CVE-2026-85663
Received Received - Intake

Unauthenticated Remote Code Execution in Aim 3.29.1

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85663
EUVD
EUVD-2026-71119

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aim 3.29.1 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Aim 3.29.1 remote tracking server lacks authentication, allowing unauthenticated attackers to register clients, create Repo resources, and call arbitrary methods via getattr without validation. This enables reading experiments or deleting runs.

Detection Guidance

Check if Aim remote tracking server (v3.29.1 or earlier) is running without authentication. Inspect network traffic for unauthenticated HTTP POST requests or WebSocket connections to /tracking or similar endpoints. Review server logs for suspicious method invocations like getattr calls or resource instantiation attempts.

Impact Analysis

Unauthenticated attackers could access sensitive data like experiments, delete critical runs, or manipulate the system without authorization. This could lead to data loss, unauthorized access, or disruption of operations.

Compliance Impact

This vulnerability could violate GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access to sensitive data. Compliance requires preventing such breaches, so this flaw risks non-compliance and potential penalties.

Mitigation Strategies

Immediately upgrade Aim to a patched version beyond 3.29.1. If upgrading is not possible, restrict network access to the Aim remote tracking server to trusted IPs only. Disable unauthenticated client registration and monitor for suspicious Repo resource instantiation or method invocations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85663. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart