CVE-2026-40118 Details
Description
UDP Console provided by Arcserve contains an incorrectly specified destination in a communication channel vulnerability. When a user configures an activation server hostname of the affected product to a dummy URL, the product may unintentionally communicate with the dummy domain, causing information disclosure.
A vulnerability has been identified in the Arcserve UDP Console version 10.3, related to the offline activation process. The issue arises from an incorrectly specified destination in the communication channel, allowing activation traffic to be redirected to a dummy URL. This misconfiguration can lead to unauthorized interception and exposure of sensitive activation data.
Users are advised to apply the patch P00003790, available on the Arcserve Support Portal. The patch should be installed when no active jobs are running, as its installation will restart Arcserve UDP services.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-941 | Incorrectly Specified Destination in a Communication Channel | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | New CVE Received | [email protected] |