CVE-2026-9775: ATEN Unizon Path Traversal Vulnerability

CVE-2026-9775 Overview

CVE-2026-9775 is a directory traversal vulnerability in ATEN Unizon that allows authenticated remote attackers to delete arbitrary files on affected installations. The flaw resides in the uploadSSL method, which fails to properly validate user-supplied paths before performing file operations. Successful exploitation enables attackers to remove files outside the intended directory, potentially leading to a denial-of-service condition on the system. The vulnerability was reported through the Trend Micro Zero Day Initiative under the identifier ZDI-CAN-28503 and is tracked as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Authenticated attackers can delete arbitrary files on ATEN Unizon systems, causing service disruption or denial-of-service conditions.

Affected Products

ATEN Unizon

Discovery Timeline

2026-06-24 - CVE-2026-9775 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-9775

Vulnerability Analysis

The vulnerability resides within the uploadSSL method in ATEN Unizon. This method accepts a user-supplied path parameter and uses it directly in file operations without sanitizing path traversal sequences such as ../. An authenticated attacker can craft a request containing traversal sequences that escape the intended SSL upload directory. The application then performs file deletion against paths the attacker controls.

The attack requires network access to the management interface and valid credentials with sufficient privileges to invoke the uploadSSL functionality. Once exploited, the attacker can delete configuration files, system binaries, certificates, or other resources critical to Unizon operation. Removing key files renders the system inoperative, producing a denial-of-service condition that affects centralized management of attached ATEN infrastructure.

The EPSS probability stands at 1.157% with a percentile of 63.013, indicating modest predicted exploitation likelihood relative to other published CVEs.

Root Cause

The root cause is improper validation of a user-supplied filename or path passed to the uploadSSL handler. The handler does not canonicalize the input or restrict operations to the intended directory. Without these checks, traversal sequences flow into the underlying file deletion routine and resolve to attacker-chosen locations on disk.

Attack Vector

The attack vector is network-based and requires authentication. An attacker submits a request to the Unizon management interface invoking the uploadSSL endpoint with a manipulated path argument referencing files outside the SSL upload directory. The server performs the file operation with its own service privileges, allowing deletion of resources the authenticated user would not normally control through legitimate workflows.

No verified public exploitation code is available. Refer to the Zero Day Initiative Advisory ZDI-26-379 and the Aten Security Advisory for vendor-supplied technical detail.

Detection Methods for CVE-2026-9775

Indicators of Compromise

Unexpected absence of SSL certificates, configuration files, or system files on Unizon hosts following authenticated administrative sessions.
HTTP requests to the uploadSSL endpoint containing path traversal sequences such as ../, ..\, or URL-encoded equivalents %2e%2e%2f.
Unscheduled service restarts, failed certificate validation, or Unizon component crashes correlating with administrative activity.

Detection Strategies

Inspect web server and application logs for requests to uploadSSL containing directory traversal patterns in path or filename parameters.
Monitor file integrity on Unizon servers, alerting on deletion of files outside expected upload directories during administrative sessions.
Correlate authenticated administrative API calls against baseline behavior to identify anomalous parameter contents from privileged accounts.

Monitoring Recommendations

Forward Unizon application logs and host audit logs to a centralized analytics platform for correlation and retention.
Enable file system auditing on configuration, certificate, and binary directories to capture deletion events with originating process context.
Track authentication events for administrative accounts and alert on credential reuse from unusual source addresses.

How to Mitigate CVE-2026-9775

Immediate Actions Required

Apply the vendor patch referenced in the Aten Security Advisory as soon as available for your deployment.
Restrict network access to the Unizon management interface to trusted administrative networks using firewall rules or VPN gating.
Rotate administrative credentials and enforce strong authentication on all accounts capable of invoking SSL upload functionality.

Patch Information

ATEN has published a security advisory for affected Unizon versions. Consult the Aten Security Advisory and Zero Day Initiative Advisory ZDI-26-379 for fixed version identifiers and upgrade guidance specific to your Unizon installation.

Workarounds

Limit administrative access to the smallest set of operators required and audit account membership regularly.
Place the Unizon management interface behind a reverse proxy or web application firewall that blocks path traversal patterns in request parameters.
Maintain offline backups of Unizon configuration and certificate stores so that file deletion attacks can be recovered quickly.

bash

# Example WAF rule pattern to block traversal sequences targeting uploadSSL
# Adapt to your specific WAF syntax and test before enforcement
SecRule REQUEST_URI "@contains uploadSSL" \
  "chain,deny,status:403,id:1009775,msg:'CVE-2026-9775 path traversal attempt'"
  SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e(/|%2f|\\|%5c))" "t:lowercase,t:urlDecodeUni"