CVE-2020-10658
9.8
CRITICAL · CVSS 3.1 · EPSS 2.8% (pctl 86)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteImage API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.8% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-502 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2021-01-06 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| proofpoint | insider threat management server |
References
→ the Explorer · watch your stack · NVD