Is CVE-2026-9779 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9779 being exploited in the wild.

How severe is CVE-2026-9779?

High severity, with a CVSS score of 7.2, published 24 June 2026.

Is there a fix for CVE-2026-9779?

A patch was published on 2026-04-15: Fixed version V2.7.264.001 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9779 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9779?

Check whether you run ATEN Unizon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9779: ATEN Unizon remote code execution via improper signature verification

CVE-2026-9779 · Severity: high · CVSS 7.2 · Published 2026-06-24

ATEN Unizon, a centralized management platform for AV and IT equipment, contains a security flaw in how it handles software updates. An attacker with administrative credentials can bypass security checks to upload a malicious update package. If successful, the attacker can take full control of the server, potentially leading to data theft or complete service disruption.

Technologies: ATEN Unizon. Vendors: ATEN.

Quick answers

Is CVE-2026-9779 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9779 being exploited in the wild.
How severe is CVE-2026-9779?: High severity, with a CVSS score of 7.2, published 24 June 2026.
Which products and versions are affected?: ATEN Unizon 2.6.253.001.
Is there a fix for CVE-2026-9779?: A patch was published on 2026-04-15: Fixed version V2.7.264.001 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9779 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9779?: Check whether you run ATEN Unizon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A remote code execution vulnerability exists in ATEN Unizon's 'updateWar' method within the 'doCryptoHugeFileToFile' function. The application fails to properly verify cryptographic signatures when processing update packages via the 'rest/system/information' endpoint. Specifically, the system utilizes a hard-coded secret for encryption/decryption, allowing an attacker with high-level (administrative) privileges to craft and encrypt a malicious WAR file. Upon processing this file, the application executes the payload in the context of the SYSTEM user. This vulnerability is addressed in firmware version V2.7.264.001.

Affected products

ATEN Unizon 2.6.253.001

Timeline

2026-03-13: disclosed: Vulnerability reported to vendor
2026-04-15: patched: Fixed version V2.7.264.001 released
2026-06-24: advisory: Coordinated public release of advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.