dormakaba evolo Service: Remote code execution via .NET component

Summary

The dormakaba evolo Service, a Windows service used with the evolo Manager (KEM) for CardLink terminals, contains a flaw in a .NET component that allows an attacker to execute arbitrary code as SYSTEM. The vendor states that exploitation is only possible from within the internal network, while the researcher advisory describes an unauthenticated attacker. Successful exploitation could allow control over the door access system. No vendor fix is available.

Affected

• dormakaba evolo Service, all versions (vendor advisory DKSA-26-31-031)
• Researcher advisory MLSA-2026-001 lists versions up to and including 7.1.76.0; the vendor does not confirm this version boundary
• Standalone installations of the service are also affected

Fixed in

Unknown. No vendor patch or fixed version was found at the time of research.

Workaround

• Uninstall the evolo Service completely if no CardLink Update Terminals are used; evolo Manager installations without the service are not affected
• If the service is still needed, operate the host in a protected network and restrict access with strict firewall rules
• Restrict access to TCP port 8902 with a local host firewall rule
• Keep the Windows host off untrusted networks and do not expose it to the internet

Exploitation

• Known exploited: no. No CISA KEV listing was found.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Public proof of concept: not found in the research; this does not prove that none exists.

Our recommendation

• Identify all hosts with the evolo Service, including standalone installations
• Check whether CardLink Update Terminals are in use
• Remove the service where it is not needed
• Where it is needed, isolate the host with strict firewall rules and restrict access to TCP port 8902
• Monitor for unusual activity on these hosts and check the vendor security advisories for a fix

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Vendor advisory DKSA-26-31-031 (PDF) assets.ctfassets.net
• dormakaba security advisories www.dormakabagroup.com
• Researcher advisory MLSA-2026-001 mogwailabs.de
• CISA ADP Vulnrichment record (via HOL) hol.org
• evolo Manager V7.2 operating manual res.cloudinary.com
• CVE Brief (third-party scoring) cvebrief.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:17.