CVE-2026-8360 Overview
CVE-2026-8360 is a null pointer dereference vulnerability [CWE-476] affecting the Triofox Server Agent. Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() from multiple dependent DLLs return a NULL pointer when no user is logged into the Triofox Server Agent Management Console. The returned pointer is dereferenced without validation, causing the process to crash. Affected modules include WOSProfileMgrModule.dll and WOSWebDavModule.dll. The flaw is remotely reachable over the network without authentication or user interaction, producing a denial-of-service condition against the Triofox service.
Critical Impact
Unauthenticated remote attackers can trigger a null pointer dereference in Triofox Server Agent DLLs, crashing the service and disrupting file sharing operations.
Affected Products
- Triofox Server Agent (WOSCommonUtil.dll)
- Triofox Profile Manager Module (WOSProfileMgrModule.dll)
- Triofox WebDAV Module (WOSWebDavModule.dll)
Discovery Timeline
- 2026-05-27 - CVE-2026-8360 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-8360
Vulnerability Analysis
The vulnerability resides in WOSCommonUtil.dll, specifically the exported function WOSSysInfoGetDeviceInterface(). Multiple Triofox modules call this function to retrieve a device interface pointer used for downstream system information queries. When no user is currently logged into the Triofox Server Agent Management Console, the function returns NULL to signal the absence of an active session context.
Callers in WOSProfileMgrModule.dll and WOSWebDavModule.dll proceed to dereference the returned pointer without checking it. The dereference triggers an access violation in the worker process, terminating the affected service component. Because the WebDAV and Profile Manager paths are reachable over the network, an unauthenticated remote client can repeatedly trigger the crash and prevent legitimate use of the file-sharing service.
Root Cause
The root cause is missing return-value validation [CWE-476]. The calling code assumes WOSSysInfoGetDeviceInterface() always returns a valid object pointer and skips the standard null check before invoking methods through that pointer. The function's contract permits a NULL return under the documented "no logged-in user" condition, making the absent check a direct contract violation.
Attack Vector
An unauthenticated attacker sends a network request to a Triofox endpoint serviced by WOSProfileMgrModule.dll or WOSWebDavModule.dll while no console operator is logged in. The handler invokes WOSSysInfoGetDeviceInterface(), receives NULL, and dereferences it. The resulting access violation crashes the service, yielding a denial-of-service outcome. The vulnerability does not enable code execution or data disclosure. See the Tenable Security Research Report for protocol-level reproduction details.
Detection Methods for CVE-2026-8360
Indicators of Compromise
- Unexpected termination of the Triofox Server Agent process with access violation (0xC0000005) exceptions referencing WOSCommonUtil.dll, WOSProfileMgrModule.dll, or WOSWebDavModule.dll.
- Repeated Windows Error Reporting (WER) crash dumps for the Triofox service correlated with inbound WebDAV or profile management requests.
- Service restart loops or watchdog-triggered relaunches of the Triofox Server Agent during periods with no logged-in console user.
Detection Strategies
- Monitor Windows Application and System event logs for Application Error events (Event ID 1000) naming the Triofox executable and any of the listed DLLs as the faulting module.
- Correlate crash events with network telemetry showing unauthenticated WebDAV or profile management requests immediately preceding the fault.
- Alert on Triofox service stop/start sequences outside of scheduled maintenance windows.
Monitoring Recommendations
- Enable crash dump collection for the Triofox Server Agent and forward dumps to a centralized analysis pipeline.
- Track availability of Triofox-exposed endpoints with synthetic transactions to detect repeated outages.
- Aggregate web server access logs for the Triofox WebDAV interface and baseline normal request volume to surface DoS bursts.
How to Mitigate CVE-2026-8360
Immediate Actions Required
- Apply the vendor-supplied update for Triofox Server Agent once released by the vendor.
- Restrict network access to Triofox WebDAV and profile management interfaces to trusted source ranges using firewall or reverse-proxy rules.
- Ensure an authorized operator remains logged into the Triofox Server Agent Management Console, since the null pointer is only returned when no user session is active.
Patch Information
No vendor patch reference is listed in the NVD record at publication time. Consult the Tenable Security Research Report and the Triofox vendor for the latest fix availability and version guidance.
Workarounds
- Maintain an active logged-in session on the Triofox Server Agent Management Console to prevent WOSSysInfoGetDeviceInterface() from returning NULL.
- Place the Triofox service behind a reverse proxy that enforces authentication and rate limiting on WebDAV and profile management paths.
- Configure Windows Service Recovery to automatically restart the Triofox Server Agent on failure to reduce outage duration while a patch is pending.
# Configuration example: enforce auto-restart of the Triofox service on crash
sc.exe failure "TriofoxServerAgent" reset= 86400 actions= restart/5000/restart/5000/restart/5000
sc.exe failureflag "TriofoxServerAgent" 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
