Security researchers and Microsoft have disclosed multiple vulnerabilities affecting certain versions of SharePoint Server:

• CVE-2026-55040: An authentication bypass vulnerability stemming from weaknesses in how it validates JSON Web Tokens (JWTs). A remote, unauthenticated attacker who knows or enumerates a target user's Active Directory Security ID (SID) or User Principal Name (UPN) can leverage this flaw to bypass authentication checks. Successful exploitation grants the attacker unauthorized access, allowing them to perform actions, disclose files, and modify data under the identity of the impersonated user, including administrators. The vulnerability has been designated CVE-2026-55040 and has been rated critical with a CVSS score of 9.1.
• CVE-2026-56164: A privilege escalation vulnerability stemming from missing authentication for a critical function. Successful exploitation allows a remote, unauthenticated attacker to elevate privileges. The vulnerability has been designated CVE-2026-56164 and has been rated medium with a CVSS score of 5.3.

Vulnerability researchers disclosed that CVE-2026-55040 is the first link in a high-impact, two-vulnerability exploit chain originally developed for the Pwn2Own Berlin hacking competition. The second vulnerability, yet to be publicly disclosed, is a remote code execution (RCE) flaw. Microsoft plans to patch the RCE vulnerability during its August 2026 security update cycle. Applying the July 2026 patch for CVE-2026-55040 is critical, as it successfully disrupts this exploit chain and prevents unauthenticated RCE.

Update (July 15, 2026): There is evidence that CVE-2026-56164 is being actively exploited in the wild, prompting its addition to the CISA KEV catalog on July 14, 2026.

The following versions are affected

• SharePoint Enterprise Server 2016: Versions prior to 16.0.5561.1001
• SharePoint Server 2019: Versions prior to 16.0.10417.20175
• SharePoint Server Subscription Edition: Versions prior to 16.0.19725.20434

What is Microsoft SharePoint?

Microsoft SharePoint is a web-based collaboration and document management platform, available both within Microsoft 365 and as on-premises software, that serves as a secure, centralized hub for storing, organizing, and sharing information across devices.

What is the impact?

Successful exploitation of this vulnerability allows an unauthenticated attacker to bypass security checks, impersonate valid users, and gain unauthorized access to disclose or modify sensitive data on the SharePoint server.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• SharePoint Enterprise Server 2016: Upgrade to version 16.0.5561.1001 or later.
• SharePoint Server 2019: Upgrade to version 16.0.10417.20175 or later.
• SharePoint Server Subscription Edition: Upgrade to version 16.0.19725.20434 or later.

How do I find Microsoft SharePoint Server installations with runZero?

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Microsoft AND version:>0 AND (
  (product:="SharePoint Server 2016" AND (version:>=16.0.4107.1002 AND version:<16.0.5561.1001)) OR
  (product:="SharePoint Server 2019" AND (version:>=16.0.10337.12109 AND version:<16.0.10417.20175)) OR
  (product:="SharePoint Server Subscription Edition" AND (version:>=16.0.0.1 AND version:<16.0.19725.20434))
  )

March 2026: CVE-2026-20963

On January 13, 2026, Microsoft disclosed a remote code execution vulnerability, designated CVE-2026-20963, in Microsoft SharePoint. The vulnerability is due to deserialization of untrusted data in Microsoft SharePoint which allows a remote, unauthenticated attacker attacker to execute code over a network.

While initially released with a CVSS score of 8.8, the score was updated to 9.8 on March 17, 2026.

This vulnerability is known to be exploited in the wild and was added to the CISA.gov Known Exploited Vulnerabilities (KEV) list on March 18, 2026.

The following versions are affected:

• SharePoint Enterprise Server 2016 before version 16.0.5535.1001
• SharePoint Server 2019 before version 16.0.10417.20083
• SharePoint Server Subscription Edition before version 16.0.19127.20442

What is the impact?

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are any updates or workarounds available?

Upgrade affected versions of SharePoint Server to the latest patched version.

• SharePoint Enterprise Server 2016 version 16.0.5535.1001 or later

• SharePoint Server 2019 version 16.0.10417.20083 or later

• SharePoint Server Subscription Edition version 16.0.19127.20442 or later

How do I find Microsoft SharePoint Server installations with runZero?

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Microsoft AND (
  (product:="SharePoint Server 2016" AND (version:>=16.0 AND version:<16.0.5535.1001)) OR
  (product:="SharePoint Server 2019" AND (version:>=16.0 AND version:<16.0.10417.20083)) OR
  (product:="SharePoint Server Subscription Edition" AND (version:>=16.0 AND version:<16.0.19127.20442))
  ) AND NOT version:=""

July 2025 (Multiple CVEs)

Microsoft has disclosed two vulnerabilities in certain versions of on-premises Microsoft SharePoint Server:

• SharePoint Server deserializes untrusted data without sufficiently ensuring that the resulting data will be valid resulting in a remote code execution (RCE) vulnerability. The vulnerability allows an unauthenticated adversary to remotely execute code on the vulnerable server. This vulnerability has been designated CVE-2025-53770 and has been rated critical with a CVSS score of 9.8. This vulnerability is a variant of a remote code execution vulnerability designated CVE-2025-49704 that was patched earlier this month. There is evidence that this vulnerability is being actively exploited in the wild.
• SharePoint Server improperly limits a pathname to a restricted directory allowing path traversal in Microsoft Office SharePoint resulting in a spoofing vulnerability. The vulnerability allows an authorized adversary to perform spoofing over a network. This vulnerability has been designated CVE-2025-53771 and has been rated medium with a CVSS score of 6.3. This vulnerability is a variant of a spoofing vulnerability designated CVE-2025-49706 that was patched earlier this month.

The following versions are affected

• Microsoft SharePoint Enterprise Server 2016 versions currently unknown
• Microsoft SharePoint Server 2019 versions currently unknown
• Microsoft SharePoint Server Subscription Edition versions 16.0.0 prior to 16.0.18526.20508

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are any updates or workarounds available?

As of 7/20/2025 security updates are available for Microsoft SharePoint Server Subscription Edition. A patch is currently unavailable for other affected versions, but Microsoft is actively working on a security update.

• Mitigate attacks against on-premises SharePoint Server environments by configuring the Windows Antimalware Scan Interface (AMSI) integration in SharePoint and deploying Defender AV on all SharePoint servers. This should stop an unauthenticated adversary from successfully exploiting the vulnerability.
• Rotate SharePoint Server ASP.NET machine keys.

• Upgrade affected systems to the new versions when a patch is available.

How do I find Microsoft SharePoint Server installations with runZero?

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="Microsoft" AND product:="SharePoint Server%"

SonicWall disclosed that certain versions of the SMA1000 series appliances are susceptible to the following vulnerabilities:

• CVE-2026-15409: A Server-Side Request Forgery (SSRF) vulnerability allows a remote unauthenticated attacker to access internal server resources and unintended locations. This vulnerability has been designated CVE-2026-15409 and has been rated critical with a CVSS score of 10.0.
• CVE-2026-15410: A authenticated remote code execution (RCE) vulnerability in the SMA1000 Appliance Management Console (AMC) could allow an attacker with administrator permissions to execute OS commands. This vulnerability has been designated CVE-2026-15410 and has been rated high with a CVSS score of 7.2.

There is evidence that these vulnerabilities are being actively exploited in the wild and the vulnerability has been added to the CISA KEV list July 14th, 2026.

The following versions are affected:

• SMA1000 Models - 6210, 7210, 8200v
  • 12.4.3-03245
  • 12.4.3-03387
  • 12.4.3-03434
  • 12.5.0-02283
  • 12.5.0-02624
  • 12.5.0-02800

What is SonicWall SMA1000?

SonicWall Secure Mobile Access (SMA) 1000 series appliances are hardware security devices that provide zero-trust and secure access gateway support for businesses.

What is the impact?

Successful exploitation of the vulnerabilities allows an unauthenticated attacker with network access to gain unauthorized access to management functionality, potentially allowing an attacker to access administrative endpoints and if the vulnerabilities can be chained potentially remote code execution.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

• Version 12.4.3-03453 or later
• Version 12.5.0-02835 or later

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="SonicWall SMA1000" AND os_version:>0 AND (os_version:=12.4.3 OR os_version:=12.5.0)

May 2026: CVE-2026-0204, CVE-2026-0205, and CVE-2026-0206

SonicWall disclosed that certain versions of SonicOS across Gen 6, Gen 7, and Gen 8 firewall platforms are susceptible to the following vulnerabilities:

• CVE-2026-0204: A flaw in the access control mechanism may expose management interface functions under specific conditions. An unauthenticated attacker with adjacent network access could gain unauthorized access to management functionality, potentially leading to security control bypasses or administrative misuse. This vulnerability has been designated CVE-2026-0204 and has been rated high with a CVSS score of 8.0.
• CVE-2026-0205: A post-authentication path traversal vulnerability allows an authenticated attacker with adjacent network access to interact with restricted services. This vulnerability has been designated CVE-2026-0205 and has been rated medium with a CVSS score of 6.8.
• CVE-2026-0206: A post-authentication stack-based buffer overflow allows a remote, high-privileged attacker to cause a denial-of-service (DoS) by crashing the firewall. This vulnerability has been designated CVE-2026-0206 and has been rated medium with a CVSS score of 4.9.

While unconfirmed, the initial authentication bypass (CVE-2026-0204) may provide an unauthenticated attacker with the privileges necessary to chain and exploit the subsequent path traversal and buffer overflow vulnerabilities.

The following versions are affected:

• Gen 6 Series (TZ 300/400/500/600, NSA 2650–6650, SOHO 250, SM 9200–9650): SonicOS version 6.5.5.1-6n and prior.
• Gen 7 Series (TZ 270–670, NSa 2700–6700, NSsp 10700–15700, NSv 270-870): SonicOS 7.0.1-5169 and prior, and 7.3.1-7013 and prior.
• Gen 8 Series (TZ 80–680, NSa 2800–5800): SonicOS version 8.1.0-8017 and prior.

What is the impact?

Successful exploitation of the vulnerabilities allows an unauthenticated attacker with adjacent network access to gain unauthorized access to management functionality, potentially leading to security control bypasses.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

• Gen 6 Series: Upgrade to SonicOS version 6.5.5.2-28n or later.
• Gen 7 Series: Upgrade to SonicOS version 7.3.2-7010 or later.
• Gen 8 Series: Upgrade to SonicOS version 8.2.0-8009 or later.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="SonicWall%" AND os:="SonicWall SonicOS%" AND
  os_version:>0 AND ((os_version:<"6.5.5.2-28n") OR
  (os_version:>="7" AND os_version:<"7.3.2-7010") OR
  (os_version:>="8" AND os_version:<"8.2.0-8009"))

July 2025: SMA1000 series, multiple vulnerabilities

SonicWall has disclosed four vulnerabilities, across two advisories (SNWLID-2025-0014 and SNWLID-2025-0012), in certain versions of SMA 100 series products (SMA 210, 410 and 500v).

• An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote adversary with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution (RCE). This vulnerability has been designated CVE-2025-40599 and has been rated critical with a CVSS score of 9.1.
• A stack-based buffer overflow vulnerability in the SMA 100 series web interface may allow a remote, unauthenticated adversary to achieve remote code execution (RCE) or cause a denial-of-service (DoS) condition. This vulnerability has been designated CVE-2025-40596 and has been rated high with a CVSS score of 7.3.
• A heap-based buffer overflow vulnerability in the SMA 100 series web interface may allow a remote, unauthenticated adversary to achieve remote code execution (RCE) or cause a denial-of-service (DoS) condition. This vulnerability has been designated CVE-2025-40597 and has been rated high with a CVSS score of 7.5.
• A reflected cross-site scripting (XSS) vulnerability in the SMA 100 series web interface may allow a remote, unauthenticated adversary to execute arbitrary client-side JavaScript code in a victim's web browser. This vulnerability has been designated CVE-2025-40598 and has been rated medium with a CVSS score of 6.1.

The following versions are affected

• SMA 100 Series (SMA 210, 410, 500v) version 10.2.1.15-81sv and prior versions

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable device, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• SMA 100 Series (SMA 210, 410, 500v) upgrade to version 10.2.2.1-90sv or later

There is no evidence these vulnerabilities are being exploited in the wild. However, due to latest threat intelligence from Google Threat Intelligence Group (GTIG), which highlights potential risks, SonicWall is strongly advising all organizations using SMA 100 series products to take additional measures detailed in the comments section of the security advisory SNWLID-2025-0014.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially vulnerable assets:

hw:="SonicWall SMA100"

May 2025: SMA1000 series, multiple vulnerabilities

SonicWall has issued an advisory for its SMA100 Series appliances. 

• CVE-2025-32819 and has been rated high with a CVSS score of 8.8.
• CVE-2025-32820 and has been rated high with a CVSS score of 8.3.
• CVE-2025-32821 and has been rated medium with a CVSS score of 6.7.

What is the impact?

When chained together, the vulnerabilities could allow a remote authenticated attacker to bypass system checks leading to potential remote code execution. It does not affect SonicWall Firewall or SMA 1000 series appliances.

Are updates or workarounds available?

The vendor advises users to update to platform-hotfix (10.2.1.15-81sv or later) as soon as possible. The vendor also advises its customers to configure multifactor authentication (MFA) and enable WAF on the appliance.

How to find potentially vulnerable systems with runZero

From the Service Inventory, use the following query to locate systems running potentially vulnerable firmware:

hw:"SonicWall SMA100" OR (_asset.protocol:http AND http.head.server:="SonicWALL SSL-VPN Web Server")

January 2025: SMA1000 Series

SonicWall has issued an advisory for its SMA1000 Series appliances. The vendor reported that this vulnerability may be actively exploited in the wild.

This vulnerability has been designated CVE-2025-23006 and has been assigned a CVSS score of 9.8 (critical).

What is the impact?

The vulnerability would allow for a remote unauthenticated attacker to execute arbitrary operating system commands. The vulnerability was discovered within the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC). It does not affect SonicWall Firewall or SMA 100 series appliances.

Are updates or workarounds available?

The vendor advises users to update to platform-hotfix (12.4.3-02854 or later) as soon as possible. The vendor also advises its customers to follow the steps outlined in the Best Practices section of the SMA1000 Administration Guide. Access to the console should also be restricted to trusted networks.

How to find potentially vulnerable systems with runZero

From the Service Inventory, use the following query to locate systems running potentially vulnerable firmware:

hw:"SonicWall SMA1000" OR _asset.protocol:http (last.html.title:="Appliance Management Console Login" OR last.html.title:="Central Management Console Login" OR http.head.server:="SMA/%" OR (favicon.ico.image.mmh3:"16866410" AND (last.html.title:"WorkPlace" OR html.title:"WorkPlace")))

September 2024: SonicOS and SSLVPN

SonicWall disclosed a vulnerability that affects SonicOS management access and SSLVPN software on SonicWall Gen 5, Gen 6, in addition to Gen 7 devices running SonicOS version 7.0.1-5035 or earlier.

CVE-2024-40766 is rated critical with CVSS score of 9.3, and potentially allows for unauthorized resource access by an attacker.

What is the impact?

Successful exploitation of this vulnerability potentially results in unauthorized resource access and in some cases could lead to a DoS after causing vulnerable devices to crash.

Are updates or workarounds available?

SonicWall recommends restricting management access to trusted sources or disabling WAN management from the public Internet. Additionally, SonicWall has released updated firmware which is available for download from mysonicwall.com.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:"SonicWall"

• Communications
• Defense Industrial Base
• Energy
• Financial Service
• Government Services and Facilities, especially state and local level entities
• Healthcare and Public Health

The attack strategy

The threat actors are using a multi-step process to steal and exfiltrate router configurations for future exploitation, including:

1. Scanning Internet IP Ranges for devices using default community strings for SNMPv1 and 2
2. Once discovered, SNMP commands are executed against the devices
3. Router configuration is copied off and sent via TFTP
4. The cyber actor accesses the stolen data.

Recommended actions for mitigating these attacks

The CSA guidance calls out six mitigation actions to help defenders protect their environments:

1. Disable Cisco Smart Install on all devices
2. Discontinue use of and disable SNMPv1 and v2. Use SNMPv3 with ‘authPriv’ configured to modernize encryption
3. Use strong and unique passwords for local accounts on network devices and configure secure storage for credentials
   1. Avoid using Cisco hashing other than type 8.
4. Monitor and restrict access to SNMP OID’s using a MIB allow-list.
   1. Monitor and configure IDS rules for SNMP Set-Requests that target OIDs that have access to target sensitive data
5. Restrict and monitor management protocols
   1. On edge devices, deny or strictly monitor:
      1. TFTP (UDP 69)
      2. SMI (TCP 4786)
      3. SNMP (UDP 161 and 162)
      4. SNMPv3 (TCP/UDP 10161 and 10162)
6. Ensure network devices are running up to date software and firmware packages. Patch known vulnerabilities, and replace end of life (EOL) devices.

How runZero can help

runZero can help federal agencies, financial institutions, critical infrastructure, and everyone in between to quickly and efficiently implement the mitigations the advisory recommends. By scanning your internal and external attack surface, runZero can ensure that you are in a strong defensive posture against adversarial cyber actors by allowing you to:

1. Identify all Cisco devices with Cisco Smart Install enabled, and what interface its enabled on, with a native Vulnerability finding

2. Identify default SNMPv2 and v2 community strings with a native SNMP defaults finding:

3. Identify all instances of SNMPv1 or v2 with:

   protocol:snmp AND (protocol:snmp1 or protocol:snmp2)

1. Or, to just find all instance of SNMP running with just protocol:snmp

4. Identify any and all management protocols, even over non standard ports:

5. Discovery of EOL network devices with a native finding of EOL devices, including a finding for edge devices as they pertain to BOD 26-02:

If you aren’t certain that your network is properly protected against this threat vector, contact us today or sign up for a free trial at: https://www.runzero.com/try/.

Ubiquiti disclosed multiple vulnerabilities affecting certain versions of the UniFi OS:

• CVE-2026-54401: A Server-Side Request Forgery (SSRF) vulnerability that allows a remote, low-privileged attacker to escalate privileges within UniFi OS devices or instances. The vulnerability has been designated CVE-2026-54401 and has been rated high with a CVSS score of 7.7.
• CVE-2026-54402: An improper input validation vulnerability that allows a remote, low-privileged attacker to perform command injection on the host device. The vulnerability has been designated CVE-2026-54402 and has been rated critical with a CVSS score of 9.9.
• CVE-2026-54403: A path traversal vulnerability that allows a remote, low-privileged attacker to bypass authentication on UniFi OS devices or instances. The vulnerability has been designated CVE-2026-54403 and has been rated high with a CVSS score of 8.6.
• CVE-2026-54404: A series of authenticated SQL Injection (SQLi) vulnerabilities that allow a remote, low-privileged attacker to escalate privileges within UniFi OS devices or instances. The vulnerability has been designated CVE-2026-54404 and has been rated high with a CVSS score of 8.8.
• CVE-2026-55110: A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability that allows a remote, unauthenticated attacker, who convinces an authenticated user to visit a malicious webpage, to trigger operations in UniFi OS using that user's session. The vulnerability has been designated CVE-2026-55110 and has been rated high with a CVSS score of 7.5.
• CVE-2026-55112: An improper access control vulnerability that allows a remote, low-privileged attacker to escalate privileges on the host device under certain conditions when UniFi OS is configured with the UniFi Protect Application. The vulnerability has been designated CVE-2026-55112 and has been rated high with a CVSS score of 7.5.
• CVE-2026-55116: An improper access control vulnerability that, under certain network configurations, allows a remote, unauthenticated attacker to make unauthorized changes to UniFi OS devices. The vulnerability has been designated CVE-2026-55116 and has been rated critical with a CVSS score of 9.0.

The following software versions are affected across their respective hardware platforms (including all standalone servers, UDM, UNAS, UCG, UCK, UNVR, ENVR, and EF consoles):

• UniFi OS / Server (Standard Consoles): Version 5.1.15 and prior.
  • Applies to all reported CVEs (CVE-2026-54401 through CVE-2026-55116).
  • Note on CVE-2026-55112: This risk only presents if the platform is running the UniFi Protect Application.
• UniFi Network Attached Storage (UNAS): Version 5.1.16 and prior.
  • Applies to CVE-2026-54401, CVE-2026-54402, CVE-2026-54403, CVE-2026-54404, and CVE-2026-55110.
• Enterprise Firewall (EF-Core): Version 5.1.18 and prior.
  • Applies to all reported CVEs.

Note on CVE-2026-54403: While the narrative text within the manufacturer's advisory suggests that chaining this path traversal flaw could allow an attacker to bypass the low-privilege threshold, the formal CVSS tracking metrics officially list the Privileges Required (PR) value as "None."

What is Ubiquiti UniFi OS?

Ubiquiti UniFi OS is a Linux-based operating system and application server platform deployed across dedicated Cloud Gateways, hardware consoles, and self-hosted servers to manage and run individual network and security applications.

What is the impact?

Successful exploitation of these vulnerabilities allows an adversary to bypass authentication, escalate privileges on the host device, and make unauthorized system or configuration changes.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• All Platforms: Upgrade to UniFi OS version 5.1.19 or later.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

os:="Ubiquiti UniFi OS"

Ubiquiti disclosed multiple vulnerabilities affecting certain versions of the UniFi Protect Application:

• CVE-2026-54407: An improper access control vulnerability that allows a remote, unauthenticated attacker to bypass authentication on specific UniFi Protect Application API endpoints. The vulnerability has been designated CVE-2026-54407 and has been rated high with a CVSS score of 8.6.
• CVE-2026-54408: An improper access control vulnerability that allows a remote, unauthenticated attacker to bypass data streaming authentication. The vulnerability has been designated CVE-2026-54408 and has been rated high with a CVSS score of 8.6.
• CVE-2026-54409: An improper initialization vulnerability that allows a remote, unauthenticated attacker to bypass authentication on UniFi Protect cameras under certain conditions. The vulnerability has been designated CVE-2026-54409 and has been rated high with a CVSS score of 7.5.
• CVE-2026-55115: A Server-Side Request Forgery (SSRF) vulnerability that allows a remote, low-privileged attacker to escalate privileges on the host device. The vulnerability has been designated CVE-2026-55115 and has been rated critical with a CVSS score of 9.9.
• CVE-2026-56841: An authenticated SQL Injection (SQLi) vulnerability that allows a remote, low-privileged attacker to escalate privileges on the host device. The vulnerability has been designated CVE-2026-56841 and has been rated high with a CVSS score of 8.8.

The following versions are affected

• UniFi Protect Application: Versions 7.1.77 and prior.

What is Ubiquiti UniFi Protect?

Ubiquiti UniFi Protect is a network video management application that operates on specialized local hardware to manage camera configuration, video recording, and event-based analytics for an integrated surveillance system.

What is the impact?

Successful exploitation of these vulnerabilities allows an adversary to escalate privileges on the host device while gaining unauthorized access to the UniFi Protect API endpoints, data streaming, and connected cameras.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• UniFi Protect Application: Version 7.1.83 or later.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Ubiquiti _NVR%"

January 2026: CVE-2026-21633 and CVE-2026-21634

Ubiquiti disclosed multiple vulnerabilities affecting certain versions of the UniFi Protect Application:

• An improper authentication vulnerability via the discovery protocol. Successful exploitation allows a network-adjacent, unauthenticated adversary to obtain unauthorized access to UniFi Protect cameras. The vulnerability has been designated CVE-2026-21633 and has been rated high with a CVSS score of 8.8.
• A buffer overflow vulnerability via the discovery protocol. Successful exploitation allows a network-adjacent, unauthenticated adversary to restart the application, causing a denial-of-service (DoS) condition. The vulnerability has been designated CVE-2026-21634 and has been rated medium with a CVSS score of 6.5.

The following versions are affected

• UniFi Protect Application versions 6.1.79 and prior

What is the impact?

Successful exploitation of the vulnerabilities would allow an adversary to gain unauthorized access to UniFi Protect cameras or cause denial-of-service (DoS) conditions limiting proper function.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• UniFi Protect Application upgrade to version 6.2.72 or later

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Ubiquiti _NVR%"

May 2025: UniFi Protect IP cameras (CVE-2025-23123)

In May 2025, Ubiquiti disclosed a vulnerability in its UniFi Protect IP cameras. This vulnerability allowed an unauthenticated attacker with access to the camera's management network to execute arbitrary code on the device.

This vulnerability was designated CVE-2025-23123 and had a CVSS score of 10.0 (critical). 

What was the impact?

An attacker with access to the camera's management interface would be able to execute arbitrary code on the device. This would allow the attacker to take complete control of the device.

Were updates or workarounds available?

Ubiquiti released an update to the firmware, version 4.75.62, to address this issue. Users were recommended to update to this or a later version as quickly as possible.

How to find UniFi Protect cameras with runZero

From the Asset inventory, use the following query to locate Ubiquiti IP cameras on your network:

hw:Ubiquiti type:Camera

Adobe disclosed (via bulletin ID APSB26-68) multiple vulnerabilities in their ColdFusion rapid application development product that could allow an attacker to execute arbitrary code on vulnerable systems, or disclose the contents of arbitrary files.

• CVE-2026-48276: Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. This vulnerability is considered critical with a CVSS score of 10.0.
• CVE-2026-48277: Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. This vulnerability is considered critical with a CVSS score of 10.0.
• CVE-2026-48281: Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. This vulnerability is considered critical with a CVSS score of 10.0.
• CVE-2026-48282: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. This vulnerability is considered critical with a CVSS score of 10.0.
• CVE-2026-48283: Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. This vulnerability is considered critical with a CVSS score of 10.0.
• CVE-2026-48313: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. This vulnerability is considered critical with a CVSS score of 9.3.
• CVE-2026-48315: Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. This vulnerability is considered critical with a CVSS score of 9.3.
• CVE-2026-48307: Reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially resulting in arbitrary code execution in the context of the current user. This vulnerability is considered high with a CVSS score of 8.8.
• CVE-2026-48285: Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. This vulnerability is considered high with a CVSS score of 8.6.

Update (July 7, 2026): There is evidence that CVE-2026-48282 is being actively exploited in the wild.

What is Adobe ColdFusion?

Adobe ColdFusion is a commercial rapid web-application development platform that runs on top of Java and uses its own simplified scripting language, ColdFusion Markup Language (CFML). It is primarily designed to easily connect dynamic web pages to databases and streamline complex enterprise tasks with minimal code.

What is the impact?

Successfully exploiting one of these vulnerabilities could allow an attacker to execute arbitrary code on the vulnerable system, or disclose the contents of arbitrary files.

ColdFusion 2025.9, 2023.20, and earlier versions are vulnerable.

Are updates or workarounds available?

Adobe has released updates that address these vulnerabilities and users are advised to upgrade as quickly as possible.

How do I find potentially vulnerable systems with runZero?

From the Software Inventory, use the following query to locate systems running potentially vulnerable software:

vendor:=Adobe AND product:ColdFusion

April 2025: Adobe ColdFusion vulnerabilities

On April 8, 2025, Adobe disclosed (via bulletin ID APSB25-15) multiple vulnerabilities in their ColdFusion rapid application development product that could allow an attacker to execute arbitrary code on vulnerable systems, or disclose the contents of arbitrary files.

What was the impact?

Successfully exploiting one of these vulnerabilities could allow an attacker to execute arbitrary code on the vulnerable system, or disclose the contents of arbitrary files.

ColdFusion 2021, 2023, and 2025 were vulnerable.

Were updates or workarounds available?

Adobe released updates that addressed these vulnerabilities and users were advised to upgrade as quickly as possible.

How do I find potentially vulnerable systems with runZero?

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

product:ColdFusion

BeyondTrust disclosed multiple pre-authentication authorization vulnerabilities affecting certain versions of both Remote Support (RS) and Privileged Remote Access (PRA). The vulnerabilities have been designated CVE-2026-40138, CVE-2026-40139, CVE-2026-40140, & CVE-2026-40141 and has the highest risk of the vulnerabilities been rated critical with a CVSS score of 9.2.

What are BeyondTrust Remote Support, and Privileged Remote Access?

BeyondTrust Remote Support (RS) is an enterprise platform designed for help desks to securely access and troubleshoot end-user devices or mobile platforms across any network without a VPN.

BeyondTrust Privileged Remote Access (PRA) is a zero-trust security solution providing vendors and internal admins with granular, audited access to critical infrastructure without granting full network visibility.

What is the impact?

Successful exploitation of these issues may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to appliances, impact availability, access internal appliance data, and in some configurations gain authenticated privilege escalation.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• Remote Support (RS) versions 25.3.2 and prior upgrade to version 25.3.3 and later
• Privileged Remote Access (PRA) versions 25.3.2 and prior upgrade to version 25.3.3 and later

How to find potentially vulnerable systems with runZero

From the Services Inventory, use the following query to locate potentially impacted assets:

_asset.protocol:=http AND protocol:=http AND
  (product:="BeyondTrust Remote Support" OR product:="BeyondTrust Privileged Remote Access")
  AND _service.product:beyondtrust

February 2026: CVE-2026-1731

BeyondTrust disclosed a pre-authentication remote code execution (RCE) vulnerability affecting certain versions of both Remote Support (RS) and Privileged Remote Access (PRA). This flaw is triggered via specially crafted client requests sent to the appliance. Successful exploitation could allow a remote, unauthenticated adversary to execute arbitrary operating system commands in the context of the site user, potentially leading to full system compromise. The vulnerability has been designated CVE-2026-1731 and has been rated critical with a CVSS score of 9.9.

There is evidence that this vulnerability is being actively exploited in the wild.

The following versions are affected:

• Remote Support (RS) versions 25.3.1 and prior
• Privileged Remote Access (PRA) versions 24.3.4 and prior

What is the impact?

Successful exploitation of the vulnerability would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• Remote Support (RS) versions 21.3 and older upgrade to a newer version to apply patch BT26-02-RS
• Remote Support (RS) versions 25.3.1 and prior upgrade to version 25.3.2 and later
• Privileged Remote Access (PRA) versions 22.1 and older upgrade to a newer version to apply patch BT26-02-PRA
• Privileged Remote Access (PRA) versions 24.3.4 and prior upgrade to version 25.1.1 and later

How to find potentially vulnerable systems with runZero

From the Services Inventory, use the following query to locate potentially impacted assets:

_asset.protocol:=http AND protocol:=http AND
  (product:="BeyondTrust Remote Support" OR
  product:="Beyond Trust Remote Support" OR
  product:="BeyondTrust BeyondTrust Remote Support" OR
  product:="BeyondTrust Privileged Remote Access")
  AND _service.product:beyondtrust

January 2025: CVE-2024-12356

BeyondTrust disclosed that affects their Privileged Remote Access (PRA) and Remote Support (RS) appliances. This has also been added to the CISA KEV as it has been exploited in the wild.

• CVE-2024-12356 is rated highly-critical with a CVSS score of 9.8. Successful exploitation of this vulnerability would allow an attacker execute arbitrary commands on the appliance.

What is the impact?

The issue impacts PRA and RS versions 24.3.1 and earlier.

Are updates or workarounds available?

BeyondTrust has released a patch for all supported iterations of PRA and RS versions 22.1.x and higher and has applied the patch to cloud customers earlier this week.

How do I find potentially vulnerable systems with runZero?

From the Services Inventory, use the following query to locate systems running potentially vulnerable software:

vendor:BeyondTrust or http.body:BeyondTrust

From the Assets Inventory, use the following query to locate systems running potentially vulnerable software:

os:BeyondTrust OR hw:BeyondTrust OR os:Bomgar OR hw:Bomgar

While AI-driven attacks are ramping up, defenders now have the tools to stay ahead. By integrating deep intelligence across IT, OT, IoT, cloud, and mobile environments, organizations can move from passive asset listing to proactive risk reduction. Now is the time to prepare and understand the most effective strategy for countering this new reality with comprehensive exposure management built to outpace AI threats.

runZero: Definitive record of risk reduction for AI threats

With AI's ability to quickly chain vulnerabilities together, having a single source of truth for exposure management across your total attack surface is crucial. runZero now serves as the definitive system of record for risk reduction, managing the entire remediation lifecycle from identification to verified closure.

Traditional vulnerability tools often leave defenders buried in noise. By leading with exposure-driven decisions and keeping the network picture current, runZero allows security teams to instantly uncover critical exposures and validate network isolation before an attacker finds the gaps.

runZero’s Exposure Management Platform is a game-changer for defenders. It delivers complete visibility and exposure intelligence across your entire attack surface, including IT, OT, IoT, mobile, and cloud, without agents, credentials, or appliances.

With the combined power of runZero 4.9 and 5.0, defenders can map hidden attack paths, identify segmentation gaps, and verify remediation against live discovery data. This shift from reactive patching to proactive, risk-based prioritization ensures that defenders win by default, even against AI-driven threats.

By uncovering hidden exposure and risks beyond CVEs, runZero identifies security issues that align with real-world attacker targets and carry significant business impact. Bringing all of this critical context together enables organizations to focus on proactive, risk-based prioritization. You can't fix what you can't see, and you can't prioritize what you don't understand in context.

How runZero transforms exposure management in the age of AI-driven discovery:

1. Comprehensive asset inventory: runZero provides industry-leading discovery and fingerprinting across internal, external, IT, OT, IoT, and cloud environments without requiring agents or credentials. By unmasking field-level devices and sub-assets hidden behind protocol gateways, it ensures you have a complete picture of your attack surface.

2. Advanced attack path mapping and interactive topology: Visualize exactly how an attacker could move through your network with interactive 2D and 3D maps. By setting source and target nodes, you can trace trajectories from initial compromise to operational impact, identifying critical choke points and multi-homed devices that bypass segmentation.

3. Protocol exposure identification: Detects devices and inherently insecure industrial protocols (like Modbus, BACnet, and S7comm) that are exposed to the IT domain. With support for over 220 protocols, runZero flags "low-hanging fruit" that AI-driven threats target to disrupt operations.

4. Focused exposure intelligence dashboard: The 5.0 release introduces a new default dashboard that prioritizes exposures most likely to lead to an incident. It instantly surfaces critical issues, emerging threats, and recent environment changes, allowing teams to focus on the assets that pose the greatest operational risk.

5. Enhanced vulnerability prioritization and impact insights: Beyond basic CVE scores, runZero 5.0 correlates asset hardware and software data with known advisories to provide "Missing Patches" entries with remediation recommendations. This reduces noise by highlighting vulnerabilities that carry significant business impact in your specific context.

6. Faster, verified remediation workflows: Drive execution through bi-directional Jira integration, tracking ownership and status transitions directly within runZero. Most importantly, defenders can verify fixes against live state scans to ensure that gaps are truly fixed before closing the ticket.

7. Interactive exposure reporting: Share critical risk assessments with stakeholders via automated, interactive email reports. Recipients can search, filter, and drill down into details without needing a runZero login, easing the burden of executive and compliance reporting.

Bottom line

As AI helps attackers exploit network exposures faster than ever, an "assume-breach" mentality is a necessity. By mapping attack paths, identifying exposures, and validating segmentation, defenders can shrink their attack surface and stay ahead of the avalanche.

And before AI bug reports become an avalanche that you cannot dig out from, you should consider deploying runZero to gain the comprehensive visibility and context needed to prioritize vulnerabilities and other security risks (misconfigurations, unknown assets, segmentation gaps, etc.) that matter most for securing your environment.

Try runZero for free today at: https://www.runzero.com/try/

Citrix has published Security Bulletin CTX696604, documenting multiple vulnerabilities that impact customer-managed installations of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). In certain gateway and load-balancing configurations, these devices are vulnerable to multiple vulnerabilities:

• CVE-2026-8451 - Insufficient input validation leading to memory overread. This vulnerability is considered high with a CVSS score of 8.8.
  
• CVE-2026-8452 - Memory overflow vulnerability. This vulnerability is considered high, with a CVSS score of 8.8.
• CVE-2026-8655 - Memory overflow vulnerability. This vulnerability is considered high, with a CVSS score of 8.8.
• CVE-2026-10816 - Unauthenticated arbitrary file read. This vulnerability is considered high, with a CVSS score of 7.1.
• CVE-2026-13474 - Denial of service through malformed HTTP/2 requests. This vulnerability is considered high, with a CVSS score of 8.7.

The following versions are affected:

• NetScaler ADC: Versions 14.1 BEFORE 72.61
• NetScaler ADC: Versions 14.1 FIPs BEFORE 72.61
• NetScaler ADC: Versions 13.1 BEFORE 63.18
• NetScaler ADC: Versions 13.1 FIPS and NDcPP BEFORE 37.272
• NetScaler Gateway: Versions 14.1 BEFORE 72.61
• NetScaler Gateway: Versions 13.1 BEFORE 63.18

Note: Citrix ADC / NetScaler 13.0 and prior have reached end of life. Citrix has made no statements regarding the vulnerabilities in these versions, but they are possibly affected as well.

What is the impact?

Citrix has not published guidance on the impact of these vulnerabilities. Given the values that they have provided for the CVSS score it likely that successful exploitation of these vulnerabilities could result in full system compromise.

Are updates or workarounds available?

Citrix recommends upgrading affected systems to one of the following versions as soon as possible:

• NetScaler ADC and NetScaler Gateway 14.1-72.61 and later releases
• NetScaler ADC and NetScaler Gateway 13.1-63.18 and later releases of 13.1
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.272 and later releases of 13.1-FIPS and 13.1-NDcPP

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

March 2026 (CVE-2026-3055, CVE-2026-4368)

Citrix has published Security Bulletin CTX696300, documenting multiple vulnerabilities that impact customer-managed installations of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). In certain gateway and load-balancing configurations, these devices are vulnerable to multiple vulnerabilities:

• CVE-2026-3055 - Insufficient input validation leading to memory overread. This vulnerability is considered critical with a CVSS score of 9.3.
  
• CVE-2026-4368 - A race condition could lead to user session mixup. This vulnerability is considered severe, with a CVSS score of 7.7.

The following versions are affected:

• NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-66.59
• NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-62.23
• NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.262

Note: Citrix ADC / NetScaler 13.0 and prior have reached end of life. Citrix has made no statements regarding the vulnerabilities in these versions, but they are possibly affected as well.

What is the impact?

Citrix has not published guidance on the impact of these vulnerabilities. Given the values that they have provided for the CVSS score it likely that successful exploitation of these vulnerabilities could result in full system compromise.

Are updates or workarounds available?

Citrix recommends upgrading affected systems to one of the following versions as soon as possible:

• NetScaler ADC and NetScaler Gateway 14.1-66.59 and later releases
• NetScaler ADC and NetScaler Gateway 13.1-62.23 and later releases of 13.1
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.262 and later releases of 13.1-FIPS and 13.1-NDcPP

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

September 2025 (Multiple CVEs)

Citrix has published Security Bulletin CTX694938, documenting multiple vulnerabilities that impact customer-managed installations of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). In certain gateway and load-balancing configurations, these devices are vulnerable to multiple vulnerabilities:

• CVE-2025-7775 - A memory corruption vulnerability that could allow a remote attacker to execute arbitrary code on the system. This vulnerability is considered critical with a CVSS score of 9.2.
  
• CVE-2025-7776 - A memory corruption vulnerability that could allow a remote attacker to create a denial-of-service condition. This vulnerability is considered severe, with a CVSS score of 8.8.
• CVE-2025-8424 - An improper authentication vulnerability that could allow a remote attacker to gain access to sensitive system resources without proper authorization. This vulnerability is considered severe, with a CVSS score of 8.7.

There is evidence that CVE-2025-775 is being actively exploited in the wild.

The following versions are affected:

• NetScaler ADC and NetScaler Gateway 14.1  before 14.1-47.48
• NetScaler ADC and NetScaler Gateway 13.1  before 13.1-59.22
• NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.241-FIPS and NDcPP
• NetScaler ADC 12.1-FIPS and NDcPP before 12.1-55.330-FIPS and NDcPP

What is the impact?

Successful exploitation of this vulnerability could allow an adversary to execute arbitrary code on the vulnerable system, potentially leading to total system compromise or a denial-of-service condition.

Are updates or workarounds available?

Citrix recommends upgrading affected systems to one of the following versions as soon as possible:

• NetScaler ADC and NetScaler Gateway 14.1-47.48 and later releases
• NetScaler ADC and NetScaler Gateway 13.1-59.22 and later releases of 13.1
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.241 and later releases of 13.1-FIPS and 13.1-NDcPP
• NetScaler ADC 12.1-FIPS and 12.1-NDcPP 12.1-55.330 and later releases of 12.1-FIPS and 12.1-NDcPP

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

June 2025 (CVE-2025-6543)

Citrix published Security Bulletin CTX694788 that documented a vulnerability that impacts customer-managed installations of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or Authentication, Authorization and Auditing (AAA) virtual server are affected by a memory overflow vulnerability. This vulnerability has been designated CVE-2025-6543 and has been rated critical with a CVSS score of 9.2.

There is evidence that this vulnerability is being actively exploited in the wild.

The following versions are affected

• NetScaler ADC and NetScaler Gateway 14.1 prior to 14.1-47.46
• NetScaler ADC and NetScaler Gateway 13.1 prior to 13.1-59.19
• NetScaler ADC 13.1-FIPS and NDcPP prior to 13.1-37.236-FIPS and NDcPP

What is the impact?

Successful exploitation of this vulnerability could allow an adversary to make unintended changes to control flow, potentially allowing remote code execution (RCE) or causing denial-of-service (DoS).

Are updates or workarounds available?

Citrix recommends upgrading affected systems to one of the following versions as soon as possible:

• NetScaler ADC and NetScaler Gateway to version 14.1-47.46 and later releases
• NetScaler ADC and NetScaler Gateway to version 13.1-59.19 and later releases of 13.1
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP to version 13.1-37.236 and later releases of 13.1-FIPS and 13.1-NDcPP

NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 are end-of-life (EOL) and no longer supported. It is recommended to upgrade to one of the currently supported versions that address the vulnerabilities.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

June 2025 (CVE-2025-5777, CVE-2025-5349)

Citrix published Security Bulletin CTX693420 that documented two vulnerabilities that impact customer-managed installations of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). There is evidence that one of the vulnerabilities, designated by CVE-2025-5777, is being actively exploited in the wild.

• NetScaler configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or Authentication, Authorization and Auditing (AAA) virtual server are at risk of an insufficient input validation vulnerability leading to memory out-of-bounds read in the NetScaler Management Interface which could allow access to secret values, bypass of protection mechanism, DoS or other unexpected results. This vulnerability has been designated CVE-2025-5777 and has been rated critical with a CVSS score of 9.3.
• An attacker with access to the NetScaler appliance IP (NSIP) address, Cluster Management IP (CLIP) address or local Global Server Load Balancing (GSLB) Site IP (GSLBIP) address could utilize an improper access control vulnerability to gain access the the NetScaler Management Interface and its management functions. This vulnerability has been designated CVE-2025-5349 and has been rated high with a CVSS score of 8.7.

