CVE-2026-9774: ATEN Unizon Directory Traversal Arbitrary File Deletion

Technical summary

CVE-2026-9774 is a path traversal vulnerability (CWE-22) in the updateLicense method of ATEN Unizon. The vulnerability stems from insufficient input validation on user-supplied file paths prior to file system operations. An authenticated attacker with high privileges can craft malicious path inputs—such as those containing directory traversal sequences (../)—to reference and delete files outside the intended directory scope. This can be leveraged to remove configuration files, application binaries, or other critical system components, resulting in service disruption or system instability.

Business impact

An attacker with authenticated administrative access could exploit this vulnerability to delete vital application or system files, causing service outages and data loss. In environments where ATEN Unizon manages critical infrastructure or facilities (such as KVM switching, building management, or data center operations), file deletion could disrupt facility operations, interrupt monitoring and control systems, or trigger cascading failures. Recovery would require system restoration from backups and potential downtime.

Affected systems

ATEN Unizon installations are affected. Organizations using Unizon for centralized control and management of ATEN devices should assess whether they are running vulnerable versions. Verify the specific version numbers and patch status against ATEN's advisory documentation.

Exploitability

Exploitation requires valid authentication credentials with high privilege level (administrative or equivalent). The attack vector is network-based with low complexity, meaning an authenticated attacker can exploit this remotely without additional steps or user interaction. While the barrier to entry (authentication requirement) is moderate, the impact on system integrity and availability is significant. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting limited evidence of active, widespread exploitation at this time.

Remediation

Apply security updates from ATEN that address this directory traversal vulnerability in the updateLicense function. Consult ATEN's security advisory for specific patch versions and installation instructions. Additionally, enforce strict access controls to limit which users and roles can access the updateLicense function, and implement network-level controls to restrict administrative access to Unizon to trusted IP ranges.

Patch guidance

Contact ATEN or review their security advisories for patch availability and version numbers for ATEN Unizon. Apply patches during a maintenance window after testing in a non-production environment. Verify that the patched version properly validates and sanitizes file path inputs before performing file operations. If patches are not yet available, apply the recommended access control mitigations.

Detection guidance

Monitor access logs for the updateLicense function, especially calls originating from unexpected IP addresses or user accounts. Watch for suspicious file deletion events in system logs, particularly deletions of critical configuration or application files. Implement file integrity monitoring (FIM) on key Unizon directories and system files to detect unauthorized modifications or deletions. Network intrusion detection systems should be tuned to identify path traversal patterns (../ sequences) in updateLicense requests.

Why prioritize this

This vulnerability is rated MEDIUM severity (CVSS 6.5) due to the authentication requirement and the absence of confidentiality impact. However, the high integrity and availability impact—combined with the ability to delete arbitrary files remotely—makes it a concern for organizations relying on Unizon for critical operations. Prioritize patching based on your environment's dependency on Unizon and the privilege levels of users with access to its administrative functions.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a network-accessible vulnerability that requires high-level authentication (PR:H) but has no user interaction requirement (UI:N). The lack of confidentiality impact (C:N) is offset by high integrity (I:H) and availability (I:A) impact, as an attacker can delete files and disrupt service. Organizations where Unizon manages critical infrastructure should consider the business context when assessing risk, as file deletion in such environments could escalate effective impact beyond the numerical score.

Frequently asked questions