Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assignment of inappropriate permissions during the software’s default installation, whereby the main executable and other programme files located in C:\Program Files have excessive permissions for the ‘Everyone’ group. This could allow an unprivileged user to replace the main executable and/or its components with a malicious file, thereby enabling the execution of arbitrary code. In the worst-case scenario, if the malicious code is executed with elevated privileges (such as those of Administrator or SYSTEM), the attacker could escalate privileges and gain full control of the system, compromising both security and data integrity.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-22 | 2 | Disclosure1General1 |
| 2026-06-23 | 1 | Active Exploitation1 |
A lot of offensive activities were identified targeting Aruba Sign (CVE-2026-12602) https://vuldb.com/vuln/372676/cti
Post summary
Offensive actors have been observed targeting Aruba Sign via CVE-2026-12602, indicating active exploitation in the wild, but no PoC, tooling, patch, or technical details are provided.
🚨*CVE* CVE-2026-12602 Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assignment of inappropriate permissions during the … https://www.cve.org/CVERecord?id=CVE-2026-12602 ----- Traducción: CVE-2026-12602 Per… http://infoflow.cloud`
Post summary
The tweet reports the disclosure of CVE-2026-12602, noting incorrect default permissions in ArubaSign versions prior to v4.6.6, but does not mention exploitation, patches, or PoC details.
CVE-2026-12602 Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assignment of inappropriate permissions during the … https://www.cve.org/CVERecord?id=CVE-2026-12602
Post summary
The post references CVE-2026-12602, noting that older ArubaSign versions have incorrect default permissions, without details on exploitation, patches, or PoC.