The following versions are affected

• NetScaler ADC and NetScaler Gateway 14.1 prior to 14.1-43.56
• NetScaler ADC and NetScaler Gateway 13.1 prior to 13.1-58.32
• NetScaler ADC 13.1-FIPS and NDcPP prior to 13.1-37.235-FIPS and NDcPP
• NetScaler ADC 12.1-FIPS prior to 12.1-55.328-FIPS

What is the impact?

Successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive information, potentially disrupt system operations and cause a denial-of-service, or gain control over the NetScaler Management Interface and its management functions potentially leading to system compromise.

Are updates or workarounds available?

Citrix recommends upgrading affected systems to one of the following versions as soon as possible:

• NetScaler ADC and NetScaler Gateway to version 14.1-43.56 and later releases
• NetScaler ADC and NetScaler Gateway to version 13.1-58.32 and later releases of 13.1
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP to version 13.1-37.235 and later releases of 13.1-FIPS and 13.1-NDcPP
• NetScaler ADC 12.1-FIPS to version 12.1-55.328 and later releases of 12.1-FIPS

NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 are end-of-life (EOL) and no longer supported. It is recommended to upgrade to one of the currently supported versions that address the vulnerabilities.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

February 2025 (CVE-2024-12284)

Citrix issued a security bulletin for the on-premise NetScaler Console (formerly NetScaler ADM) and NetScaler Agent products. CVE-2024-12284 is rated high with a CVSS score of 8.8, which could lead to privilege escalation.

What is the impact?

For customers running an on-premise installation of NetScaler Console with NetScaler Console Agents deployed, an authenticated remote attacker could "execute commands without additional authorization". NetScaler emphasized that an attacker must be authenticated, which limits the potential impact. 

Are updates or workarounds available?

Citrix recommends upgrading to one of the following versions as soon as possible:

• NetScaler Console 14.1-38.53 and later releases
• NetScaler Console 13.1-56.18 and later releases of 13.1
• NetScaler Agent 14.1-38.53 and later releases
• NetScaler Agent 13.1-56.18 and later releases of 13.1

How to find potentially vulnerable systems with runZero

From the Service Inventory, use the following query to locate systems running potentially vulnerable software:

_asset.protocol:http AND protocol:http AND html.title:="NetScaler Console"

June 2024 (CVE-2023-6548, CVE-2023-6549)

In January Citrix published Security Bulletin CTX584986 that documented two vulnerabilities that impact NetScaler ADCs and Gateways. The most severe of these, CVE-2023-6549, was discovered and documented by BishopFox.

CVE-2023-6549 is rated high with a CVSS score of 8.2. This vulnerability is an unauthenticated out-of-bounds memory read which could be exploited to collect information from the appliance’s process memory, including HTTP request bodies. While serious, this is not thought to be a bad as the Citrix Bleed vulnerability due to the new vulnerability being less likely to leak high risk data.

CVE-2023-6548 is rated medium with a CVSS score of 5.5. This vulnerability is a code injection flaw that allows remote code injection by an authenticated attacker (with low privileged) with access to a management interface on one of the NSIP, CLIP or SNIP interfaces.

What is the impact?

The vulnerability would enable an attacker to remotely obtain sensitive information from a NetScaler appliance configured as a Gateway or AAA virtual server via a very commonly connected Web interface, and without requiring authentication. CVE-2023-6549 is nearly identical to the Citrix Bleed vulnerability (CVE-2023-4966), except it is less likely to return highly sensitive information to an attacker. CVE-2023-6548 could be used by an attacker with credentials to execute code.

Are updates or workarounds available?

Citrix recommends limiting access to management interfaces as well as upgrading to one of the following versions:

• NetScaler ADC and NetScaler Gateway 14.1-12.35 and later releases
• NetScaler ADC and NetScaler Gateway  13.1-51.15 and later releases of 13.1
• NetScaler ADC and NetScaler Gateway 13.0-92.21 and later releases of 13.0
• NetScaler ADC 13.1-FIPS 13.1-37.176 and later releases of 13.1-FIPS 
• NetScaler ADC 12.1-FIPS 12.1-55.302 and later releases of 12.1-FIPS 
• NetScaler ADC 12.1-NDcPP 12.1-55.302 and later releases of 12.1-NDcPP

Warning: NetScaler ADC and NetScaler Gateway version 12.1 is now End Of Life (EOL). Citrix advises customers to upgrade their appliances to one supported version that addresses the vulnerabilities.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

product:netscaler OR product:"citrix adc"

July 2023 (CVE-2023-3519)

In July, 2023, Citrix alerted customers to three vulnerabilities in its NetScaler ADC and NetScaler Gateway products. Surfaced by researchers at Resillion, these vulnerabilities included a critical flaw currently being exploited in the wild to give attackers unauthenticated remote code execution on vulnerable NetScaler targets (CVE-2023-3519). Compromised organizations included a critical infrastructure entity in the U.S., where attackers gained access the previous month and successfully exfiltrated Active Directory data. And at the time of publication, there appear to be over 5,000 public-facing vulnerable NetScaler targets.

What was the impact?

The three reported vulnerabilities affecting NetScaler ADC and Gateway products were of various types, and each include different preconditions required for exploitation:

• Unauthenticated remote code execution (CVE-2023-3519; CVSS score 9.8 - "critical")
  • Successful exploitation required the NetScaler target be configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or "authentication, authorization, and auditing" (AAA) virtual server.
• Reflected cross-site scripting (XSS) (CVE-2023-3466; CVSS score 8.3 - "high")
  • Successful exploitation required the victim to be on the same network as the vulnerable NetScaler target when the victim loaded a malicious link (planted by the attacker) in their web browser.
• Privilege escalation to root administrator (nsroot) (CVE-2023-3467; CVSS score 8.0 - "high")
  • Successful exploitation required an attacker having achieved command-line access on a vulnerable NetScaler target.

U.S.-based CISA reported attackers exploiting CVE-2023-3519 to install webshells used in further network exploration and data exfiltration, causing CVE-2023-3519 to be added to CISA's Known Exploited Vulnerabilities Catalog. Other common attacker goals, like establishing persistence, lateral movement, and malware deployment, were all potential outcomes following successful exploitation.

Citrix made patched firmware updates available. Admins were advised to update older firmware on vulnerable NetScaler devices as soon as possible.

CISA also made additional information available around indicators of compromise and mitigations.

How to find potentially vulnerable systems with runZero

From the Asset inventory, they used the following prebuilt query to locate NetScaler instances on their network:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

Results from the above query should be triaged to verify they are affected ADC or Gateway products and if they are running updated firmware versions.

The following query could also be used in on the Software and Services inventory pages to locate NetScaler software:

product:netscaler

Results from the above query should be triaged to verify they are affected ADC or Gateway products and if they are updated versions.

As always, any prebuilt queries are available from your runZero console. Check out the documentation for other useful inventory queries.

Today, we're publishing seven CVEs documenting several vulnerabilities in FatFs project, ranging from CVSS Medium to High (no Criticals, phew!). The affected ecosystem includes some major non-hobby platforms like Espressif ESP-IDF, STMicroelectronics STM32Cube middleware, Zephyr RTOS, MicroPython, ArduPilot, RT-Thread, Mbed, Samsung TizenRT, and SWUpdate, with downstream reach into consumer IoT, industrial controllers, drones, crypto wallets, and more.

This project is a return to a security assessment started back in 2017, when a manual audit and multi-day fuzzing effort identified some basic, but not compelling, bugs in the FatFs driver. Nine years later, in March of 2026, we revisited this project using Visual Studio Code, GitHub Copilot in "auto" mode, and some basic prompts, all without any specific loops, harnesses, or skills. The results were surprising. Bugs that were overlooked during the manual audit became trivial to find by using the LLM to automatically build a fuzzer with novel inputs. Not only did this effort find interesting and reportable bugs, it also automated the process of validating that these bugs are actually exploitable across different embedded scenarios.

So, why do FatFs bugs matter? For the vendors who build on these platforms it's simple: any physical access leads to a jailbreak, especially given the lack of address space layout randomization (ASLR) and memory protection. For everyone else, there are numerous devices where brief physical access by the general public should not lead to a full compromise. For example, security cameras with SDCard storage, voting machines with USB file readers, ATMs, and pretty much anything else that has a screen that you expect people to touch.

However, the attacker value is straightforward: these issues are triggerable by crafted FAT/exFAT/GPT images, often through removable media or update channels that get mounted automatically. Note that CVE-2026-6682 and 6683 are both implicated in some OTA update processes for firmware.

This post is intentionally light on exploit internals. For technical details, PoC images, harnesses, and code-level analysis, see runZero's companion research repository:

• https://github.com/runZeroInc/vulns-2026-fatfs-chance

The findings, ordered by criticality

The seven findings documented here are listed roughly in order of subjective attacker value.

FAT32 integer overflow in mount_volume()

(CVSS 7.6, High) – This is the headline issue: CVE-206-6682 describes integer overflow in core mount arithmetic can produce attacker-controlled file-size metadata that downstream code may trust as a read length. In real systems, that can become a heap/stack overflow and code execution. In terms of practical attacker value plus transitive impact, this is at the top of the stack.

exFAT label-length stack overflow in f_getlabel()

(CVSS 7.6, High) – CVE-2026-6687 describes a condition where the exFAT label length field is not adequately capped, enabling oversized writes into caller-provided label buffers. This is especially painful where canonical examples and generated code use small stack buffers. It is a clean memory-corruption primitive in a path many firmware projects expose, at least where exFAT has been enabled.

Long filename overflow in downstream callers

(CVSS 7.6, High) – With LFN enabled, fno.fname can be much larger than many caller buffers expect, as described by CVE-2026-6688. The bug class appears repeatedly in integrations (strcpy, sprintf, fixed-size name/path fields). This one is tricky to fix entirely in FatFs directly (since exploitation depends on wrappers copying long filenames into undersized local buffers), but it could be mitigated by FatFs changes that make filename lengths and truncation/validation outcomes more explicit to callers.

Unsigned-subtraction wrap in dirty-cache handling 

(CVSS 6.1, Medium) – CVE-2026-6685 describes a condition where on fragmented volumes, arithmetic wrap can drive stale dirty-cache behavior and out-of-bounds memory effects in read/write paths. This can manifest as silent corruption, which is exactly the kind of bug operators hate most: hard to detect, easy to misdiagnose, and dangerous in control/data-logging workloads.

exFAT divide-by-zero in sync/write paths

(CVSS 4.6, Medium) – CVE-2026-6683 documents a divide-by-zero condition in exFAT sync/write flows that can be triggered by crafted media and produce reliable crash behavior. In update contexts, this can become a practical bricking vector. While generally more "DoS than RCE," it still offers meaningful attacker value against availability, especially given the OTA implications.

Uninitialized cluster exposure after seek beyond EOF

(CVSS 4.6, Medium) – CVE-2026-6686 describes an uninitialized-cluster exposure path where extending files beyond EOF can leak stale data from previously deleted content. It is an information-disclosure bug with real consequences in multi-stage boot/update and shared-media environments.

GPT partition-scan loop DoS (pre-R0.16)

(CVSS 4.6, Medium) – CVE-2026-6684 covers a GPT entry-count abuse case that can trigger effectively unbounded scanning in older trees. That creates a severe mount-time DoS in affected pre-R0.16 implementations, especially painful in boot paths, but it is ranked last here because upstream R0.16 added protective GPT validation. Now, it's up to implementers to upgrade.

XKCD "Dependency" strikes again

If you have seen XKCD 2347 ("Dependency"), you already know where this is going: one component, maintained in one tiny corner of the internet, quietly supports an absurd amount of modern cyber-stuff.

FatFs is one of those components. It's compact, useful, and copied everywhere. That's great for shipping products quickly, but less great when memory-safety issues show up in parser-adjacent code that happily ingests untrusted media. This kind of component is even more challenging to deal with, from a disclosure-and-fix perspective, in that nearly everyone ends up making local, vendored modifications. So, an upstream patch must be validated pretty carefully before incorporating.

We made repeated attempts to contact the maintainer, and we involved JPCERT/CC early on as well. We did not receive a response. So, this publication is aimed at the people who can still do something useful right now: downstream implementors. Audit your vendored version, audit your wrappers, audit your file-name and file-size handling, and plan for patch updates.

Also, keeping this class of issue quiet in 2026 would be almost entirely security theater, now that we've entered the age of the apex agentic adversary. If we can find this kind of thing with some thoughtful application of AI-assisted vuln-hunting, then so can pretty much anyone else. Sure, this took a little HD Moore-branded stubbornness, but even so, we don’t believe these are going to stay undiscovered for very long. It’s too good a target space, and the next researcher probably won’t bother with creating validation and reproduction harnesses.

When it comes to vulnerability disclosure, I've always believed that I'm merely the most recent person to learn about the issue, and that's more true now than ever in this hyper-automated code auditing world. Better to disclose, coordinate where possible, and in the end, publish in order to give defenders the head's up.

PS. Looking for exploits? You can find a test harness, a full qemu-based exploit example, and corrupt FatFs images in the repository.

Microsoft has disclosed three vulnerabilities in certain versions of Microsoft SQL Server:

• SQL Server is affected by a heap-based buffer overflow vulnerability that may allow an authorized adversary to escape the SQL server context and remotely execute code on the target host. Successful exploitation of the vulnerability requires the adversary to prepare the target environment prior to executing a specially crafted query. This vulnerability has been designated CVE-2025-49717 and has been rated high with a CVSS score of 8.5.
• SQL Server is affected by an information disclosure vulnerability due its use of an uninitialized resource. Successful exploitation may allow an unauthorized adversary to remotely inspect heap memory from a privileged process running on the target host. This vulnerability has been designated CVE-2025-49718 and has been rated high with a CVSS score of 7.5.
• SQL Server is affected by an information disclosure vulnerability due to improper input validation. Successful exploitation may allow an unauthorized adversary to remotely inspect uninitialized memory on the target host. This vulnerability has been designated CVE-2025-49719 and has been rated high with a CVSS score of 7.5.

It may be possible that the information returned via CVE-2025-49718 and CVE-2025-49719 could aid in the successful exploitation of CVE-2025-49717, as these vulnerabilities may be useful for disclosing sensitive authentication information or for manipulating heap memory to be more amenable to exploitation.

