ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution flaw that occurs when the EXECUTE function is invoked. An attacker who can trigger this function can run arbitrary commands with the privileges of the ACL Analytics service. The vulnerability is based on native code execution via an unvalidated input, classified as CWE-94. Attackers can leverage bitsadmin to pull malicious PowerShell scripts and then execute them, leading to system compromise and the establishment of reverse shells.

The affected product is ACL Analytics from acl, covering all releases from version 11.x up to 13.0.0.579. No patch version is listed in the data, but any installation within that range is still at risk.

The flaw has a CVSS score of 9.3, indicating a severe threat with high potential impact. The EPSS score is not available, and it is not listed in the CISA KEV catalog, so exploitation frequency is unknown. However, the ability to run system‑level commands and create reverse shells means a remote attacker can compromise the host with full control if they can reach the EXECUTE endpoint, which is inferred to be accessible over the network.