PT-2025-34946 · Arcserve · Arcserve Unified Data Protection

Watchtowr · Published 2025-08-27 · Updated 2026-03-01 · CVE-2025-34520

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Arcserve Unified Data Protection (UDP) versions prior to 10.2 Arcserve Unified Data Protection (UDP) versions 8.0 through 10.1 Arcserve Unified Data Protection (UDP) versions 7.x and earlier

Description: An authentication bypass in Arcserve Unified Data Protection (UDP) allows unauthenticated attackers to gain unauthorized access to protected functionality or user accounts. Attackers can bypass login mechanisms without valid credentials and access administrator-level features by manipulating request parameters or exploiting a logic flaw.

Recommendations: Upgrade to Arcserve Unified Data Protection (UDP) version 10.2. Apply the available patch for Arcserve Unified Data Protection (UDP) versions 8.0 through 10.1. Upgrade to Arcserve Unified Data Protection (UDP) version 10.2 from versions 7.x and earlier.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-34520

Affected Products

Arcserve Unified Data Protection

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-34520 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34520 · Vendor Advisory
• https://t.me/cveNotify/134779 · Telegram Post
• https://t.me/CVEtracker/31085 · Telegram Post
• https://support.arcserve.com/s/article/Important-Security-Bulletin-Must-read-for-all-Arcserve-UDP-customers-on-all-versions · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/1960822222248882423 · Twitter Post
• https://twitter.com/stratosberry/status/2028113210054779083 · Twitter Post