The following versions are affected by CVE-2025-49717 and CVE-2025-49718

• Microsoft SQL Server 2019 (GDR) versions 15.x prior to 15.0.2135.5
• Microsoft SQL Server 2019 (CU 32) versions 15.x prior to 15.0.4435.7
• Microsoft SQL Server 2022 (GDR) versions 16.x prior to 16.0.4200.1
• Microsoft SQL Server 2022 (CU 19) versions 16.x prior to 16.0.1140.6

The following versions are affected by CVE-2025-49719

• Microsoft SQL Server 2016 for Service Pack 2 (GDR) versions 13.x prior to 13.0.6460.7
• Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack versions 13.x prior to 13.0.7055.9
• Microsoft SQL Server 2017 (GDR) versions 14.x prior to 14.0.2075.8
• Microsoft SQL Server 2017 (CU 31) versions 14.x prior to 14.0.3495.9
• Microsoft SQL Server 2019 (GDR) versions 15.x prior to 15.0.2135.5
• Microsoft SQL Server 2019 (CU 32) versions 15.x prior to 15.0.4435.7
• Microsoft SQL Server 2022 (GDR) versions 16.x prior to 16.0.4200.1
• Microsoft SQL Server 2022 (CU 19) versions 16.x prior to 16.0.1140.6

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise, or leak sensitive information.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible.

• Microsoft SQL Server 2016 for Service Pack 2 (GDR) upgrade to version 13.0.6460.7 or later
• Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack upgrade to version 13.0.7055.9 or later
• Microsoft SQL Server 2017 (GDR) upgrade to version 14.0.2075.8 or later
• Microsoft SQL Server 2017 (CU 31) upgrade to version 14.0.3495.9 or later
• Microsoft SQL Server 2019 (GDR) upgrade to version 15.0.2135.5 or later
• Microsoft SQL Server 2019 (CU 32) upgrade to version 15.0.4435.7 or later
• Microsoft SQL Server 2022 (GDR) upgrade to version 16.0.4200.1 or later
• Microsoft SQL Server 2022 (CU 19) upgrade to version 16.0.1140.6 or later
  

If the SQL Server version is not represented above then it is no longer supported. It is advised users upgrade their software to the latest Service Pack or SQL Server product in order to apply current and future security updates.

How do I find Microsoft SQL Server installations with runZero?

From the Services Inventory, use the following query to locate potentially impacted assets:

protocol:mssql AND has:mssql.version AND (mssql.product:="Microsoft SQL Server%" OR mssql.versionName:="SQL Server 20%")
AND ((mssql.versionMajor:=13 AND mssql.versionMinor:=0) AND ((mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=6460 AND mssql.versionSubBuild:<7) OR (NOT mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=7055 AND mssql.versionSubBuild:<9))
OR (mssql.versionMajor:=14 AND mssql.versionMinor:=0) AND ((mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=2075 AND mssql.versionSubBuild:<8) OR (NOT mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=3495 AND mssql.versionSubBuild:<9))
OR (mssql.versionMajor:=15 AND mssql.versionMinor:=0) AND ((mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=2135 AND mssql.versionSubBuild:<5) OR (NOT mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=4435 AND mssql.versionSubBuild:<7))
OR (mssql.versionMajor:=16 AND mssql.versionMinor:=0) AND ((mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=4200 AND mssql.versionSubBuild:<1) OR (NOT mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=1140 AND mssql.versionSubBuild:<6)))

In this high-stakes race to find and remediate exposures before attackers do, relying on third-party tools like EDR agents to pinpoint vulnerabilities is no longer adequate as you can’t assume 100% coverage of the attack surface. AI will find the gaps in your defenses if you don’t find them first.

runZero has the fastest, most comprehensive active scanning in the industry, and requires zero agents and zero security credentials to map complex hybrid IT, OT, and IoT environments. runZero’s discovery even walks the backplane to reveal every asset hiding behind OT gateways like Modbus and BACnet, showing you every connected device. Since a single exposed thermostat can potentially touch every other device connected to that gateway, this deep visibility is critical. Our comprehensive exposure management platform offers ground truth about the assets and exposures that present the most risk for your organization.

With the new 5.0 release, runZero is giving defenders the edge they need to succeed in the AI-attack era. Version 5.0 accelerates the entire exposure management lifecycle from asset discovery to risk prioritization to verified remediation — providing immutable proof that a vulnerability is actually fixed. When every minute counts due to AI’s speed, you need a platform that quickly empowers defenders with deep, actionable intelligence across IT, OT, IoT, cloud, and mobile to close the gaps and hold the line.

Exposure Management dashboard

The Exposure Management dashboard operationalizes runZero’s industry-leading asset and exposure intelligence into a centralized hub for risk reduction. The Exposure Management dashboard puts critical risks, major changes, and top priorities front and center.

While deep-dive analysis into asset attributes remains available, this new view bubbles up the highest (and newest) risks across your attack surface that require immediate attention.

Understand how an exposure will be exploited

We don’t stop at known vulnerabilities and CVEs. We also show you the choke points and unintended routes attackers can use to move in your environment. A powerful example of this is the automatic identification of multi-homed devices, which can serve as bridges that bypass your elaborate network segmentation efforts. Every second that a multi-homed device or an exposed OT gateway remains unmasked is a second the attacker uses to finalize their path to your crown jewels.

runZero visualizes the path an attacker can take from a multi-homed device to an asset with a vulnerability. These attack path maps show you the road of least resistance to an exposed asset.

But these are just the first steps of the exposure lifecycle, and runZero is working hard to shorten that entire lifecycle with another new capability.

Expanded vulnerability coverage with decision-focused insight

Version 5.0 also broadens vulnerability detection. We’ve expanded end-of-life coverage for more network devices and added out-of-band testing that identifies blind vulnerability classes without requiring customer-side callback infrastructure.

We have also added new capabilities to correlate asset-specific hardware and software data with known advisories; the results are consolidated into streamlined "Missing Patches" entries that offer impact intelligence and remediation recommendations, reducing noise and accelerating fixes.

New summary views have also been added that allow you to hover over a vulnerability group to see a rollup of all exposures in that group, as well as recommended actions and environmental context that enable you to quickly and decisively take remediation actions.

Remediation tracking with verified closure

Even after the heavy lifting of discovery and prioritization is done, tracking verified remediation remains a challenge. The process is often fragmented across tools and teams outside the security organization. runZero 5.0 addresses this with remediation tracking.

Without leaving the runZero platform, you can now push high-risk exposures directly into existing ticketing tools (Jira today, ServiceNow and more coming soon).

runZero tracks the ownership and status of both the ticket and the underlying exposure. This bi-directional integration means you and runZero are in the loop regarding the actions taken on all the exposures you track.

The "last mile" of security is often where exposures fall through the cracks as they pass across platforms and tools. Not any more. Once a ticket is marked "closed" in an external system, runZero goes the extra distance by comparing new scans against previous snapshots to verify the exposure no longer exists. If runZero detects the vulnerability again, it automatically re-opens the ticket and notifies the owner. This immutable truth of remediation ensures that a "closed ticket” actually means a "resolved risk.”

External scheduled reports

No security team wins alone. To help communicate successes and bottlenecks to stakeholders, we’ve added external scheduled reports. You can now schedule and deliver the Exposure Management dashboard — along with risk assessments and inventory views — directly to the inboxes of stakeholders, regardless of whether they have a runZero login. Defenders can leverage runZero’s data to communicate with confidence across teams and executive leadership and show progress against goals.

Explore 5.0 today

Security begins with visibility, but it must end with action. For too long, the remediation lifecycle has been a fragmented black box where a closed ticket didn't always mean a mitigated exposure.

With runZero 5.0, that era is over.

By uniting comprehensive asset and exposure intelligence, closed-loop remediation tracking and verification, and stakeholder reporting, runZero transforms raw discovery into a powerful, proactive workflow. With 5.0, you can seamlessly move beyond finding hidden assets and exposures to ruthlessly prioritizing the vulnerabilities most likely to be exploited, hardening critical choke points, and verifying high-risk vulnerabilities have been fully mitigated.

We believe defenders should win by default. Even against AI. With runZero, know every asset on your attack surface, uncover every exposure, map every attack path, and validate your segmentation. Take command of your entire attack surface by starting your free 21-day trial with runZero 5.0 today.

Why you (probably) don’t need to panic

While any vulnerability disclosure deserves attention, the actual exploitability of CVE-2026-47729 is highly situational. Here is why this likely isn't the "sky is falling" moment some might fear:

• HTTPS is the usual default: Most modern web traffic is encrypted via HTTPS. When Squid handles this, it typically uses an opaque CONNECT tunnel, rendering the contents of that traffic encrypted, even in the case of a successful exploit.

• The FTP requirement: The vulnerability is specifically tied to FTP (File Transfer Protocol). For an attack to work, the proxy must be directed to an attacker-controlled FTP server on 21/TCP that’s specially created to exploit the FTP LIST condition.

• Deployment matters: This attack pattern described by Calif assumes a level of "open proxy" access that is rarely how Squid is deployed in production environments. Most implementations are configured to sit between internal clients and the internet, not as an open gateway for anyone to come calling. This reality limits your attacker-space to mostly insiders.

Why you should still check

So, if it’s so situational, why is it making noise?

• It’s legacy: FTP is still alive and well in state and federal environments and in many education environments, where old-style FTP is frequently used to move files. It’s not super-unusual, even today.

• It’s bundled: Squid is often shipped as a proprietary or niche proxy solution. You might be running it without realizing it.

• It’s an info leak: At its core, this is an information disclosure vulnerability that risks some secrets, in some circumstances, like passwords, session tokens, and API keys. If an attacker does manage to trick an internal user into using your proxy to connect to their malicious FTP server, the attack may be worthwhile.

How to find Squid Proxy on your network

All that said, it’s pretty easy to take a quick audit of your environment for Squid proxy, and see if there are any surprises, or double-check your patch levels. You can use the following software query in runZero to identify assets running Squid.

vendor:="Squid Cache" AND product:=Squid AND (version:>0 AND version:<7.6)

The bottom line

The bug has been patched since April 8. If you (or your Linux distribution, or your proprietary proxy vendor) are very on top of your routine Squid proxy patching (without the benefit of a flashy CVE), you would have picked up the patch normally. While it’s worth verifying where your internal instances are, this vulnerability requires a level of attacker interaction and specific network architecture that makes it less of a "drive-by" threat and more of an edge case. In other words, no need to panic about this, but it’s worth a second look at your services inventory.

Splunk disclosed that certain versions of the Splunk Enterprise solution utilize the PostgreSQL Sidecar Service that contains an unauthenticated file upload vulnerability. Remote unauthenticated attackers can utilize this vulnerability to forge remote database connections and trigger database administrative actions to achieve remote code execution and gain access to the underlying operating system. This vulnerability has been designated CVE-2026-20253, and has been rated critical with a CVSS score of 9.8.

Update (June 18, 2026): This vulnerability is known to be exploited in the wild and was added to the CISA.gov Known Exploited Vulnerabilities (KEV) list.

The following versions are affected:

• Splunk Enterprise: 
  • Versions 10.0.0 through 10.0.6
  • Versions 10.2.0 through 10.2.3

What is Splunk Enterprise?

Splunk provides ingestion and indexing of machine-generated data, and is commonly used for logging, tracing, SIEM, and other business processes. The PostgreSQL Sidecar Service is a Splunk provided storage integration that provides a PostgreSQL database and API provider for Splunk Enterprise deployments.

What is the impact?

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to bypass authentication, trigger database backups, trigger database restores containing attacker controlled connection information, and users of the complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• Splunk Enterprise 10.0.x: Version 10.0.7 or later.
• Splunk Enterprise 10.2.x: Version 10.2.4 or later.

Splunk has provided a set of workarounds and mitigations in their advisory.

How to find potentially vulnerable systems with runZero

From the Software inventory, use the following query to locate potentially impacted assets:

vendor:="Splunk" AND (product:="Splunk" OR product:="splunkd") AND
  version:>0 AND
  ((version:>=10.0.0 AND version:<=10.0.6) OR
  (version:>=10.2.0 AND version:<=10.2.3))

It also validates runZero’s approach (which doesn’t rely on signature-based CVE scanning) that focuses on revealing every asset, every exposure, every gap, every attack path to give defenders a comprehensive view of their attack surface and the actionable data needed to prioritize the risks that matter most to their unique environments.

The brutal math of the detection gap

As recently as early 2025, security teams felt they had about four months to patch a vulnerability, on average, before a working exploit emerged. This “grace period” gave vulnerability scanners time to create a signature and then roll out an update. Then it was up to the customers using these vulnerability scanners to run a new scan looking for that signature, and patch all the devices that matched the signature. While we occasionally saw exploitation frontrunning vulnerability disclosures, this was not the norm. Sadly, those days are now well and truly over.

The Cogent Research team looked at 69,159 CVE’s from January of 2025 to April of 2026 and mapped out three critical events for each one: when the CVE was published, when a working exploit became available, and finally when the other vulnerability scanning vendors (Tenable, Qualys, Rapid7) shipped a signature for that CVE.

These results should be a wakeup call to everyone:

1. Since January of 2025, 55.7% of critical vulnerabilities never got a signature at all.
2. Of the 44.3% of vulnerabilities that did get a signature for detection, 62% of those had exploits circulating BEFORE the signature shipped to the scanner.
3. The conclusion Cogent Research came to was that of all the observed critical vulnerabilities, 83.2% weren’t covered at all by traditional scanners, or had observed exploits before scanner coverage was shipped.

This is the one sentence from the report you need to commit to memory: “Scanner coverage lags exploits, or is absent entirely, for more than four out of five critical vulnerabilities.”

Attackers leverage AI to further outpace legacy vuln scanners

The reason why this has happened is no secret; attackers are using AI-assisted exploit development to compress the time-to-exploit window. Look at this chart Cogent Research created using those 69,159 CVE’s and the time it took for an exploit to circulate.

The report also highlights another key statistic: the median lag time to publish a signature is 2.7 days. And that’s just for the CVE’s that get a signature. Legacy scanners completely ignore 55.7% of critical CVEs because they focus only on major enterprise software, leaving a long tail of vulnerabilities without signatures in IoT devices, edge routers, and niche open-source packages.

But if scanners are losing the race, how do you defend the enterprise? Survival in this new era requires shifting from signature-dependent scanning to proactive, single-source of truth for exposure management.

runZero was designed for exactly this purpose. While legacy scanners must actively probe every device with specific CVEs in mind to see if a vulnerability exists. runZero operates on the principle that if you have a detailed, continuously updated asset inventory, you don't need to rescan the network when a new threat drops — you just need to query the data you already have.

