CVE-2025-34520: Critical Authentication Bypass in Arcserve UDP

CVE-2025-34520 is a critical flaw (CVSS 9.8) in Arcserve Unified Data Protection (UDP). An unauthenticated attacker can bypass login and reach administrator level features. It affects all UDP versions before 10.2. Upgrade to 10.2, or apply the patch Arcserve provides for supported older versions.

What's affected

The record says the issue affects all UDP versions prior to 10.2. It then gives the remediation path by version:

• UDP 10.2 includes the necessary patches and needs no action.
• Versions 8.0 through 10.1 are supported and need either a patch or an upgrade to 10.2.
• Versions 7.x and earlier are unsupported or out of maintenance and must be upgraded to 10.2.

Arcserve published an important security bulletin for all UDP customers. The page needs a browser to render, so I could not read its patch details. Open the bulletin itself and follow its instructions for your exact version.

How to check if you're exposed

Open the UDP console and read the installed version from the About or Help menu. Compare it with the list above. Anything below 10.2 is in scope unless the vendor's patch has been applied, and the bulletin explains how to confirm that.

Then look at where UDP is reachable. The record describes an unauthenticated flaw, so any network path to the console matters. List the networks that can connect to the console and to the agents' service ports, and check whether any of them are exposed to the internet.

Backup servers hold copies of everything, so write down which servers and workloads each UDP instance protects. That tells you how bad a compromise would be.

What to do now

1. Inventory every Arcserve UDP server and note its version.
2. Read the Arcserve security bulletin for your release line.
3. Upgrade to 10.2, or apply the patch if you are on a supported release from 8.0 through 10.1.
4. If you run 7.x or older, schedule the move to 10.2 as an urgent project.
5. Restrict network access to the UDP console and services to trusted management hosts.
6. Review logs for unusual logins and unexpected administrative actions.

Why it matters

The record classifies the flaw as an authentication bypass using an alternate path or channel (CWE-288). It describes manipulated request parameters or a logic flaw that lets a caller skip the login step. The usual cause is a code path that reaches protected functions without going through the same check as the front door.

The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Even so, backup software is a high value target. An attacker with control of the backup system can read stored data, or damage the copies you would need after an incident. Treat the server as part of your core security perimeter.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Arcserve security bulletin for UDP customers

Last reviewed: 18 October 2026.