EIP-2026-102467

This PHP script demonstrates an authentication bypass and credentials disclosure vulnerability in CA ARCserve D2D r15 via a crafted GWT RPC request. It exploits a lack of session validation for localhost-originating requests to retrieve Windows Administrator credentials in cleartext.