CVE-2026-40118
Medium · 6.3CVSS
6.3
EPSS
0.2%
Published
Apr 16, 2026
CISA due date
—
The record
UDP Console provided by Arcserve contains an incorrectly specified destination in a communication channel vulnerability. When a user configures an activation server hostname of the affected product to a dummy URL, the product may unintentionally communicate with the dummy domain, causing information disclosure.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-72506 VoiceTra provided by National Institute of Information and Communications Technology… CWE-941
- CVE-2026-69246 Guzzle is an extensible PHP HTTP client. CWE-941
- CVE-2025-69515 An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to… CWE-941
- CVE-2025-53899 Kiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication… CWE-941
- CVE-2024-29415 The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such… CWE-941