CVE-2026-9776: ATEN Unizon Path Traversal Vulnerability

CVE-2026-9776 Overview

CVE-2026-9776 is a directory traversal vulnerability in ATEN Unizon that allows remote, unauthenticated attackers to disclose sensitive information from affected installations. The flaw resides in the writeFileToHttpServletResponse method, which fails to properly validate user-supplied paths before performing file operations. Attackers can leverage this weakness to read arbitrary files in the context of SYSTEM. The vulnerability is tracked as ZDI-CAN-28505 by the Zero Day Initiative and is categorized under [CWE-22] Path Traversal. Successful exploitation requires no authentication and can be performed over the network.

Critical Impact
Remote unauthenticated attackers can read arbitrary files with SYSTEM privileges, exposing credentials, configuration data, and other sensitive information stored on the host.

Affected Products

ATEN Unizon (see vendor advisory for specific affected versions)

Discovery Timeline

2026-06-24 - CVE-2026-9776 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-9776

Vulnerability Analysis

The vulnerability exists in the writeFileToHttpServletResponse method within ATEN Unizon. This method accepts a path parameter from incoming HTTP requests and uses it directly in file operations without sanitization. Because the method runs in the context of the SYSTEM account on Windows hosts, any file readable by SYSTEM is exposed to the attacker. The Zero Day Initiative tracked this issue internally as ZDI-CAN-28505 before publication as ZDI-26-380.

Exploitation does not require credentials or user interaction. An attacker only needs network access to the Unizon web interface to read files outside the intended directory. The EPSS score of 1.58% places this issue in the 72nd percentile for likelihood of exploitation within 30 days.

Root Cause

The root cause is missing input validation on a user-supplied file path [CWE-22]. The writeFileToHttpServletResponse method does not canonicalize the path nor restrict it to an allow-listed base directory. Sequences such as ../ are interpreted by the underlying file API, permitting traversal outside the intended web resource directory.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable endpoint with a path parameter containing directory traversal sequences. The server resolves the path, opens the targeted file, and writes its contents back through the HTTP servlet response. Targets typically include configuration files, credential stores, application logs, and Windows system files accessible to the SYSTEM account. See the Zero Day Initiative Advisory ZDI-26-380 for additional technical context.

Detection Methods for CVE-2026-9776

Indicators of Compromise

HTTP requests to ATEN Unizon endpoints containing path traversal patterns such as ../, ..\, %2e%2e%2f, or %2e%2e%5c in query parameters or POST bodies.
Unexpected HTTP responses from Unizon servers returning the contents of system files, configuration files, or files outside the application web root.
Web server access logs showing repeated requests targeting the writeFileToHttpServletResponse handler with abnormal path parameters.

Detection Strategies

Inspect Unizon web access logs for URL-encoded and double-encoded traversal sequences in request parameters used by file-serving endpoints.
Deploy web application firewall (WAF) rules that flag path traversal payloads targeting ATEN Unizon URI patterns.
Correlate network telemetry with file access events on the Unizon host to identify reads of sensitive files initiated by the Unizon service process.

Monitoring Recommendations

Monitor outbound HTTP response sizes from Unizon endpoints for anomalous transfers that may indicate file exfiltration.
Alert on read access to high-value files such as web.xml, credential stores, and Windows registry hives by the Unizon service account.
Track repeated 200 OK responses to requests containing traversal characters and review them as potential successful exploitation attempts.

How to Mitigate CVE-2026-9776

Immediate Actions Required

Apply the fixed version of ATEN Unizon as documented in the ATEN Security Advisory.
Restrict network access to the Unizon management interface to trusted administrative networks only.
Audit the Unizon host for evidence of prior file disclosure by reviewing web access logs against the indicators listed above.

Patch Information

ATEN has published a security advisory for this vulnerability. Administrators should consult the ATEN Security Advisory and the Zero Day Initiative Advisory ZDI-26-380 for the fixed release information and upgrade instructions.

Workarounds

Place the Unizon web interface behind a reverse proxy or WAF configured to block path traversal sequences in request parameters.
Apply firewall rules limiting inbound access to the Unizon HTTP(S) ports to administrator workstations.
Run the Unizon service under an account with reduced privileges where supported, reducing the scope of files readable through this flaw.

bash

# Example WAF rule concept - block traversal sequences on Unizon endpoints
# (adapt to your WAF syntax; pseudo-ModSecurity shown)
SecRule REQUEST_URI|ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c)" \
  "id:1029776,phase:2,deny,status:403,log,msg:'CVE-2026-9776 ATEN Unizon path traversal attempt'"