CVE-2015-4068: Arcserve UDP servlet path traversal exposes files and causes DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.1, CISA KEV listing, and high EPSS probability indicate a remotely exploitable, actively exploited flaw with severe confidentiality and availability impact.

What it is

Arcserve UDP before 5.0 Update 4 contains a directory traversal flaw in the reportFileServlet and exportServlet servlets. A crafted file path lets a remote, unauthenticated attacker read sensitive files or disrupt service availability. The flaw is rated critical and has been exploited in the wild per CISA KEV.

Impact

An attacker can read files outside the intended directory, potentially exposing credentials or configuration data, and can cause a denial of service against the affected service.

Attack surface

Reachable over the network through the vulnerable servlets; the CVSS vector shows no privileges or user interaction required, so any host that can reach the service can attempt it.

Exploitation

CVE-2015-4068 is listed in CISA KEV with a 2022-03-25 addition date, and EPSS shows a 30-day probability of roughly 0.64 (99th percentile), indicating active exploitation and high likelihood.

What to do

• Apply Arcserve UDP 5.0 Update 4 or later per the vendor release notes.
• If patching cannot be done immediately, restrict network access to the reportFileServlet and exportServlet endpoints to trusted hosts only.
• Place the UDP service behind a reverse proxy or WAF that normalizes and rejects traversal sequences in request paths.
• Audit the UDP host for exposed sensitive files and rotate any credentials or secrets that may have been readable.
• Monitor vendor advisories for any further updates to the affected servlets.

Detection

• Inspect web server and UDP logs for requests containing traversal sequences such as ../ or encoded variants to reportFileServlet or exportServlet.
• Alert on unusual file read patterns or errors from the UDP service that suggest path manipulation attempts.
• Correlate outbound or local file access by the UDP process with unexpected paths outside its normal data directories.
• Review network traffic to UDP management ports for anomalous request paths from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.