Is CVE-2026-9778 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9778 being exploited in the wild.

How severe is CVE-2026-9778?

High severity, with a CVSS score of 7.2, published 24 June 2026.

Which products and versions are affected?

ATEN Unizon 2.7.262.002 and earlier versions prior to 2.7.264.001.

Is there a fix for CVE-2026-9778?

A patch was published on 2026-04-15: Firmware version 2.7.264.001 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9778 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9778?

Check whether you run ATEN Unizon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9778: ATEN Unizon directory traversal remote code execution in ImportDeviceList

CVE-2026-9778 · Severity: high · CVSS 7.2 · Published 2026-06-24

ATEN Unizon, a centralized management platform for AV and IT devices, contains a security flaw in its device list import feature. An authenticated attacker with administrative privileges can exploit this flaw to bypass folder restrictions and run unauthorized commands on the underlying server. This could lead to a complete takeover of the management system and the data it controls, potentially disrupting operations across the connected device network.

Technologies: ATEN Unizon. Vendors: ATEN.

Quick answers

Is CVE-2026-9778 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9778 being exploited in the wild.
How severe is CVE-2026-9778?: High severity, with a CVSS score of 7.2, published 24 June 2026.
Which products and versions are affected?: ATEN Unizon 2.7.262.002 and earlier versions prior to 2.7.264.001.
Is there a fix for CVE-2026-9778?: A patch was published on 2026-04-15: Firmware version 2.7.264.001 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9778 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9778?: Check whether you run ATEN Unizon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A directory traversal vulnerability exists in the ATEN Unizon `/rest/devices/csv` endpoint within the `ImportDeviceList` method. The flaw is caused by insufficient validation of user-supplied file paths during CSV file upload operations. An authenticated attacker with high privileges (PR:H) can provide a manipulated path to escape the intended directory and write or interact with files in restricted locations. Successful exploitation allows for remote code execution in the security context of the SYSTEM account. ATEN has addressed this in firmware version 2.7.264.001.

Affected products

ATEN Unizon 2.7.262.002 and earlier versions prior to 2.7.264.001

Timeline

2026-03-13: disclosed: Vulnerability reported to vendor via ZDI
2026-04-15: patched: Firmware version 2.7.264.001 released
2026-06-24: advisory: Coordinated public release of advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.