CVE-2026-9776: ATEN Unizon directory traversal in writeFileToHttpServletResponse

CVE-2026-9776 · Severity: high · CVSS 7.5 · Published 2026-06-24

ATEN Unizon, a centralized management platform for AV and IT equipment, contains a security flaw that allows unauthorized individuals to access sensitive files on the server. By sending a specially crafted request, an attacker can bypass security restrictions to read any file on the underlying operating system. This could lead to the exposure of system credentials, configuration data, and other confidential information, potentially compromising the entire management network.

Technologies: ATEN Unizon. Vendors: ATEN.

Quick answers

Is CVE-2026-9776 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9776 being exploited in the wild.
How severe is CVE-2026-9776?
High severity, with a CVSS score of 7.5, published 24 June 2026.
Which products and versions are affected?
ATEN Unizon 2.7.262.002.
Is there a fix for CVE-2026-9776?
A patch was published on 2026-04-15: Firmware V2.7.264.001 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9776 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9776?
Check whether you run ATEN Unizon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A directory traversal vulnerability exists in ATEN Unizon within the 'writeFileToHttpServletResponse' method, specifically exposed via the '/rest/history/report/getFile' endpoint. The flaw is caused by insufficient validation of user-supplied file paths before they are used in file system operations. A remote, unauthenticated attacker can exploit this by submitting crafted path sequences (e.g., dot-dot-slash) to access files outside of the intended directory. Because the application runs with NT AUTHORITY\SYSTEM privileges, an attacker can read any file on the host operating system. The issue is addressed in firmware version V2.7.264.001.

Affected products

  • ATEN Unizon 2.7.262.002

Timeline

  • 2026-03-13: disclosed: Vulnerability reported to vendor
  • 2026-04-15: patched: Firmware V2.7.264.001 released
  • 2026-06-24: advisory: Coordinated public release of advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.