The Automic Automation Agent on Unix platforms can execute target programs with privileges that are not required, giving an attacker the ability to raise their privileges to match the agent’s elevated status. This flaw is a classic instance of CWE‑250, where the system runs code with unnecessary privileges. If exploited, an attacker could access or modify sensitive data and compromise the integrity of the system by gaining elevated rights.

The vulnerability impacts Broadcom Automic Automation Agents on AIX, Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSeries), Solaris x64, and Solaris Sparc 64. All installations with a version lower than 24.4.4 HF1 are known to be affected.

The CVSS base score of 8.5 indicates a high severity level. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. While the official description does not specify an attack vector, the nature of the flaw suggests local exploitation or remote exploitation through the agent’s communication channels if they are exposed. Attack conditions therefore likely include the ability to interact with the agent process or its configuration files, and the vulnerability can lead to total privilege escalation on the affected host.