Winning by default against modern threats

When a critical zero-day or high-profile CVE is announced, runZero’s research team analyzes the threat to identify the exact fingerprinted characteristics of the affected software, hardware, or firmware. Instead of waiting days for a vulnerability signature, runZero pushes out an asset query that day. Organizations can instantly search their existing inventory to see exactly which devices run the vulnerable component, where they are located, and whether they are exposed to the internet.

runZero’s proprietary, non-authenticated active scanning goes way beyond CVE’s and identifies the exposures attackers can actually reach via the network. This moves you from the reactive mindset of “does this asset have a CVE” to the proactive mindset of “what assets and exposures are most likely to be attacked.” The attack path mapping that came out in the 4.9 release shows you the path of least resistance an attacker can take to your most at risk assets, illuminating segmentation failures and unintended network routes that bypass your defenses. Another new feature in runZero 4.9 allows you to identify many more potential attack targets by walking the backplane of your common protocol gateways like Modbus and BACnet. Where most scanners stop at the IP address of the gateway itself, runZero identifies every connected device behind it, and the exposures of those devices. This allows us to identify many of the exposures legacy scanners miss entirely.

Your legacy vulnerability scanners are now outclassed with modern AI accelerated threats. But you don’t have to wait for them to catch up. runZero is empowering defenders to win by default. Even against AI. Start a free trial today to know every asset on your attack surface, uncover all types of exposures, map every attack path, and validate your segmentation integrity — before the exploit drops.

Ivanti disclosed that certain versions of Sentry are susceptible to two vulnerabilities.

• CVE-2026-10520: An OS command injection vulnerability allows a remote, unauthenticated attacker to achieve root-level remote code execution (RCE). This vulnerability has been designated CVE-2026-10520 and has been rated critical with a CVSS score of 10.0.
• CVE-2026-10523: An authentication bypass vulnerability allows a remote, unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access. This vulnerability has been designated CVE-2026-10523 and has been rated critical with a CVSS score of 9.9.

Update (June 12, 2026): There is evidence that CVE-2026-10520 is being actively exploited in the wild.

The following versions are affected:

• Ivanti Sentry: Versions 10.5.1, 10.6.1, 10.7.0, and prior.

Note: Older, unsupported product versions have not been tested but are likely also affected.

What is Ivanti Sentry?

Ivanti Sentry, formerly MobileIron Sentry, is an inline security gateway appliance that controls, encrypts, and isolates data traffic between remote mobile devices and a company's internal corporate servers based on device compliance rules set by a central management platform.

What is the impact?

Successful exploitation of these vulnerabilities would allow a remote, unauthenticated attacker to bypass authentication, create administrative accounts, and execute arbitrary commands with root privileges, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• Ivanti Sentry 10.5.x: Version 10.5.2 or later.
• Ivanti Sentry 10.6.x: Version 10.6.2 or later.
• Ivanti Sentry 10.7.x: Version 10.7.1 or later.
• All older, unsupported versions: Migrate to a supported, patched release.

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially impacted assets:

_asset.protocol:http AND protocol:http AND
  (last.http.body:"background-image:url(images/sentry-ivanti-logo-178x32.png)" OR
  last.http.body:"background-image:url(images/sentry-mi-logo-300x40.png)")

Oracle disclosed that certain versions of the PeopleSoft Enterprise PeopleTools solution utilize the Environment Management Hub (EMHub) service that contains a server-side request forgery (SSRF) vulnerability. Remote unauthenticated attackers can utilize this vulnerability to chain outbound requests to achieve remote code execution and gain access to the underlying operating system.

Note: There is evidence that this vulnerability is being actively exploited in the wild.

The following versions are affected:

• Oracle PeopleSoft: Versions 8.61 and 8.62.

What is Oracle PeopleSoft?

PeopleSoft is an enterprise resource planning (ERP) platform used for managing large organizations' business functions.

What is the impact?

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to bypass authentication, create administrative accounts, and execute arbitrary commands with root privileges, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• Oracle PeopleSoft: Versions 8.61 and 8.62 should apply the supplied vendor patch immediately. 

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially impacted assets:

_asset.protocol:http AND protocol:http AND (http.head.setCookie:"PS_TOKEN=" OR last.html.title:="Oracle PeopleSoft Sign-in" OR html.title:="Oracle PeopleSoft Sign-in")

Risk-based prioritization for the KEV

BOD 26-04 introduces an explicit prioritization framework for the CISA Known Exploited Vulnerabilities (KEV) catalog. Historically, remediation deadlines for federal civilian agencies centered around two or three weeks, but occasionally landed on one or three days. This was always a little mysterious, and a likely risk indicator (as mentioned in our paper on KEVology). Now, CISA has codified the logic: deadlines are determined by whether a target is publicly accessible and the overall attacker value of the vulnerability. This shift moves the industry closer to a true risk-based approach rather than treating all KEV entries as equally hot fires.

Standardizing on SSVC

The directive firmly pins its triage methodology on Stakeholder-Specific Vulnerability Categorization (SSVC). While many practitioners were raised on CVSS as the definitive standard, SSVC offers a more pragmatic path for triage. No scoring system is perfect, but SSVC excels at guiding remediation decisions based on organizational context. For a deeper look at how this compares to other signals, see our research on deciphering signals from vulnerability scores.

The compressed timeline of remediation

We are entering an era of aggressive patching. A three-day remediation window for KEVs has become the new, de facto benchmark, and 14 days represent the "fairly normal" outer limit. While achieving a three-day turnaround across massive federal infrastructures is a Herculean task, the increasingly AI-driven threat landscape demands it. As we publish this blog, exactly 31 KEVs have been posted with a three-day deadline (which you can track via the KEV Collider), but we expect this count to skyrocket as CISA leans into these new prioritizations.

Defining the digital perimeter

There is still much to debate, particularly regarding the specific technical definitions of what "counts" as being "publicly exposed." For example, while BOD 26-04 accounts for a change in exposure status leading to a change in the deadline, does the status change when there’s a hot new firewall 0-day that makes the firewall fail open? I would hope so, but what if there’s no evidence of that vulnerability being exploited? The firewall didn’t fail, didn’t go away, but it’s arguably a lot more fragile than people thought.

This is the kind of thing that people will definitely struggle with when they interpret the interaction of vulns-du-jour. So, as always, the devil remains in the details, and how agencies interpret and defend their exposure determinations will dictate the speed and success of their compliance. You can read the full text of the directive on the CISA website.

Take action: Assess your exposure

As the window between discovery and exploitation continues to shrink, understanding your attack surface is no longer optional. To understand why we must move faster, I highly recommend reading our Apex Agentic Adversary blog. 

To begin assessing your exposures and identifying publicly accessible assets, sign up for a runZero free trial today.

Veeam Software disclosed that certain versions of Veeam Backup & Replication contain a vulnerability that allows an authenticated domain user to achieve remote code execution (RCE) on the Backup Server. Additional technical details have not been released at this time. This vulnerability has been designated CVE-2026-44963 and has been rated critical with a CVSS score of 9.4.

The following versions are affected:

• Veeam Backup & Replication 12.x: Versions prior to 12.3.2.4854.

What is Veeam Backup & Replication?

Veeam Backup & Replication is data protection software that supports image-level backup, recovery, and replication for virtual, physical, and cloud machines.

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• Veeam Backup & Replication 12.x: Version 12.3.2.4854 or later.
• All older, unsupported product versions: A supported, fixed version.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Veeam AND (product:="Backup & Replication" OR product:="Veeam Backup & Replication")

March 2026: CVE-2026-21666, CVE-2026-21667, CVE-2026-21668, CVE-2026-21669, CVE-2026-21670, CVE-2026-21671, CVE-2026-21672, and CVE-2026-21708

Veeam Software disclosed in two advisories that multiple vulnerabilities have been identified in Veeam Backup & Replication which could allow for remote code execution (RCE), privilege escalation, and credential theft.

Version 12.3.x Vulnerabilities

• CVE-2026-21666 & CVE-2026-21667: Allows a remote, low-privileged authenticated domain user to perform RCE on the Backup Server. The vulnerabilities designated CVE-2026-21666 and CVE-2026-21667 have been rated critical with a CVSS score of 9.9.
• CVE-2026-21668: Allows a remote, low-privileged authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository. This vulnerability has been designated CVE-2026-21668 and has been rated high with a CVSS score of 8.8.

Version 13.0.x Vulnerabilities

• CVE-2026-21669: Allows a remote, low-privileged authenticated domain user to perform RCE on Windows-based Backup Servers. This vulnerability has been designated CVE-2026-21669 and has been rated critical with a CVSS score of 9.9.
• CVE-2026-21670: Allows a remote, low-privileged user to extract saved SSH credentials from Windows-based servers or the Veeam Software Appliance. This vulnerability has been designated CVE-2026-21670 and has been rated high with a CVSS score of 7.7.
• CVE-2026-21671: Allows a remote, high-privileged user with the "Backup Administrator" role to perform RCE in high availability (HA) deployments. This vulnerability has been designated CVE-2026-21671 and has been rated critical with a CVSS score of 9.1.

Vulnerabilities Affecting Both 12.3.x and 13.0.x

• CVE-2026-21672: A vulnerability allowing local privilege escalation on Windows-based Backup Servers. This vulnerability has been designated CVE-2026-21672 and has been rated high with a CVSS score of 8.8.
• CVE-2026-21708: Allows a remote, low-privileged user with the "Backup Viewer" role to perform RCE as the postgres user. This vulnerability has been designated CVE-2026-21708 and has been rated critical with a CVSS score of 9.9.

The following versions are affected:

• Veeam Backup & Replication versions 12.3.x prior to 12.3.2.4465
• Veeam Backup & Replication versions 13.0.x prior to 13.0.1.2067

What is Veeam Backup & Replication?

Veeam Backup & Replication is data protection software that supports image-level backup, recovery, and replication for virtual, physical, and cloud machines.

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• Veeam Backup & Replication versions 12.3.x upgrade to version 12.3.2.4465 or later
• Veeam Backup & Replication versions 13.0.x upgrade to version 13.0.1.2067 or later

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Veeam AND (product:="Backup & Replication" OR product:="Veeam Backup & Replication")

November 2025: CVE-2025-48983, and CVE-2025-48984

Veeam Software has disclosed two remote code execution (RCE) vulnerabilities affecting certain versions of Veeam Backup & Replication. These flaws in different software components allow a remote, low-privileged adversary (authenticated domain user) to execute arbitrary code.

• The first method is via a vulnerability in the Mount service on domain-joined backup infrastructure servers. This vulnerability has been designated CVE-2025-48983 and has been rated critical with a CVSS score of 9.9.
• The second method is via a vulnerability in domain-joined backup servers. This vulnerability has been designated CVE-2025-48984 and has been rated critical with a CVSS score of 9.9.

The following versions are affected:

• Veeam Backup & Replication versions 12.x prior to 12.3.2.4165

What is Veeam Backup & Replication?

Veeam Backup & Replication is data protection software that supports image-level backup, recovery, and replication for virtual, physical, and cloud machines.

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• Veeam Backup & Replication versions 12.x upgrade to version 12.3.2.4165 or later

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Veeam AND product:="Veeam Backup & Replication" AND (version:>0 AND version:>=12 AND version:<12.3.2.4165)

Currently, runZero prebuilt integrations can identify these findings.

December 2024:

Veeam has disclosed two vulnerabilities found internally within their Veeam Service Provider Console (VSPC).

• CVE-2024-42448 is rated Critical with a CVSS score of 9.9, which potentially allows remote code execution.
• CVE-2024-42449 is rated High with a CVSS score of 7.1, which potentially leaks the NTLM hash of a service account and allows for the deletion of files on the server.

What is the impact?

Although there an no known exploitations of the vulnerabilities in the wild, CVE-2024-42448 could allow remote code execution by an attacker on the server. An attacker would need to launch their attack from an authorized VSPC management agent server in order to exploit either of the disclosed vulnerabilities.

Are updates or workarounds available?

No mitigations are available for the disclosed vulnerabilities. Instead, the vendor is strongly encouraging customers to "update to the latest cumulative patch".

How to find potentially vulnerable systems with runZero

From the Service Inventory, use the following query to locate systems running potentially vulnerable software:

has:"html.title" html.title:"Veeam Service Provider Console"

December 2022

Veeam published information on two vulnerabilities in the Veeam Backup & Replication product, originally reported by Nikita Petrov of Positive Technologies.

As of December 16th, CISA had announced the addition of two critical vulnerabilities (tracked as CVE-2022-26500 and CVE-2022-26501) to the KEV catalog. These CVEs were actively being exploited, putting systems at risk. It was critical that these systems were updated to patch these vulnerabilities as soon as possible.

Which versions were affected?

These vulnerabilities affected Backup & Replication versions 9.5, 10, and 11, allowing for exploitation by attackers to achieve unauthenticated remote code execution via the Veeam Distribution Service API. Details on the vulnerabilities (identified as CVE-2022-26500 and CVE-2022-26501) were not published at the time of writing, though Veeam had assigned a "critical" CVSS score of 9.8.

Were updates made available?

Patched releases of Veeam Backup & Replication were made available (see the "Solution" section). Guidance from Veeam was for administrators to update to these newer versions as soon as possible. If near-term updating was not possible, Veeam offered a temporary mitigation strategy via stopping-and-disabling the Veeam Distribution Service (see the "Solution->Notes" section).

How runZero users found potentially vulnerable Veeam instances

We added the default port (9380) for the Veeam Distribution Service API to our runZero Explorer and Scanner. If you were using Explorer or Scanner v2.11.5 or later, you just needed to ensure you had performed a recent scan of your assets prior to running the query below. If you were using an older Explorer or Scanner, users simply added port 9380 to the "Included TCP ports" (under the Advanced tab) and then ran a scan to gather the necessary data.

From the Asset Inventory, users ran the following pre-built query to locate Veeam Distribution Service instances within their network that could have potentially ran vulnerable versions of Veeam Backup & Replication:

tcp_port:9380

As always, any prebuilt queries we create are available from our Queries Library. Check out the library for other useful inventory queries.

