CVE-2026-37719 in Evolo Service
Summary
by MITRE • 10/05/2026
An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified within the dormakaba Evolo Service software represents a critical security flaw affecting all released versions of this access control management platform. This issue stems from an insecure implementation within a core .NET component that handles remote interactions, allowing unauthenticated or authenticated attackers to achieve arbitrary code execution with SYSTEM-level privileges on the affected host machine. The presence of such a high-privilege escalation vector in enterprise-grade security infrastructure underscores significant deficiencies in input validation and privilege management during the processing of external requests directed at this service layer.
From a technical perspective, the root cause lies in how the .NET component processes incoming data streams or method calls without adequate sanitization or type checking. This typically involves deserialization vulnerabilities where untrusted data is converted into executable objects by the runtime environment, or improper handling of command arguments that are passed directly to system-level APIs. Because the service operates with elevated permissions necessary for managing hardware access points and user credentials, any successful exploitation results in full control over the operating system. The attacker can inject malicious payloads that bypass standard security controls due to the inherent trust placed in the local service account context, which is often configured as Local System or Administrator to ensure uninterrupted operation of critical access control functions.
The operational impact of this vulnerability is severe and far-reaching for organizations relying on dormakaba Evolo Service for physical security management. An attacker gaining SYSTEM-level access can not only compromise the integrity of the software but also pivot to attack other systems within the network segment where the server resides. This includes stealing sensitive data such as user credentials, access logs, encryption keys used for securing communication between readers and controllers, and potentially disabling or manipulating alarm states. In a worst-case scenario, this could lead to physical security breaches by allowing an adversary to unlock doors remotely, disable surveillance integrations, or install persistent backdoors that survive reboots and standard patching cycles if the underlying service is not properly secured.
This vulnerability aligns with CWE-502 Deserialization of Untrusted Data and CWE-78 Improper Neutralization of Special Elements used in an OS Command depending on the specific exploitation vector utilized by the attacker. In terms of offensive security frameworks, it maps to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter for executing arbitrary code and potentially T1068 Exploitation for Privilege Escalation if additional local vectors are required to reach SYSTEM level from a lower privilege account. The ability to execute code remotely without authentication places this in the highest severity category of remote code execution flaws, requiring immediate attention due to its exploitability by automated tools found on public vulnerability databases.
Mitigation strategies must focus on both immediate containment and long-term architectural hardening. Organizations should immediately isolate affected systems from untrusted networks if possible and restrict network access to the Evolo Service ports using strict firewall rules that only allow connections from known management stations or IP ranges. It is critical to apply any available patches provided by dormakaba as soon they are released, ensuring that version updates include fixes for this specific .NET component flaw. Additionally, administrators should enforce least privilege principles by configuring the service account with minimal necessary permissions rather than full SYSTEM rights where feasible, although this may require careful testing due to operational dependencies. Regular vulnerability scanning and penetration testing of access control infrastructure components are recommended to identify similar misconfigurations or unpatched software instances across the enterprise environment.