CVE-2026-5384

CVE-2026-5384 is an authorization bypass vulnerability affecting the runZero Platform that allows credentials to be improperly updated and leveraged for tasks outside their authorized organization scope. This represents a classic authorization control failure (CWE-863) in the access management logic. The vulnerability was remediated in version 4.0.26021.0 of the platform. From a severity perspective, the vulnerability carries a CVSS score of 5.8 (Medium) with a network attack vector, high complexity requirement, and high privilege prerequisite. The attack requires administrator-level access to initiate but could result in high-impact confidentiality compromise across organizational boundaries. No user interaction is required for successful exploitation once the initial conditions are met. Exploitation status is minimal at present. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation in the wild. The EPSS score of 0.00044 suggests very low probability of exploitation over the next 30 days, and the vulnerability remains on the inactive hot list with limited community attention. Organizations should prioritize patching but may defer this issue lower than critical vulnerabilities with active exploitation.