Exploits are up, but still not the majority

Most headlines and slide citations you’ve likely seen sourced from the DBIR over the last couple weeks (and certainly through the next several months) are breathless exhortations that exploited vulnerabilities are up – way up – as average time-to-patch rates are slowing down, which spells doom for most enterprises. This is absolutely the case: exploited vulnerabilities account for 31% of initial access events that ultimately lead to a material breach, which is up from 2025’s reported 20% rate, which itself is a whopping 55% boost from last year, and continues the trend of exploitation taking more and more of the initial access pie.

However, what the DBIR doesn’t state plainly is that this statistic represents merely a plurality, not a majority, of successful initial access attacks. Putting it another way, 69%¹ of initial access attacks sourced from something other than an exploited software vulnerability.

This means that even if you manage to patch 100% of technical vulnerabilities on your network edge, you’ve still got a ton of work to do to deal with misconfigurations, default credentials, phishing, pretexting, and all the other ways spies and criminals penetrate your network. I know, I know, as a vulnerability-lover, this pains me, too, but that’s just the deal with modern, comprehensive cybersecurity. Maybe next year? If exploitation rates rise another 60-ish percent, it’ll be in striking range of a majority tactic.

The “speed of light” barrier to patch rates

Unfortunately, that “patch 100%” target is ever more elusive these days, and we have real backing from the DBIR for this opinion. The Verizon authors cite the rapid rise of CVE-identified vulnerabilities, and specifically, the ever-increasing rate of CISA KEV additions. IT security shops have been admirably keeping up with the firehose… until the 2025 study period that the 2026 DBIR covers, where keeping up with critical vulnerabilities faltered.

For me, the most compelling quote in the DBIR is this: “this might be an initial measurement of the “speed of light” — the theoretical limit — for vulnerability remediation processes. Organizations at their very best only get to fix 30%–40% of KEV instances in the first week after detection, so choosing the correct ones to patch really is the key strategy.” Emphasis added, because this goes right to the core of something we’ve been flogging for a while now here at runZero.

While DBIR uses “CISA KEV-listed vulnerabilities” as a useful stand-in for “critical vulnerabilities,” we know that not all KEVs are created equal. Heck, I wrote a whole paper on the art and science of KEVology, and we released a fun workbench, KEV Collider, for sorting and choosing the KEVs that organizations can use to help prioritize this tiny subset of software vulnerabilities.

What this also tells me is that it’s simply unreasonable and unrealistic to expect an enterprise of any appreciable size and complexity to mitigate every KEV on any human-scale timeline with our current tooling and processes. Achieving 100% coverage inside the first week after detecting a known-exploited vulnerability in the environment is nearly impossible for no less than half of the very best and most expensive IT security teams.

Part of the reason here is the sheer volume of alerts to deal with. It may well be possible to hit this mark in a vacuum in a well-understood tech stack, but when your attention is being seized by alert after alert, in quick succession, in a chaotic environment of a modern TCP/IP network, teams and systems are practically guaranteed to start dropping patches on the floor. We seem to have hit maximum capacity in 2024, and now we get to worry about a renewed onslaught of AI-assisted vulnerability discovery further slowing us down.

I cannot stress this enough: it is impossible to keep patched against thousands to millions of vulns as they become public. Enterprises must make choices, based on the inherent riskiness of specific vulnerabilities, where those vulnerable systems live, and how far attackers need to go to reach them. This makes high-visibility asset and exposure management a critical component of any continuous security strategy.

Ransomware and AI

A couple other stories emerged for me in the DBIR this year, which I wanted to touch on. First off, there’s a shift in the ransomware economics underway. Verizon reports that ransomware attacks are up by volume (no surprise there), but the rate at which victims are paying off the extortionists is trending down, along with the total dollar amounts of payments. This strikes me as very normal economics of scale, and the goal of pretty much every consumer tech company in Silicon Valley and beyond: lower prices, increase consumption, and you make up the difference on volume. So, what does this mean for RaaS (ransomware-as-a-service)? I’m starting to suspect there will be a major upheaval (dare I say, disruption) in the space, but I have no idea what that’ll look like.

The other story that jumped out at me is the massive uptake of “shadow AI” in enterprises. The DBIR reports that people who describe themselves as “regular AI users” on company equipment, on the job, is up to 45% over last year’s figure of 15% of regular AI users. This tells me that shadow AI is going to be a real headache this year, and to keep an eye out for the entirely predictable breach of company secrets due to unsanctioned, unauthorized AI use. Just like how shadow IT imperils enterprise networks by escaping the usual controls applied to sanctioned techs, using off-site chatbots and other LLM-backed technology is virtually guaranteed to lead to an exposure of sensitive customer and company info. Security shops are advised to monitor for this, but detection is going to be quite difficult in the BYOD/WFH world we live in; at the very least, every enterprise today needs to spend some leadership cycles on crafting and publishing an AI acceptable use policy (AUP), and take violations of this seriously. I hate to be the tech police here, but even the most well-meaning employee, having just hopped on the AI bandwagon, is going to screw this up eventually.

Getting ahead of (gestures broadly) all this

The DBIR is an invaluable resource for good statistics and good science, and if you’ve read this far, you’re the kind of person that’s likely to run into citations from the DBIR from your vendors, your partners, and your boss for the rest of the year. Hopefully, your takeaway from the DBIR (or this book report) is not, in the end, utter despair. There are things you can do to get ahead of your exposure management.

One of those things is to give runZero’s best-in-class solution a whirl. Head over to runZero.com/try for a free community edition and see what I’m talking about when I say that vulns aren’t the only thing, or even the most pressing thing, you can spend your time and effort on. Modern cybersecurity means having a great, up-to-date picture of your attack surface, and the runZero 4.9 release does a bang-up job at getting you armed with the situational awareness to stay ahead of the most likely attacks you’re going to see in this cruel, cruel world.

¹Nice

LiteLLM disclosed in three advisories that certain versions of LiteLLM Proxy are susceptible to multiple vulnerabilities that can be chained together to achieve remote code execution (RCE). While official container images run the process as root, other deployments execute with the privileges of the user account running the proxy process. Research regarding the exploit chain involving GHSA-r75f-5x8p-qvmc and GHSA-xqmj-j6mv-4862 indicates that the vulnerable code path only triggers after the server has processed "a minimum amount of legitimate interaction."

• CVE-2026-42208: A SQL injection vulnerability exists in the API key verification process due to improper error handling. A remote, unauthenticated attacker can exploit this by sending a specially crafted Authorization header to any LLM API endpoint (e.g., /chat/completions). Successful exploitation allows an attacker to read or potentially modify database data, leading to unauthorized access to the proxy and the credentials it manages. This vulnerability has been designated CVE-2026-42208 and has been rated critical with a CVSS score of 9.3.
• CVE-2026-42203: A server-side template injection (SSTI) vulnerability in the /prompts/test API endpoint arises from the improper neutralization of user-supplied prompt templates, which are rendered without sandboxing. A crafted template can execute arbitrary code within the LiteLLM Proxy process. Successful exploitation allows a remote, authenticated user to access secrets in the process environment (e.g., provider API keys or database credentials) or execute arbitrary code on the host. This vulnerability has been designated CVE-2026-42203 and has been rated high with a CVSS score of 8.6.
• CVE-2026-42271: An authenticated command execution vulnerability exists in the MCP stdio test endpoints (/mcp-rest/test/connection and /mcp-rest/test/tools/list), which are used to preview an MCP server before saving. A remote, low-privileged attacker can exploit this by providing a crafted server configuration in the request body. The command is spawned as a subprocess on the proxy host with the privileges of the proxy process. This vulnerability has been designated CVE-2026-42271 and has been rated high with a CVSS score of 8.7.

These vulnerabilities do not currently have CVE IDs assigned, however, the vulnerability currently designated GHSA-r75f-5x8p-qvmc has been rated critical with a CVSS score of 9.3.

Update (April 27, 2026): The advisories now reflect assigned CVE IDs; however, these remain in a "reserved" state, and further details have not yet been provided by the CNA.

Update (May 8, 2026): There is evidence that CVE-2026-42208 is being actively exploited in the wild. The CVE IDs listed above have been updated with the latest CVSS score information.

Update (June 8, 2026): There is evidence that CVE-2026-42271 is being actively exploited in the wild.

The following versions are affected:

• LiteLLM: Versions 1.81.16 through 1.83.6

What is LiteLLM Proxy?

LiteLLM Proxy is an open-source gateway that enables applications to interact with multiple large language model (LLM) providers through a single, standardized API by translating requests into the specific formats required by each service.

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

• LiteLLM: Upgrade to v1.83.7-stable or later.

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially impacted assets:

_asset.protocol:http AND protocol:http AND (html.title:="LiteLLM%" OR last.html.title:="LiteLLM%")

Check Point disclosed that certain versions of their VPN products utilize the deprecated IKE protocol version 1 (IKEv1) that are affected by an authentication logic flow vulnerability. Remote unauthenticated attackers can utilize this vulnerability to bypass the authentication validation without credentials in order to gain access to secure networks. This vulnerability has been designated CVE-2026-50751 and has been rated critical with a CVSS score of 9.3.

The following versions are affected:

• Security Gateways:
  • R82.10 Jumbo Hotfix Take 19 or below
  • R82 Jumbo Hotfix Take 103 or below
  • R81.20 Jumbo Hotfix Take 141 or below
  • R81.10 (End-of-Support (EOS))
  • R81 (End-of-Support (EOS))
  • R80.40 (End-of-Support (EOS))
• Spark Firewalls: 
  • R80.20.X (End-of-Support (EOS))
  • R82.00.X
  • R81.10.X

What is Check Point Remote Access and Mobile Access VPN?

Check Point Remote Access and Mobile Access VPN provide users access to corporate networks over IPSec.

What is the impact?

Successful exploitation of the vulnerability would allow an attacker to establish an unauthorized VPN connection and gain access to protected networks.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions:

Security Gateway, Maestro Orchestrator, and Security Group

• R82.10 Jumbo Hotfix Accumulator Take 19 (Take #3)
• R82.10 Jumbo Hotfix Accumulator Take 6 (Take #2)
• R82 Jumbo Hotfix Accumulator Take 103 (Take #2)
• R82 Jumbo Hotfix Accumulator Take 91 (Take #2)
• R81.20 Jumbo Hotfix Accumulator Take 141 (Take #2)
• R81.20 Jumbo Hotfix Accumulator Take 127 (Take #2)
• R81.20 Jumbo Hotfix Accumulator Take 120 (Take #2)
• R81.20 Jumbo Hotfix Accumulator Take 113 (Take #2)

Spark Firewall Appliances

• R82.00.10 Build 998002216

For End-of-Support products Check Point has provided multiple mitigation options.

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially impacted assets:

hw:="Check Point%" AND protocol:ike AND ike.version:="1.0"

May 2024: CVE-2024-24919

On May 28, 2024, Check Point disclosed a serious vulnerability in Check Point Security Gateway Devices with certain remote access software blades (security modules) enabled. Per their guidance, devices are impacted if one of the following conditions are met:

• The IPsec VPN Blade is enabled, but ONLY when included in the Remote Access VPN community.
• The Mobile Access Software Blade is enabled.

The issue, identified as CVE-2024-24919, allows reading arbitrary files on the targeted appliance by unauthenticated remote attackers. This vulnerability could be leveraged to read sensitive files such as those containing password hashes, certificates, and ssh keys.

This vulnerability has a CVSS score of 8.6 out of 10, indicating that this is a high risk vulnerability. According to their disclosure and information provided by CISA this vulnerability is being actively exploited. A report from mnemonic.io states that they have observed attacks at least as far back as April 30, 2024.

What is the impact?

Upon successful exploitation of the vulnerability, unauthenticated remote attackers could access password hashes for local users. If the hashes are cracked the attacker may be able to log into these user accounts if secondary controls, such as MFA, are not enforced. This includes service accounts that may be used to access Active Directory or other services. Attackers could leverage this information to move across a target's network. 

Are updates or workarounds available?

Check Point has released a software updates to address this vulnerability. They also provide guidance for other measures that should be taken after the vulnerability has been addressed. These can be found in their advisory.

How do I find potentially vulnerable Check Point devices with runZero?

From the Asset Inventory, use the following query to locate assets that may be running the vulnerable operating system in your network:

hardware:"Check Point" AND (_service.last.http.body:"Check Point Mobile" OR _service.http.body:"Check Point Mobile" OR udp_port:500)

For decades, cybersecurity operated with a somewhat predictable pulse. A researcher found a bug, a CVE was cataloged, a vendor navigated a patch cycle, and weeks or even months later a fix was deployed. In this era, dwell time was a metric of days and weeks. But we are now on the verge of a major shift in the evolutionary timeline.

The catalyst arrived in early 2026 with the release of frontier agentic models: AI entities that no longer just suggested code, but actively tested it. These models don't just automate the offensive lifecycle; they radically compress the time between discovery and weaponization.

Beware the wolves in the fabric

There is a reason the old saying warns about the wolf in sheep’s clothing. In a rush to stay competitive, organizations have invited AI into the deepest layers of their infrastructure — giving LLM agents write access to repos and allowing third-party AI wrappers to plug into internal APIs. These are the sheep: the helpful, fluffy productivity boosters sitting in our software ribbons.

But there lie wolves in the fabric. The same technology that allows a developer to refactor code in seconds allows agentic offensive models to hunt for logic flaws at the same speed. These tools are capable of finding an exposure, weaponizing it, and executing a breach before a human defender has even finished their first cup of coffee. The agility we gained in our workflows is now the agility the adversary can use to dismantle them.

The death of the catalog

The most unsettling part of this cusp is not just the speed, but the increasing anonymity. In the pre-AI era, we relied on public vulnerability and exploitation accounting like the CVE program, CISA's KEV Catalog, and EPSS. We looked for known signatures and documented behaviors. But as AI-driven breaches become autogenous and self-generating, they become ephemeral. Attacks will soon be so fast, so targeted, and so mutated that they will not even stay in the room long enough to be cataloged.

If attack design, creation, and execution happens at machine speed and there is no signature to find, did it even happen? By the time your SIEM triggers an alert, the AI agent has already breached, escalated, pivoted, spread, exfiltrated, and scrubbed, leaving no trace to investigate.

The convergence trap: IT/OT and the segmentation illusion

The danger is amplified because our fabric is no longer just digital; it is physical. The continuing convergence of IT and OT has created a unified playground for AI attackers. We used to rely on the segmentation illusion: the comfortable assumption that our critical industrial assets were air-gapped or safely tucked away behind firewalls.

