CVE-2026-37719: dormakaba evolo Service RCE Vulnerability

CVE-2026-37719 Overview

CVE-2026-37719 is a remote code execution vulnerability in the dormakaba evolo Service. The flaw affects all versions of the service and allows a remote, unauthenticated attacker to execute arbitrary code as SYSTEM through a vulnerable .NET component. The weakness is tracked as CWE-502: Deserialization of Untrusted Data.

The evolo Service manages electronic access control programming for dormakaba locking systems. Exploitation grants full control of the host, enabling attackers to tamper with physical access configurations, pivot into operational technology environments, or deploy ransomware.

Critical Impact

An unauthenticated network attacker can gain SYSTEM-level code execution on any host running the dormakaba evolo Service, compromising access control integrity across the facility.

Affected Products

• dormakaba evolo Service — all versions
• Deployments integrating the evolo Service .NET component for access control management
• Workstations and servers hosting the evolo programming infrastructure

Discovery Timeline

• 2026-10-05 - CVE-2026-37719 published to NVD
• 2026-10-06 - Last updated in NVD database
• Vendor advisory published as DKSA-26-31-031 (advisory PDF)

Technical Details for CVE-2026-37719

Vulnerability Analysis

The evolo Service exposes a .NET component that processes attacker-controlled input over the network. The component deserializes data without validating the resulting object types. Because the service runs as SYSTEM, successful exploitation grants the highest privilege level on Windows hosts.

The attack requires no authentication, no user interaction, and succeeds over the network with low complexity. These conditions produce the maximum CVSS impact ratings across confidentiality, integrity, and availability. The EPSS score of 0.741% reflects an elevated likelihood of exploitation activity relative to average CVEs.

Root Cause

The root cause is insecure deserialization of untrusted data in a .NET component of the evolo Service [CWE-502]. .NET serializers such as BinaryFormatter, NetDataContractSerializer, SoapFormatter, and LosFormatter instantiate arbitrary types during deserialization. When the service accepts a crafted payload containing gadget chains, type instantiation triggers code execution within the service process.

Attack Vector

An attacker reaches the evolo Service over the network and submits a serialized .NET object payload containing a gadget chain, such as those generated by public tools like ysoserial.net. The service deserializes the payload, invokes the embedded gadget, and executes attacker commands under the NT AUTHORITY\SYSTEM account. No credentials are required.

Public proof-of-concept code is not currently available. For technical details, consult the vendor advisory DKSA-26-31-031 referenced in the dormakaba security advisories portal.

Detection Methods for CVE-2026-37719

Indicators of Compromise

• Child processes of the evolo Service parent executable spawning cmd.exe, powershell.exe, rundll32.exe, or other LOLBins under the SYSTEM context
• Unexpected inbound TCP connections to ports exposed by the evolo Service from non-management network segments
• New service installations, scheduled tasks, or registry Run keys created immediately after evolo Service network activity
• Outbound beaconing from hosts running the evolo Service to unknown external addresses

Detection Strategies

• Monitor process lineage for the evolo Service executable and alert on any child process creation that is not part of normal operation
• Deploy network detection rules that identify serialized .NET object signatures, including the AAEAAAD///// base64 marker that indicates BinaryFormatter output
• Correlate authentication logs, service installation events, and firewall logs on hosts running the evolo Service to detect post-exploitation activity

Monitoring Recommendations

• Enable Windows Sysmon with Event IDs 1 (process create), 3 (network connect), and 11 (file create) on evolo Service hosts and forward logs to a central SIEM
• Baseline normal evolo Service network peers and alert on connections from new source addresses
• Audit all SYSTEM-level process executions on access control infrastructure daily

How to Mitigate CVE-2026-37719

Immediate Actions Required

• Restrict network access to the evolo Service using host-based and network firewalls so that only authorized management workstations can reach the service port
• Isolate access control servers on a dedicated VLAN segmented from general corporate and guest networks
• Review the vendor advisory DKSA-26-31-031 and apply the fixed version as soon as dormakaba publishes it
• Inventory all hosts running the evolo Service and verify their patch status

Patch Information

Refer to dormakaba security advisory DKSA-26-31-031 published through the dormakaba security advisories portal for the fixed component version and installation instructions. Monitor the dormakaba website for additional guidance.

Workarounds

• Block inbound traffic to the evolo Service port from untrusted networks at the perimeter and host firewall
• Stop the evolo Service when it is not actively required for programming or configuration tasks
• Require VPN or jump-host access for any administrator connecting to access control infrastructure
• Enable Windows Defender Exploit Guard attack surface reduction rules on hosts running the service to limit post-exploitation behavior

# Example: restrict evolo Service inbound traffic to a single management host on Windows
New-NetFirewallRule -DisplayName "evolo Service - Allow Mgmt Only" `
  -Direction Inbound `
  -Program "C:\Program Files\dormakaba\evolo\evoloService.exe" `
  -RemoteAddress 10.10.20.25 `
  -Action Allow

New-NetFirewallRule -DisplayName "evolo Service - Block All Other" `
  -Direction Inbound `
  -Program "C:\Program Files\dormakaba\evolo\evoloService.exe" `
  -Action Block