Is CVE-2026-5489 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5489 being exploited in the wild.

How severe is CVE-2026-5489?

Medium severity, with a CVSS score of 5.3, published 29 July 2026.

Which products and versions are affected?

DriveLock SE DriveLock Enterprise Service (DES) <= 24.2.8, <= 25.1.6, <= 25.2.3.

Is there a fix for CVE-2026-5489?

A patch was published on 2026-02-06: First published date of security bulletin Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5489 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5489?

Check whether you run DriveLock SE DriveLock Enterprise Service (DES) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5489: DriveLock Enterprise Service directory traversal information disclosure

Q: Is there a fix for CVE-2026-5489?

A patch was published on 2026-02-06: First published date of security bulletin Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-5489 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-5489?

Check whether you run DriveLock SE DriveLock Enterprise Service (DES) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5489 · Severity: medium · CVSS 5.3 · Published 2026-07-29

DriveLock Enterprise Service, a platform used for endpoint security and device control, contains a vulnerability in its web service. An unauthenticated attacker can exploit this flaw to access sensitive configuration data that should be restricted to internal users. This could lead to the exposure of global or tenant-specific settings, potentially aiding further attacks against the organization's security infrastructure.

Quick answers

Is CVE-2026-5489 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5489 being exploited in the wild.
How severe is CVE-2026-5489?: Medium severity, with a CVSS score of 5.3, published 29 July 2026.
Which products and versions are affected?: DriveLock SE DriveLock Enterprise Service (DES) <= 24.2.8, <= 25.1.6, <= 25.2.3.
Is there a fix for CVE-2026-5489?: A patch was published on 2026-02-06: First published date of security bulletin Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5489 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5489?: Check whether you run DriveLock SE DriveLock Enterprise Service (DES) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A directory traversal vulnerability exists in the DriveLock Enterprise Service (DES) web API, which typically listens on TCP port 4568. The flaw is caused by a misconfigured reverse proxy and a lack of proper validation of user-supplied paths before they are used in file operations. By using URL manipulation and encoding techniques (such as obfuscating '..' sequences), a remote, unauthenticated attacker can bypass access controls to reach internal endpoints. This allows for the unauthorized retrieval of global and tenant configuration files in the context of the service account. The issue is addressed in versions 24.2.9, 25.1.7, and 25.2.4.

Affected products

DriveLock DriveLock Enterprise Service (DES) <= 24.2.8, <= 25.1.6, <= 25.2.3

Timeline

2026-02-06: disclosed: Vulnerability reported to vendor
2026-02-06: patched: First published date of security bulletin
2026-04-15: advisory: Coordinated public release by ZDI
2026-07-29: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.