---
id: "CVE-2015-4068"
kind: "vulnerability"
aliases: ["CVE-2015-4068"]
title: "Arcserve Unified Data Protection (UDP): Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability"
severity: "critical"
cvss: 9.4
epss: 0.63643
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Arcserve Unified Data Protection (UDP)", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["arcserve-udp", "backup-servers", "exploited", "infrastructure", "windows"]
not_affected_if: ["unknown"]
published_at: "2015-05-29T15:59:23+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-4068", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-4068", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4068", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Arcserve Unified Data Protection (UDP): Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability

Arcserve Unified Data Protection (UDP) has a directory traversal flaw that lets remote attackers read sensitive files or crash the service. It is listed in CISA's Known Exploited Vulnerabilities catalog, so attacks have been observed in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Arcserve Unified Data Protection (UDP) affected ? fixed ?

## Fix

Apply the vendor updates per Arcserve instructions (CISA required action); the affected and fixed versions are not stated in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-4068
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2015-4068
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2015-4068

## From the sources

Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_