Is CVE-2026-5487 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5487 being exploited in the wild.

How severe is CVE-2026-5487?

High severity, with a CVSS score of 7.5, published 29 July 2026.

Which products and versions are affected?

DriveLock SE DriveLock Enterprise Service (DES) <= 24.2.8, <= 25.1.6, <= 25.2.3.

Is there a fix for CVE-2026-5487?

A patch was published on 2026-02-06: First publication of security bulletin by vendor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5487 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5487?

Check whether you run DriveLock SE DriveLock Enterprise Service (DES) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5487: DriveLock Enterprise Service directory traversal information disclosure

Q: Is there a fix for CVE-2026-5487?

A patch was published on 2026-02-06: First publication of security bulletin by vendor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-5487 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-5487?

Check whether you run DriveLock SE DriveLock Enterprise Service (DES) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5487 · Severity: high · CVSS 7.5 · Published 2026-07-29

DriveLock Enterprise Service, a platform used for endpoint security and device control, contains a security flaw in its web service. An unauthenticated remote attacker can exploit this to access sensitive files stored on the server's file system. This could lead to the exposure of configuration data or other internal information, potentially compromising the security of the managed environment.

Quick answers

Is CVE-2026-5487 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5487 being exploited in the wild.
How severe is CVE-2026-5487?: High severity, with a CVSS score of 7.5, published 29 July 2026.
Which products and versions are affected?: DriveLock SE DriveLock Enterprise Service (DES) <= 24.2.8, <= 25.1.6, <= 25.2.3.
Is there a fix for CVE-2026-5487?: A patch was published on 2026-02-06: First publication of security bulletin by vendor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5487 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5487?: Check whether you run DriveLock SE DriveLock Enterprise Service (DES) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A directory traversal vulnerability (CWE-22) exists in the DriveLock Enterprise Service (DES) web service, which typically listens on TCP port 4568. The flaw is caused by insufficient validation of user-supplied file paths containing sequences such as '..'. An unauthenticated remote attacker can exploit this by sending a crafted network request to access arbitrary files outside the intended directory in the context of the service account. The vulnerability is fixed in versions 24.2.9, 25.1.7, and 25.2.4.

Affected products

DriveLock DriveLock Enterprise Service (DES) <= 24.2.8, <= 25.1.6, <= 25.2.3

Timeline

2026-02-06: disclosed: Vulnerability reported to vendor
2026-02-06: patched: First publication of security bulletin by vendor
2026-04-15: advisory: Coordinated public release of ZDI advisory
2026-07-29: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.