CVE-2024-9537: ScienceLogic SL1 third-party component flaw allows unauthenticated remote compromise

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.3 unauthenticated network-exploitable flaw with confirmed zero-day exploitation and CISA KEV listing, though the undisclosed component limits precise detection.

What it is

ScienceLogic SL1 (formerly EM7) contains an unspecified vulnerability in an unspecified third-party component packaged with the product. The flaw is remotely reachable without authentication and rated CVSS 4.0 9.3 Critical, and it was exploited as a zero-day in the Rackspace breach. Because the vulnerable component and root cause are not disclosed, defenders must rely on vendor patching rather than signature-level understanding.

Impact

An unauthenticated remote attacker can achieve high confidentiality, integrity and availability impact on the SL1 host, potentially leading to full compromise of the monitoring platform and data it holds. In the observed incident, monitoring data was stolen.

Attack surface

Reachable over the network per the CVSS vector (AV:N/AC:L/PR:N/UI:N), so no authentication or user interaction is required. The specific exposed interface is not identified in the record because the vulnerable third-party component is unspecified.

Exploitation

CVE-2024-9537 is listed in CISA KEV (added 2024-10-21, due 2024-11-11) and press reporting links it to a zero-day used in the Rackspace breach; EPSS 30-day probability is 0.038 (89.5th percentile). No ransomware campaign use is recorded.

What to do

• Upgrade SL1 to 12.1.3+, 12.2.3+, or 12.3+ immediately; apply the vendor remediations provided for older lines 10.1.x, 10.2.x, 11.1.x, 11.2.x and 11.3.x.
• If patching cannot be completed by the CISA KEV due date (2024-11-11), isolate or discontinue use of the affected SL1 deployment per CISA guidance.
• Restrict network access to SL1 management and component interfaces to trusted administrative networks only.
• Review vendor KB articles (support.sciencelogic.com article 15465 and 15527) for component-specific guidance, noting they require support credentials.
• Monitor vendor advisories for disclosure of the affected third-party component so compensating controls can be targeted.

Detection

• Hunt for unexpected outbound or inbound network connections to and from SL1 hosts, especially to unfamiliar external addresses.
• Review SL1 host logs and process execution for activity tied to bundled third-party utilities, since the vulnerable component is unspecified.
• Correlate SL1 host telemetry with authentication and data-access logs for anomalous access to monitoring data.
• Track CISA KEV and vendor advisory updates for the component name to build targeted detections once disclosed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.