CVE-2026-102387: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere in XServer Xserver Migrator

This vulnerability (CVE-2026-102387) affects Xserver Migrator versions <= 1.6.6 and allows unauthenticated attackers to gain access to sensitive system information. It is categorized as CWE-497, which involves exposure of sensitive system information to unauthorized entities. The CVSS v3.1 score is 7.5 (high), with an attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), and no impact on integrity or availability (I:N, A:N). No known exploits are reported in the wild, and no patch or remediation information is provided.

An attacker can remotely access sensitive system information without authentication, potentially enabling further attacks or information gathering. The confidentiality impact is high, but there is no impact on integrity or availability. This could lead to unauthorized disclosure of sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict network access to the affected service where possible.