CVE-2026-38950: An issue in ESA AnomalyMatch before 1

Synopsis

An arbitrary code execution vulnerability exists in ESA AnomalyMatch before version 1.3.1, triggered by loading crafted machine learning model checkpoint files. The attack is local, requires a low-privilege account, and no interaction from another user. Successful exploitation gives an attacker full control over the host process, including the ability to read, modify, or destroy any data accessible to that process. HarborGuard is tracking the advisory for patch availability and will make a patched rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to carry out the attack.

• Victim interactionNot required

  No other user needs to take any action for the exploit to succeed.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required.

Blast Radius

• The attacker executes arbitrary code within the context of the process loading the checkpoint file.
• All data readable by that process is exposed, including model artifacts, session data, and any credentials or secrets available to the running user.
• The attacker can modify or delete files and persisted data accessible to the process.
• The affected process and any dependent services can be crashed or rendered unavailable.