Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

dormakaba evolo Service lets remote attacker run code as SYSTEM

CVE-2026-37719 · published 13 days ago
Summary

The dormakaba evolo Service can be tricked by a remote attacker to run any program with the highest system privileges. This could let an attacker take full control of the affected computer. Apply the latest updates from the vendor or disable the vulnerable .NET component until a fix is available.

Original advisory text
An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.
An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published5 Oct 2026
Updated15 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-37719 · NVD
CVE-2026-37719 · MITRE
Track software like this
Free during beta