CVE-2026-8370 Overview
CVE-2026-8370 is a privilege escalation vulnerability in the Broadcom Automic Automation Agent for Unix platforms. The flaw stems from execution with unnecessary privileges [CWE-250], allowing a local attacker to target programs running with elevated privileges. Affected platforms include Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSeries), AIX, Solaris x64, and Solaris Sparc 64. The vulnerability impacts Automic Automation versions prior to 24.4.4 HF1. Broadcom disclosed the issue through Security Advisory #37512.
Critical Impact
A local authenticated attacker can leverage the agent's elevated privileges to escalate access on the host, compromising confidentiality, integrity, and availability of the underlying system.
Affected Products
- Broadcom Automic Automation Agent Unix on Linux x64, Linux Power 64 BE/LE, and zLinux (zSeries)
- Broadcom Automic Automation Agent Unix on AIX
- Broadcom Automic Automation Agent Unix on Solaris x64 and Solaris Sparc 64
- Automic Automation versions prior to 24.4.4 HF1
Discovery Timeline
- 2026-05-19 - CVE-2026-8370 published to NVD
- 2026-05-19 - Last updated in NVD database
Technical Details for CVE-2026-8370
Vulnerability Analysis
The vulnerability is classified as Execution with Unnecessary Privileges [CWE-250]. The Automic Automation Agent on Unix-like systems runs with privileges that exceed what is required for its workload execution functions. When the agent invokes or interacts with target programs, those programs inherit or can be influenced under the agent's elevated privilege context.
A local attacker with low-level authenticated access to the host can abuse this design to manipulate target programs and execute actions at a higher privilege level than their own user account permits. The attack requires no user interaction and exploits the agent's local execution surface.
Successful exploitation results in full compromise of confidentiality, integrity, and availability on the affected host. Because the Automic Automation Agent commonly orchestrates batch jobs, scripts, and administrative workflows, the elevated context exposes credentials, job definitions, and downstream systems reachable from the agent.
Root Cause
The root cause is improper privilege separation in the agent's Unix runtime. The agent does not consistently drop privileges or constrain the execution context when launching or interfacing with target programs, violating the principle of least privilege.
Attack Vector
Exploitation requires local access to a system running a vulnerable agent and low-privilege authenticated credentials. The attacker targets programs the agent executes with elevated rights, leveraging the inherited privilege context to escalate from a standard user to a higher-privileged account. See the Broadcom Security Advisory #37512 for vendor technical details.
Detection Methods for CVE-2026-8370
Indicators of Compromise
- Unexpected child processes spawned by the Automic Automation Agent running under root or service accounts.
- Modifications to job scripts, executables, or configuration files referenced by agent workflows.
- Anomalous file writes or SUID/SGID file creation in directories accessible to the agent process.
Detection Strategies
- Audit process trees for the Automic agent invoking shells, interpreters, or binaries outside expected job definitions.
- Compare the effective UID of agent-launched processes against the requesting user's identity to surface privilege inheritance anomalies.
- Apply file integrity monitoring on agent binaries, job repositories, and Unix configuration paths referenced by Automic workflows.
Monitoring Recommendations
- Enable Linux auditd or AIX/Solaris equivalents to log execve events from the agent's process tree.
- Forward agent host telemetry to a centralized analytics platform for cross-host correlation of unusual job execution.
- Alert on local user accounts initiating jobs that result in privileged file or command operations.
How to Mitigate CVE-2026-8370
Immediate Actions Required
- Upgrade all Automic Automation Agent Unix installations to version 24.4.4 HF1 or later.
- Inventory every Unix host running the agent across Linux, AIX, and Solaris variants to confirm patch coverage.
- Restrict local login access on hosts running the agent to trusted administrators only.
Patch Information
Broadcom resolved this issue in Automic Automation 24.4.4 HF1. Refer to Broadcom Security Advisory #37512 for the official fix and upgrade guidance.
Workarounds
- Limit local shell access on agent hosts and review accounts authorized to submit or modify agent jobs.
- Run the agent under the lowest service account permitted by your job catalog and segregate duties for privileged workflows.
- Apply strict file permissions on agent binaries, job scripts, and configuration directories to block tampering by non-privileged users.
# Verify Automic Automation Agent version on Unix
# Confirm the agent has been upgraded to 24.4.4 HF1 or later
cd $AGENT_HOME/bin
./ucxjcitx --version
# Restrict permissions on the agent installation directory
chown -R automic:automic $AGENT_HOME
chmod -R o-rwx $AGENT_HOME
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
