CVE-2025-27816CRITICAL 9.8EPSS p45.3%

CVE-2025-27816CVE-2025-27816

Description

A vulnerability was discovered in the Arctera InfoScale 7.0 through 8.0.2 where a .NET remoting endpoint can be exploited due to the insecure deserialization of potentially untrusted messages. The vulnerability is present in the Windows Plugin_Host service, which runs on all the servers where InfoScale is installed. The service is used only when applications are configured for Disaster Recovery (DR) using the DR wizard. Disabling the Plugin_Host service manually will eliminate the vulnerability.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.63% probability of exploitation · percentile 45.3% · 2026-06-18T12:00:27Z
Published2025-03-07
Last modified2026-04-15

Underlying weaknesses· 1

CWE-502

References

  1. https://www.veritas.com/content/support/en_US/security/ARC25-002

1

TypeTargetConfidenceTier
WeaknessDeserialization of Untrusted Datacwe-5020%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-29807
CVE
CVE-2025-21176
CVE
CVE-2025-58384
CVE
CVE-2026-28710
CVE
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
CVE
CVE-2025-11367
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.