CVE-2006-6076: CA BrightStor ARCserve Backup Tape Engine RPC buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 10.0 with network reachability, no authentication, and full confidentiality, integrity, and availability impact, combined with a very high EPSS score, makes this a top-priority exposure for any unpatched ARCserve 11.5 or earlier host.

What it is

The Tape Engine (tapeeng.exe) in CA BrightStor ARCserve Backup 11.5 and earlier contains a buffer overflow reachable through certain RPC requests to TCP port 6502. Successful exploitation allows remote code execution on the backup server, which typically holds broad access to stored data and other systems.

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the Tape Engine service, potentially taking full control of the backup server. Because backup servers often store credentials and reach many hosts, compromise can extend well beyond the single system.

Attack surface

Reachable over the network via RPC requests to TCP port 6502; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required. Any host that can reach the Tape Engine port can attempt the attack.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.70858, 99.368th percentile), indicating substantial predicted exploitation activity. References include public advisories and mailing-list posts, though no reference is tagged as an exploit.

What to do

• Apply the vendor fix for BrightStor ARCserve Backup Tape Engine referenced in CA's security notice and advisory; upgrade to a supported version if 11.5 or earlier is still in use.
• Restrict network access to TCP port 6502 so only trusted management hosts can reach the Tape Engine.
• Segment backup servers from general user networks and the internet, since they hold sensitive data and credentials.
• If the product is end-of-life and cannot be patched, isolate or decommission the affected server.
• Monitor vendor and CERT/CC advisories for updated guidance on this and related ARCserve issues.

Detection

• Monitor network traffic to TCP port 6502 for unexpected or malformed RPC requests, especially from hosts outside the backup management subnet.
• Alert on crashes or restarts of tapeeng.exe, which may indicate exploitation attempts.
• Review Tape Engine and system logs for anomalous process creation or unexpected child processes spawned by the service.
• Baseline normal RPC clients for port 6502 and alert on new or unusual source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.