misconfiguration.
Affected products
- Raynet RayVentory Scan Engine through 12.6 Update 8
Timeline
- 2026-05-08: disclosed: Initial CVE publication
- 2026-05-11: advisory: NVD enrichment and CISA-ADP updates