Is CVE-2026-5492 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5492 being exploited in the wild.

How severe is CVE-2026-5492?

Medium severity, with a CVSS score of 6.5, published 29 July 2026.

Which products and versions are affected?

DriveLock Enterprise Service <= 24.2.8, <= 25.1.6, <= 25.2.3.

Is there a fix for CVE-2026-5492?

A patch was published on 2026-07-29: NVD publication date Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5492 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5492?

Check whether you run DriveLock Enterprise Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5492: DriveLock Enterprise Service directory traversal in web service

Q: Is there a fix for CVE-2026-5492?

A patch was published on 2026-07-29: NVD publication date Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-5492 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-5492?

Check whether you run DriveLock Enterprise Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5492 · Severity: medium · CVSS 6.5 · Published 2026-07-29

DriveLock Enterprise Service, a platform used for endpoint security and device control, contains a vulnerability in its web service. An authenticated attacker can exploit this flaw to access sensitive files on the server that should normally be restricted. This could lead to the exposure of configuration data or other internal system information, potentially compromising the security of the management infrastructure.

Vendors: DriveLock.

Quick answers

Is CVE-2026-5492 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5492 being exploited in the wild.
How severe is CVE-2026-5492?: Medium severity, with a CVSS score of 6.5, published 29 July 2026.
Which products and versions are affected?: DriveLock Enterprise Service <= 24.2.8, <= 25.1.6, <= 25.2.3.
Is there a fix for CVE-2026-5492?: A patch was published on 2026-07-29: NVD publication date Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5492 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5492?: Check whether you run DriveLock Enterprise Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A directory traversal vulnerability exists within the DriveLock Enterprise Service (DES) web service, which typically listens on TCP port 4568. The root cause is a failure to properly validate user-supplied file paths before they are used in file system operations. An authenticated remote attacker can use directory traversal sequences (e.g., '..') to bypass intended directory restrictions and read arbitrary files in the security context of the service account. The vulnerability is addressed in versions 24.2.9, 25.1.7, and 25.2.4.

Affected products

DriveLock DriveLock Enterprise Service (DES) <= 24.2.8, <= 25.1.6, <= 25.2.3

Timeline

2026-02-06: disclosed: Vulnerability reported to vendor
2026-02-06: advisory: First published by vendor
2026-04-15: advisory: Coordinated public release by ZDI
2026-07-29: patched: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.