# CVE-2026-5492: DriveLock Enterprise Service directory traversal in web service

Source: https://junglewise.ai/threats/cve-2026-5492-drivelock-enterprise-service-directory-traversal-in-web-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-5492 · Severity: medium · CVSS 6.5 · Published 2026-07-29

DriveLock Enterprise Service, a platform used for endpoint security and device control, contains a vulnerability in its web service. An authenticated attacker can exploit this flaw to access sensitive files on the server that should normally be restricted. This could lead to the exposure of configuration data or other internal system information, potentially compromising the security of the management infrastructure.

Vendors: [DriveLock](https://junglewise.ai/threats/vendors/drivelock).

## Quick answers

**Is CVE-2026-5492 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5492 being exploited in the wild.

**How severe is CVE-2026-5492?** Medium severity, with a CVSS score of 6.5, published 29 July 2026.

**Which products and versions are affected?** DriveLock Enterprise Service <= 24.2.8, <= 25.1.6, <= 25.2.3.

**Is there a fix for CVE-2026-5492?** A patch was published on 2026-07-29: NVD publication date Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5492 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-5492?** Check whether you run DriveLock Enterprise Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A directory traversal vulnerability exists within the DriveLock Enterprise Service (DES) web service, which typically listens on TCP port 4568. The root cause is a failure to properly validate user-supplied file paths before they are used in file system operations. An authenticated remote attacker can use directory traversal sequences (e.g., '..') to bypass intended directory restrictions and read arbitrary files in the security context of the service account. The vulnerability is addressed in versions 24.2.9, 25.1.7, and 25.2.4.

## Affected products

- DriveLock DriveLock Enterprise Service (DES) <= 24.2.8, <= 25.1.6, <= 25.2.3

## Timeline

- 2026-02-06: disclosed: Vulnerability reported to vendor
- 2026-02-06: advisory: First published by vendor
- 2026-04-15: advisory: Coordinated public release by ZDI
- 2026-07-29: patched: NVD publication date

## References

- [https://www.drivelock.help/sb/Content/SecurityBulletins/26-003-PathValidation.htm](https://www.drivelock.help/sb/Content/SecurityBulletins/26-003-PathValidation.htm)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-288/](https://www.zerodayinitiative.com/advisories/ZDI-26-288/)

## Related threats

- [DriveLock Enterprise Service SQL injection in RQL translation layer](https://junglewise.ai/threats/cve-2026-5490-drivelock-enterprise-service-sql-injection-in-rql-translation)