PatchTheCVECVE-2008-1786: The DSM gui_cm_ctrls ActiveX control (gui_cm_ctrls.ocx), as used in multiple CA products including BrightStor
56
This month
HIGH 9.3DOWNGRADEDOWNGRADEDOWNGRADE
CVE-2008-1786 is a high-severity flaw (CVSS 9.3) affecting arcserve backup laptops and desktops, desktop and server management, desktop management suite. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The DSM gui_cm_ctrls ActiveX control (gui_cm_ctrls.ocx), as used in multiple CA products including BrightStor ARCServe Backup for Laptops and Desktops r11.5, Desktop Management Suite r11.1 through r11.2 C2; Unicenter r11.1 through r11.2 C2; and Desktop and Server Management r11.1 through r11.2 C2 allows remote attackers to execute arbitrary code via crafted function arguments.
Why this priority
- Critical severity
- EPSS top 6%: very likely to be exploited
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.3 (High) |
| EPSS exploit chance | 6.8% (top 6%) |
| CISA exploited list | No |
| Weakness | CWE-94 |
| Published | 2008-04-16 |
| Last modified | 2026-06-16 |
Publisher (CNA): MITRE · Vendor: computer associates
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
computer associates arcserve backup laptops and desktops DOWNGRADE
Affected: r11.5
Fixed in: no fixed release known
Safe to downgrade to: a release before r11.5
1. Check installed version
apt-cache policy arcserve-backup-laptops-and-desktops || rpm -q arcserve-backup-laptops-and-desktops || arcserve-backup-laptops-and-desktops --version
2. No fixed release: DOWNGRADE to a release before r11.5 (Debian / Ubuntu)
apt-cache madison arcserve-backup-laptops-and-desktops
sudo apt install arcserve-backup-laptops-and-desktops=<VERSION_BEFORE_r11.5>
sudo apt-mark hold arcserve-backup-laptops-and-desktops
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list arcserve-backup-laptops-and-desktops
sudo dnf downgrade arcserve-backup-laptops-and-desktops-<VERSION_BEFORE_r11.5>
sudo dnf versionlock add arcserve-backup-laptops-and-desktops
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
computer associates desktop and server management DOWNGRADE
Affected: r11.1 · r11.2 · r11.2a · r11.2c1 · r11.2c2
Fixed in: no fixed release known
Safe to downgrade to: a release before r11.1
1. Check installed version
apt-cache policy desktop-and-server-management || rpm -q desktop-and-server-management || desktop-and-server-management --version
2. No fixed release: DOWNGRADE to a release before r11.1 (Debian / Ubuntu)
apt-cache madison desktop-and-server-management
sudo apt install desktop-and-server-management=<VERSION_BEFORE_r11.1>
sudo apt-mark hold desktop-and-server-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list desktop-and-server-management
sudo dnf downgrade desktop-and-server-management-<VERSION_BEFORE_r11.1>
sudo dnf versionlock add desktop-and-server-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
computer associates desktop management suite DOWNGRADE
Affected: r11.2 · r11.2a · r11.2c1 · r11.2c2
Fixed in: no fixed release known
Safe to downgrade to: a release before r11.2
1. Check installed version
apt-cache policy desktop-management-suite || rpm -q desktop-management-suite || desktop-management-suite --version
2. No fixed release: DOWNGRADE to a release before r11.2 (Debian / Ubuntu)
apt-cache madison desktop-management-suite
sudo apt install desktop-management-suite=<VERSION_BEFORE_r11.2>
sudo apt-mark hold desktop-management-suite
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list desktop-management-suite
sudo dnf downgrade desktop-management-suite-<VERSION_BEFORE_r11.2>
sudo dnf versionlock add desktop-management-suite
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
computer associates unicenter asset management DOWNGRADE
Affected: r11.1 · r11.2 · r11.2a · r11.2c1 · r11.2c2
Fixed in: no fixed release known
Safe to downgrade to: a release before r11.1
1. Check installed version
apt-cache policy unicenter-asset-management || rpm -q unicenter-asset-management || unicenter-asset-management --version
2. No fixed release: DOWNGRADE to a release before r11.1 (Debian / Ubuntu)
apt-cache madison unicenter-asset-management
sudo apt install unicenter-asset-management=<VERSION_BEFORE_r11.1>
sudo apt-mark hold unicenter-asset-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list unicenter-asset-management
sudo dnf downgrade unicenter-asset-management-<VERSION_BEFORE_r11.1>
sudo dnf versionlock add unicenter-asset-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
computer associates unicenter desktop management bundle DOWNGRADE
Affected: r11.1 · r11.2 · r11.2a · r11.2c1 · r11.2c2
Fixed in: no fixed release known
Safe to downgrade to: a release before r11.1
1. Check installed version
apt-cache policy unicenter-desktop-management-bundle || rpm -q unicenter-desktop-management-bundle || unicenter-desktop-management-bundle --version
2. No fixed release: DOWNGRADE to a release before r11.1 (Debian / Ubuntu)
apt-cache madison unicenter-desktop-management-bundle
sudo apt install unicenter-desktop-management-bundle=<VERSION_BEFORE_r11.1>
sudo apt-mark hold unicenter-desktop-management-bundle
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list unicenter-desktop-management-bundle
sudo dnf downgrade unicenter-desktop-management-bundle-<VERSION_BEFORE_r11.1>
sudo dnf versionlock add unicenter-desktop-management-bundle
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
computer associates unicenter remote control DOWNGRADE
Affected: r11.1 · r11.2 · r11.2a · r11.2c1 · r11.2c2
Fixed in: no fixed release known
Safe to downgrade to: a release before r11.1
1. Check installed version
apt-cache policy unicenter-remote-control || rpm -q unicenter-remote-control || unicenter-remote-control --version
2. No fixed release: DOWNGRADE to a release before r11.1 (Debian / Ubuntu)
apt-cache madison unicenter-remote-control
sudo apt install unicenter-remote-control=<VERSION_BEFORE_r11.1>
sudo apt-mark hold unicenter-remote-control
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list unicenter-remote-control
sudo dnf downgrade unicenter-remote-control-<VERSION_BEFORE_r11.1>
sudo dnf versionlock add unicenter-remote-control
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2008-1786?
arcserve backup laptops and desktops: downgrade or apply the listed mitigation; desktop and server management: downgrade or apply the listed mitigation; desktop management suite: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2008-1786 being exploited?
CVE-2008-1786 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2008-1786 affect?
CVE-2008-1786 affects arcserve backup laptops and desktops, desktop and server management, desktop management suite. Severity is high (CVSS 9.3). The DSM gui_cm_ctrls ActiveX control (gui_cm_ctrls.ocx), as used in multiple CA products including BrightStor ARCServe Backup for Laptops and Desktops r11.5, Desktop Management Suite r11.1 through r11.2 C2; Unicenter r11.1 through r11.2 C2;
How urgent is CVE-2008-1786?
Priority 56/100. Critical severity; EPSS top 6%: very likely to be exploited
Related CVEs
- CVE-2008-1329 HIGH 10.0 DOWNGRADE DOWNGRADE Unspecified vulnerability in the NetBackup service in CA ARCserve Backup for Laptops and Desktops r11.0 throug
- CVE-2008-1328 HIGH 9.3 DOWNGRADE DOWNGRADE Buffer overflow in the LGServer service in CA ARCserve Backup for Laptops and Desktops r11.0 through r11.5, an