CVE-2026-36851: n/a

This vulnerability in UnPoller 2.33.0 involves improper validation of input in the password field, which can be exploited to perform path traversal attacks. This allows an attacker to read arbitrary files from the system and potentially exfiltrate sensitive data over the network. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with high confidentiality impact but no integrity or availability impact. No known exploits in the wild or patches have been reported.

An attacker can remotely read arbitrary files on the affected system, leading to potential exposure of sensitive information. The confidentiality impact is high, but the vulnerability does not affect system integrity or availability. This could result in data leakage and compromise of sensitive credentials or configuration files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the UnPoller service and monitor for suspicious activity related to file access attempts via the password field.