The issue in dormakaba evolo Service allows a remote attacker to run arbitrary code with SYSTEM privileges through a .NET component. This flaw can be used to gain full control of the affected system, compromising confidentiality, integrity, and availability.

All versions of dormakaba evolo Service are affected. The vulnerability exists in the Service’s .NET component regardless of version.

Because the flaw permits code execution at the highest local privilege, the potential impact is severe. The attack vector is inferred to be remote, likely over a network interface exposed by the Service, as the description states a remote attacker can exploit the component. The EPSS score is below 1%, indicating a very low but nonzero probability of exploitation, while it is not listed in CISA KEV.