CVE-2026-37719

An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-25)

CWE

CWE-502

Published

2026-10-05

Modified

2026-10-06

Record from

the NVD, synced 2026-10-19

References

• http://dormakaba.com
• https://assets.ctfassets.net/y0dk4vkszqeh/7nkbvO1MxCI5nOhzwDMCF9/173fdc4ceb38e4b9b853f79df6ad44d0/DKSA-26-31-031_evolo_Service_1.pdf
• https://www.dormakabagroup.com/en/security-advisories

Check your stackJSON