CVE-2017-9811

This flaw is like a backdoor in the antivirus’s control features: a person who should not be able to manage the system can misuse how the antivirus reads/writes files in quarantine to gain administrator-level control. In practical terms, that means they could take over the Linux server that runs your file-server antivirus.

This matters if your business runs Kaspersky Anti-Virus for Linux File Server (anti-virus for linux server / kaspersky anti-virus for linux file server). The findings say the attacker does not need a special login and does not need user interaction, and the attack path is described as network-based. The exact “reachable in default configuration” condition is not known from the findings, so treat it as a risk if the relevant antivirus control/quarantine actions are reachable from the network in your setup.

This is an AMBER issue because an attacker can use it to obtain full control of the Linux server, and there are public exploits available. Even though it’s not listed in CISA KEV, the high-impact result (full takeover) means you should prioritize patching rather than waiting.