CVE-2026-40118

CVE-2026-40118 is a communication channel vulnerability in Arcserve's UDP Console that allows unintended information disclosure when users configure an activation server hostname to a dummy URL. The product fails to properly validate the destination in its communication channel, causing it to contact the attacker-controlled domain and potentially expose sensitive information. This vulnerability affects the UDP Console component of Arcserve products. The vulnerability carries a CVSS severity rating of 6.3 MEDIUM, with a network-based attack vector requiring low complexity and no privileges, though user interaction is required. The attack can result in limited impacts to confidentiality, integrity, and availability. With an EPSS score of 0.000360000, this vulnerability has relatively low statistical probability of exploitation compared to the broader CVE landscape. There is currently no evidence of active exploitation in the wild, as this vulnerability is not listed on the Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists. The moderate FAUCET Risk Score of 35.0 suggests limited community attention and no publicly available exploit code. Organizations should assess whether they operate affected Arcserve deployments and consider implementing configuration controls or applying vendor patches as they become available.