CVE-2023-40266 is a critical (CVSS 9.8) path traversal in Atos Unify OpenScape Xpressions WebAssistant V7. The record shows no login is required. Releases before V7R1 FR5 HF42 P911 are affected, so apply that build or later and restrict access to the interface.
What's affected
The record names Atos Unify OpenScape Xpressions WebAssistant V7 with every build before V7R1 FR5 HF42 P911 affected. It scores the flaw 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, no privileges and no user interaction.
The weakness is CWE-22 (path traversal). The NVD description says only that the issue allows path traversal, so we cannot say which files can be reached or what the attacker gains beyond the high scores in the vector.
Unify's advisory PDF named in the record returned a not found error when we tried to fetch it, so what follows rests on the NVD record. Confirm details with the vendor advisory before you rely on this page for a change decision.
How to check if you're exposed
Find the installed WebAssistant release and hotfix level and compare it with V7R1 FR5 HF42 P911. Because the flaw needs no login, the second question matters more than usual: can anyone outside your administrators reach the WebAssistant web port?
Check firewall rules and any reverse proxy in front of the server. If the interface is reachable from the internet, treat this as the first item on the patch list.
What to do now
- Locate every OpenScape Xpressions server and record its release and hotfix level.
- Apply V7R1 FR5 HF42 P911 or later, after reading advisory OBSO-2305-03.
- If you cannot patch today, block access to the WebAssistant interface from untrusted networks.
- Review web server and application logs for unusual requests to the interface, and keep the logs.
- Rotate any credentials or keys stored on the server if you find signs of unwanted access.
Why it matters
Path traversal bugs let a request escape the folder an application meant to serve and reach other places on the file system. They come from building a file path out of user input without normalising it or checking that the final path stays inside the intended folder.
The 9.8 score comes from the unauthenticated network path and the high impact ratings, not from a confirmed exploit. The record does not mark it as being in the CISA KEV catalog. Even so, an unauthenticated flaw in a messaging server deserves a short patch window and a hard look at network exposure.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the record say it needs a login?
No. The vector has no privileges required and no user interaction, which is why the score is 9.8.
Is it exploited in the wild?
The record's KEV flag is false and we found no source that says so. That can change, so keep an eye on the vendor advisory and the CISA catalog.
Sources
Last reviewed: 19 October 2026.
