ZDI-26-075: GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the MArc.Core.Remoting.exe process, which listens on port 8017. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM.
Other sources
This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-2038.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-075?
The severity of ZDI-26-075 is high, with a CVSS score of 7.3.
How do I fix ZDI-26-075?
To fix ZDI-26-075, update to the latest version of GFI Archiver that addresses the authentication bypass vulnerability.
What does the ZDI-26-075 vulnerability affect?
The ZDI-26-075 vulnerability affects GFI Archiver installations, specifically through the MArc.Core.Remoting.exe process.
Who is affected by ZDI-26-075?
Any organization using affected versions of GFI Archiver is potentially vulnerable to the ZDI-26-075 flaw.
What type of vulnerability is ZDI-26-075?
ZDI-26-075 is an authentication bypass vulnerability that allows remote attackers to exploit the system without authentication.