CVE-2026-2039
Authentication Bypass in GFI Archiver MArc.Store Enables Remote Exploits
Publication date: 2026-02-20
Last updated on: 2026-02-24
Assigner: Zero Day Initiative
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gfi | archiver | 15.10 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
This vulnerability affects GFI Archiver's MArc.Store.Remoting.exe process, which listens on port 8018. It allows remote attackers to bypass authentication because the process lacks proper authorization checks before granting access to its functionality. As a result, attackers can access the system without needing to authenticate.
The flaw specifically arises from missing authorization in the configuration of the MArc.Store.Remoting.exe process, enabling unauthorized access.
How can this vulnerability impact me? :
This vulnerability can have serious impacts because it allows attackers to bypass authentication remotely without any user interaction.
An attacker exploiting this vulnerability can gain unauthorized access to the system and potentially leverage other vulnerabilities to execute code with SYSTEM-level privileges, leading to full control over the affected system.
The CVSS score of 7.3 indicates a high severity, with impacts on confidentiality, integrity, and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the MArc.Store.Remoting.exe process listening on port 8018 without proper authorization. To detect it on your network or system, you can check if this process is running and if port 8018 is open and accessible.
- Use a network scanning tool like nmap to check if port 8018 is open: nmap -p 8018 <target-ip>
- On the affected system, check for the running process: tasklist /FI "IMAGENAME eq MArc.Store.Remoting.exe" (Windows) or use equivalent process listing commands.
- Attempt to connect to port 8018 using telnet or netcat to see if the service responds without authentication.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to port 8018 to trusted hosts only, as the vulnerability allows authentication bypass on the MArc.Store.Remoting.exe process listening on this port.
Additionally, consider disabling or stopping the MArc.Store.Remoting.exe service if it is not required.
Apply any available patches or updates from the vendor to address the authorization bypass.
Monitor network traffic and logs for any suspicious activity targeting port 8018.