Arcserve vulnerabilities (CVEs)

83 CVEs matched to Arcserve by name in NVD, 1 on CISA's Known Exploited list.

Back to the Arcserve profile · Alternatives to Arcserve · CVE RSS feed

Exploitation riskConfirmed exploited

83 of 83 CVEs assessed

confirmed exploited

past CISA deadline

EPSS ≥ 10%

>99%

highest single CVE

17 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

CVE-2020-27858 ↗EPSS 74%LEV ≥>99%Probably exploited
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D 16.5. Authentication is not required t…
CVE-2015-4068 ↗⚠ exploitedoverdueEPSS 64%LEV ≥>99%Confirmed exploited
Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a…
CVE-2011-3011 ↗EPSS 72%LEV ≥>99%

Recent changes

last 90 days

CVE-2007-3825 is now estimated at a 100% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2008-1329 is now estimated at a 100% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2005-1018 is now estimated at a 100% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2006-5172 is now estimated at a 100% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2007-5329 is now estimated at a 99% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗

CVE severity over time

CVEs by year and severity

Count of matched CVEs by the year NVD published them.
Year	Critical	High	Medium	Low	Unscored	Total
2026	0	0	1	0	0	1
2025	3	0	1	0	0	4
2024	1	2	0	0	0	3
2023	4	0	0	0	0	4
2021	0	1	0	0	0	1
2018	0	3	1	0	0	4
2015	1	1	0	0	0	2
2012	0	1	2	0	0	3
2011	0	1	1	0	0	2
2010	0	1	0	1	0	2
2009	0	0	1	0	0	1
2008	0	9	4	0	0	13
2007	0	23	1	1	0	25
2006	0	5	2	0	0	7
2005	0	6	0	0	0	6
2001	0

On CISA's Known Exploited Vulnerabilities list

1 of 83 matched CVEs is listed. 1 is past the remediation due date CISA set.

Most recent additions

CVE-2015-4068 added 2022-03-25

Highest EPSS scores

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

CVE	EPSS	Percentile
CVE-2010-0219	91%	>99%
CVE-2005-2535	81%	>99%
CVE-2008-4397	81%	>99%
CVE-2006-5143	80%	>99%
CVE-2007-0449	79%	>99%
CVE-2007-2139	78%	>99%
CVE-2020-27858	74%	99%
CVE-2011-3011	72%	99%
CVE-2006-6076	71%	99%
CVE-2007-0169	71%	99%

Known CVEs (83)

RSS ⇢

CVE-2026-40118 ↗MEDIUM 6.32026
UDP Console provided by Arcserve contains an incorrectly specified destination in a communication channel vulnerability. When a user configures an activation server hostname of the affected product to…
CVE-2025-34523 ↗CRITICAL 9.82025
A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP). This flaw is reachable without authentication and results fro…
↗

How this is counted

CVEs come from the US National Vulnerability Database (NVD) and are matched to Arcserve by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-08-14.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-20.
Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.