CVE-2026-101020
Received Received - Intake

Incorrect Permission Assignment in AssetView Grants SYSTEM Privileges

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: JPCERT/CC

Description
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-101020
EUVD
EUVD-2026-98361

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
hammock_corporation assetview to 13.2.7B (exc)
hammock_corporation assetview_cloud to 13.3.7 (exc)
hammock_corporation assetview_cloud+ to 2600.201.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an incorrect permission assignment for critical resources in AssetView, AssetView CLOUD, and AssetView Cloud+. A local authenticated attacker with Windows system access can exploit it to gain SYSTEM privileges by replacing programs running with SYSTEM permissions.

Detection Guidance

This vulnerability requires local Windows access to exploit. Check installed versions of AssetView, AssetView CLOUD, or AssetView Cloud+ against affected versions (AssetView before 13.2.7B, AssetView CLOUD before 13.2.7B or 13.3.7, AssetView Cloud+ before 2600.201.11).

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary code with SYSTEM privileges. This can lead to full system compromise, data theft, unauthorized modifications, or denial of service on the affected system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update to the latest patched versions immediately. For AssetView CLOUD, contact Hammock support. If out of support, contact their support team for patches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101020. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart