CVE-2026-40062 describes an improper limitation of a pathname to a restricted directory (path traversal) vulnerability in Ziostation2 versions 2.9.8.7 and earlier. This flaw permits remote attackers without authentication to retrieve sensitive operating system information by manipulating file path inputs to access files outside intended directories. The vulnerability is rated high severity with a CVSS 3.0 score of 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. No vendor advisory or patch information is currently available, and no exploits are known in the wild.

An unauthenticated remote attacker can exploit this vulnerability to access sensitive information on the underlying operating system, potentially leading to information disclosure. The confidentiality impact is high, but integrity and availability are not affected. This could aid attackers in further reconnaissance or subsequent attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected Ziostation2 versions and monitor for suspicious activity related to path traversal attempts. Avoid exposing the service to untrusted networks.