CVE-2015-4068

Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to...

9.1 CriticalIn KEV

Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: High

Exploit likelihood

63.6%Up 62.4 points since Feb 4, 2022

What each source reports

NVD Score used 9.1

Record: CVE-2015-4068
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0: 9.4 HighAV:N/AC:L/Au:N/C:C/I:N/A:C
Weakness: CWE-22
Updated: 2026-11-02

CVE List 9.1

Record: CVE-2015-4068
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2015-4094 9.1

Record: EUVD-2015-4094
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rcg3-4524-mq7j 9.1

Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to...

Record: GHSA-rcg3-4524-mq7j
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-22
Updated: 2026-11-02

CISA KEV No score

Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability

Directory traversal vulnerability in Arcserve UDP allows remote attackers to obtain sensitive information or cause a denial of service.

Record: CVE-2015-4068
Weakness: CWE-22
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-4068 is a critical vulnerability (CVSS 9.1) in Arcserve Udp, published May 29, 2015. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 63.6%, the 99th percentile. No source names a fixed version.