CVE-2026-64960 is a file upload RCE in ATutor's Gameme module. The vulnerability is straightforward: unrestricted file upload in a web-accessible directory, combined with a course_id=0 bypass that eliminates the authorization check entirely. Any authenticated user can upload and execute arbitrary code. This is not a new vulnerability type — it's the same genetic sequence we've seen in Moodle, Sakai, and Blackboard, repeatedly, because the LMS ecosystem has never solved the fundamental design problem of storing user content on the same server that executes it.
The critical factor here is that ATutor is end-of-life. There will be no patch. But the EOL status changes the vulnerability in ways the CVSS score doesn't capture. The 'authenticated attacker' prerequisite assumes an active authorization boundary maintained by active operations. That assumption is dead. Alumni still have credentials. Credential dumps surface old accounts. Abandoned systems don't rotate passwords or clean up stale accounts. 'Authenticated' in this context means 'anyone with a legacy account and a grudge' — a population that expands over time, not contracts.
The course_id=0 shortcut reveals something deeper: the developer who wrote it operated on an implicit threat model that was never documented — 'the set of authenticated users is bounded and trustworthy.' That assumption has rotted away. Current account populations include former students, former contractors, accounts tied to decommissioned identity providers. The perimeter has been decaying for years with no one mapping it.
Defenders should treat EOL vulnerabilities differently from patchable ones. This is not a temporary gap with a fix on the way — it's a permanent architectural constraint. Your risk model needs to account for the fact that the 'attack surface' here includes every stale credential still valid in that database, and that surface is growing, not shrinking. The practical options are narrow: decommission the system if you can, or accept that you're managing permanent RCE exposure and restrict network access aggressively while documenting the inherited risk for stakeholders who need to understand this is now a feature of the landscape, not a problem with a solution.