Is CVE-2026-5057 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5057 being exploited in the wild.

How severe is CVE-2026-5057?

High severity, with a CVSS score of 7.5, published 29 July 2026.

Is there a fix for CVE-2026-5057?

A patch was published on 2026-04-15: Coordinated public release of advisory and vendor update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5057 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5057?

Check whether you run ATEN Unizon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5057: ATEN Unizon missing authentication in RpcProvider

CVE-2026-5057 · Severity: high · CVSS 7.5 · Published 2026-07-29

ATEN Unizon, a centralized management software for AV and power distribution systems, is vulnerable to a flaw that allows an unauthorized person to crash the service. By sending specific requests to the system's communication interface, an attacker can disrupt operations and make the management console unavailable to legitimate users. This could lead to a loss of control over connected hardware and operational downtime.

Technologies: ATEN Unizon. Vendors: ATEN.

Quick answers

Is CVE-2026-5057 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5057 being exploited in the wild.
How severe is CVE-2026-5057?: High severity, with a CVSS score of 7.5, published 29 July 2026.
Which products and versions are affected?: ATEN Unizon 2.6.253.001.
Is there a fix for CVE-2026-5057?: A patch was published on 2026-04-15: Coordinated public release of advisory and vendor update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5057 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5057?: Check whether you run ATEN Unizon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial-of-service vulnerability exists in the RpcProvider class of ATEN Unizon due to missing authentication for critical functions (CWE-306). The software fails to verify the identity of a user before granting access to certain RPC functionality. A remote, unauthenticated attacker can exploit this by sending crafted requests to the RpcProvider interface, leading to a service crash or exhaustion of resources. The vulnerability was reported via ZDI-CAN-29041 and affects version 2.6.253.001. ATEN has released an update to address this issue.

Affected products

ATEN Unizon 2.6.253.001

Timeline

2026-01-30: disclosed: Vulnerability reported to vendor
2026-04-15: patched: Coordinated public release of advisory and vendor update
2026-07-29: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.