In a converged world, that air gap or segmentation is a design flaw. An AI agent does not see a firewall; it sees an exploitable asset. In this evolving landscape, lateral movement is an automated reflex. The AI identifies the technician's laptop that bridges the corporate Wi-Fi to the factory LAN and traverses that gap in milliseconds. It treats insecure-by-design industrial protocols like Modbus, BACnet, and S7comm as open expressways. When an IT-originated breach cascades into the OT environment at machine speed, it is no longer just a data leak. It is a factory floor shutdown or a safety valve opening. It is the wolf moving from the screen to the physical world.

Taking the tactical high ground (Layer 2 and below)

The agentic adversary wins by knowing your territory better than you do. They thrive in the information gap — the space between what you think is on your network and what is actually there. Asset inventory is no longer a compliance checkbox; it defines the boundaries of your hunting ground.

While your eyes are fixed on the imminent exploit hitting your secure servers, an AI agent is already identifying the choke points you didn’t know you had — the single multi-homed device or forgotten workstation that grants total access to the critical areas of your network. You cannot outrun a predator if you are tripping over your own blind spots.

To survive, defensive strategies must shift from reactive to proactive environmental hardening. At runZero, we built our latest capabilities to deny the adversary the shadows it needs to operate:

• Mapping the unmappable: In runZero 4.9, we introduced the ability to peek behind protocol gateways. Where traditional tools see a single gateway IP, runZero leverages its unrivaled library of proprietary IT, IoT, and OT protocol safe-probes to walk the backplane. We natively query and unmask the dozens of PLCs and field-level devices sitting downstream, ensuring no industrial asset stays hidden.
  
  
• Illuminating the unknown: Agentic models can swiftly hunt for rogue access points, forgotten IoT devices, and shadow IT that lack security coverage. runZero’s unauthenticated discovery uses these same advanced protocol insights to identify unmanaged assets without requiring agents or credentials, ensuring that your blind spots don't become an adversary's primary point of entry.
  
  
• Validating the assumption: Our latest research on network segmentation shows that many of these paths are accidental. Our interactive attack path mapping allows you to move past assumptions, visualizing exactly how an attacker could use these multi-protocol environments to move laterally through your IT and OT systems alike.
  
  
• Acting on Asset Intelligence: Knowing you have exposures isn't enough; you need to know which ones are most critical to address first. runZero prioritizes your risk by identifying the exact choke points where your vulnerabilities intersect with viable cross-protocol attack paths. Instead of wasting cycles fixing everything, you can fortify the precise defensive bottlenecks that completely cut off the intruder's route to your critical assets.

Identify the predator or become the prey

We have not yet reached the point where every attack is an instantaneous strike. While frontier AI's offensive capabilities haven't reached total autonomy yet, remember: this is the least capable these models will ever be. The predator is learning.

We are currently moving through the tall grass of the perimeter’s blind spot. While most organizations are still scanning for the tracks of yesterday’s hunters, a new breed of agentic adversary is already circling. Your only hope of survival is to spot the predator before it breaks cover.

runZero is empowering defenders to win by default. Even against AI. Start a free trial today to know every asset on your attack surface, uncover all types of exposures, map every attack path, and validate your segmentation integrity — before the exploit drops.

Palo Alto Networks (PAN) has disclosed that certain versions of PAN-OS are affected by an authentication bypass vulnerability in the GlobalProtect portal and gateway. Successful exploitation allows a remote, unauthenticated attacker to bypass security restrictions, establish an unauthorized VPN connection, and gain access to restricted networks. The vulnerability has been designated CVE-2026-0257 and has been rated high with a CVSS score of 7.8.

There is evidence that this vulnerability is being actively exploited in the wild. Note that the Rapid Response released on May 13, 2026 covered many of the affected versions of PAN-OS, but CVE-2026-0257 is somewhat more expansive in scope than CVE-2026-0263, and more versions are affected.

The following versions are affected

• PAN-OS 12.1: Versions 12.1.5 through 12.1.6, and 12.1.2 through 12.1.4-h*.
• PAN-OS 11.2: Versions 11.2.11 or later, 11.2.8 through 11.2.10-h*, 11.2.5 through 11.2.7-h*, and 11.2.0 through 11.2.4-h*.
• PAN-OS 11.1: Versions 11.1.14 or later, 11.1.11 through 11.1.13-h*, 11.1.8 through 11.1.10-h*, 11.1.7 through 11.1.7-h*, 11.1.5 through 11.1.6-h*, and 11.1.0 through 11.1.4-h*.
• PAN-OS 10.2: Versions 10.2.17 through 10.2.18-h*, 10.2.14 through 10.2.16-h*, 10.2.11 through 10.2.13-h*, 10.2.8 through 10.2.10-h*, and 10.2.0 through 10.2.7-h*.

Note: It is possible that older, unsupported PAN-OS versions are also vulnerable, but this has not been confirmed.

What is Palo Alto Networks PAN-OS?

PAN-OS is the proprietary operating system that powers all Palo Alto Networks Next-Generation Firewalls (NGFW) across physical, virtual, and cloud environments. It uses a Single-Pass Parallel Processing (SP3) architecture to provide deep visibility and control over network traffic by identifying applications, users, and content simultaneously.

What is the impact?

Successful exploitation of the vulnerability would allow an attacker to establish an unauthorized VPN connection and gain access to protected networks.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• PAN-OS 12.1: Upgrade to version 12.1.4-h6, 12.1.7, or later.
• PAN-OS 11.2: Upgrade to version 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12, or later.
• PAN-OS 11.1: Upgrade to version 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15, or later.
• PAN-OS 10.2: Upgrade to version 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6, or later.
• All older, unsupported PAN-OS versions: Upgrade to a supported, fixed version.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Palo Alto Networks" AND os:="Palo Alto Networks PAN-OS%" AND os_version:>0 AND
  ((os_version:>="12.1.5" AND os_version:<"12.1.7") OR
  (os_version:>="12.1.2" AND os_version:<"12.1.4-h6") OR
  (os_version:>="11.2.11" AND os_version:<"11.2.12") OR
  (os_version:>="11.2.8" AND os_version:<"11.2.10-h7") OR
  (os_version:>="11.2.5" AND os_version:<"11.2.7-h14") OR
  (os_version:>="11.2.0" AND os_version:<"11.2.4-h17") OR
  (os_version:>="11.1.14" AND os_version:<"11.1.15") OR
  (os_version:>="11.1.11" AND os_version:<"11.1.13-h5") OR
  (os_version:>="11.1.8" AND os_version:<"11.1.10-h25") OR
  (os_version:>="11.1.7" AND os_version:<"11.1.7-h6") OR
  (os_version:>="11.1.5" AND os_version:<"11.1.6-h32") OR
  (os_version:>="11.1.0" AND os_version:<"11.1.4-h33") OR
  (os_version:>="10.2.17" AND os_version:<"10.2.18-h6") OR
  (os_version:>="10.2.14" AND os_version:<"10.2.16-h7") OR
  (os_version:>="10.2.11" AND os_version:<"10.2.13-h21") OR
  (os_version:>="10.2.8" AND os_version:<"10.2.10-h36") OR
  (os_version:>="10.2.0" AND os_version:<"10.2.7-h34"))

May 13, 2026: CVE-2026-0263

Palo Alto Networks (PAN) released a security advisory for a high buffer overflow vulnerability in the IKEv2 processing that allows an unauthenticated remote attacker to execute arbitrary code with elevated privileges or cause a denial of service.

• CVE-2026-0263 is rated high with CVSS score of 7.2, is a buffer overflow vulnerability and potentially allows for remote code execution with elevated privileges.

What is the impact?

CVE-2026-0263 allows for an unauthenticated remote attacker to execute arbitrary code with elevated privileges or lead to a denial of service (DoS).

The vulnerability only affects PA-Series firewalls if IKEv2 VPN tunnels are configured with Post Quantum Cryptography (PQC).

Are updates or workarounds available?

Within the advisory, Palo Alto recommends "configuring IKEv2 VPN tunnels only with NIST approved Post Quantum Cryptography (PQC) ciphers".

• PAN-OS 12.1: Upgrade to 12.1.7 or later, 
                                               12.1.4-h5 or 12.1.7 or later.
• PAN-OS 11.2: Upgrade to 11.2.12 or later, 
                                              11.2.10-h6 or 11.2.12 or later, 
                                              11.2.7-h13 or 11.2.12 or later, 
                                              11.2.4-h17 or 11.2.12 or later.
• PAN-OS 11.1: Upgrade to 11.1.15 or later, 
                                              11.1.13-h5 or 11.1.15 or later, 
                                              11.1.10-h25 or 11.1.15 or later, 
                                              11.1.7-h6 or 11.1.15 or later, 
                                              11.1.6-h32 or 11.1.15 or later, 
                                              11.1.4-h33 or 11.1.15 or later.

How to find PAN-OS systems on your network

From the Asset Inventory you can use the following query to locate potentially vulnerable PAN-OS systems:

hw:="Palo Alto Networks" AND os:="Palo Alto Networks PAN-OS%" AND os_version:>0 AND
  ((os_version:>="12.1.5" AND os_version:<"12.1.7") OR
  (os_version:>="12.1.2" AND os_version:<"12.1.4-h5") OR
  (os_version:>="11.2.11" AND os_version:<"11.2.12") OR
  (os_version:>="11.2.8" AND os_version:<"11.2.10-h6") OR
  (os_version:>="11.2.5" AND os_version:<"11.2.7-h13") OR
  (os_version:>="11.2.0" AND os_version:<"11.2.4-h17") OR
  (os_version:>="11.1.14" AND os_version:<"11.1.15") OR
  (os_version:>="11.1.11" AND os_version:<"11.1.13-h5") OR
  (os_version:>="11.1.8" AND os_version:<"11.1.10-h25") OR
  (os_version:>="11.1.7" AND os_version:<"11.1.7-h6") OR
  (os_version:>="11.1.5" AND os_version:<"11.1.6-h32") OR
  (os_version:>="11.1.0" AND os_version:<"11.1.4-h33"))

May 5, 2026: CVE-2026-0300

On May 5, 2026, Palo Alto Networks (PAN) released a security advisory for a critical buffer overflow vulnerability in the User-ID Authentication Portal (Captive Portal) that allows an unauthenticated remote attacker to execute arbitrary code with root privileges.

• CVE-2026-0300 is rated critical with CVSS score of 9.3, is a buffer overflow vulnerability and potentially allows for remote code execution with root privileges.

On May 6, 2026, CISA announced that the vulnerability is actively being exploited and it was added to the Known Exploited Vulnerabilities (KEV) Catalog.

What is the impact?

CVE-2026-0300 allows for an unauthenticated remote attacker to execute arbitrary code with root privileges, which can lead to complete system takeover.

The vulnerability only affects PA-Series and VM-Series firewalls if they're set up with the Captive Portal.

Are updates or workarounds available?

Within the advisory, Palo Alto recommends restricting access to the Captive Portal to trusted internal IP addresses. Additionally, they advise following a set of best practices to secure device access. 

Palo Alto Networks has a patch release scheduled for CVE-2026-0300 ranging between 5/15 through 5/28.

How to find PAN-OS systems on your network

From the Asset Inventory you can use the following query to locate potentially vulnerable PAN-OS systems:

hw:="Palo Alto Networks%" AND os:="Palo Alto Networks PAN-OS%" AND 
os_version:>0 AND ((os_version:<"10.2.7-h34") OR  
(os_version:>"10.2.7-h34" AND os_version:<"10.2.10-h36") OR  
(os_version:>"10.2.10-h36" AND os_version:<"10.2.13-h21") OR  
(os_version:>"10.2.13-h21" AND os_version:<"10.2.16-h7") OR  
(os_version:>"10.2.16-h7" AND os_version:<"10.2.18-h6") OR  
(os_version:>="11.1" AND os_version:<"11.1.4-h33") OR  
(os_version:>"11.1.4-h33" AND os_version:<"11.1.6-h32") OR  
(os_version:>"11.1.6-h32" AND os_version:<"11.1.7-h6") OR  
(os_version:>"11.1.7-h6" AND os_version:<"11.1.10-h25") OR  
(os_version:>"11.1.10-h25" AND os_version:<"11.1.13-h5") OR  
(os_version:>"11.1.13-h5" AND os_version:<"11.1.15") OR  
(os_version:>="11.2" AND os_version:<"11.2.4-h17") OR  
(os_version:>"11.2.4-h17" AND os_version:<"11.2.7-h13") OR  
(os_version:>"11.2.7-h13" AND os_version:<"11.2.10-h6") OR  
(os_version:>"11.2.10-h6" AND os_version:<"11.2.12") OR  
(os_version:>="12.1" AND os_version:<"12.1.4-h5") OR  
(os_version:>"12.1.4-h5" AND os_version:<"12.1.7"))

From the Service Inventory you can use the following query to locate potentially vulnerable PAN-OS Captive Portals:

_service.favicon.ico.image.md5:c8c08bbe0b78b27d61002db456c741cc AND _service.http.code:="403" and (port:6080 OR port:6081 OR port:6082)

February 2025 (Multiple CVEs)

On February 20, 2025, Palo Alto Networks updated another security advisory notifying customers of other active exploitation of vulnerabilities being chained together with CVE-2025-0108. In the advisory, CVE-2025-0111, with a CVSS score of 7.1, the vendor warns that an "authenticated attacker with network access to the management web interface" could gain read access to files accessible by the nobody user on the local filesystem.

On February 18, 2025 Palo Alto Networks confirmed that CVE-2025-0108 was being actively exploited in the wild. They also updated their advisory noting that the vulnerability could be chained together with other patched vulnerabilities including CVE-2024-9474.

On February 12, 2025 Palo Alto Networks (PAN) has issued multiple security advisories for vulnerabilities in PAN-OS. 

• CVE-2025-0108 is rated high with a CVSS score of 7.8. Successful exploitation of this vulnerability would allow a remote unauthenticated attacker to bypass authentication and run certain scripts.
• CVE-2025-0109 is rated medium with a CVSS score of 5.5. Successful exploitation of this vulnerability would allow a remote unauthenticated attacker to delete certain files as the "nobody" user. This includes certain logs and configuration files but not system files.

What is the impact?

An attacker that can access the web administration interface of a device running PAN-OS can execute certain scripts or delete certain files. 

Are updates or workarounds available?

Palo Alto has released updates to address these vulnerability, and strongly recommends that users update as quickly as possible. They also recommend that users restrict access to vulnerable systems' web interfaces as quickly as possible, and prior to applying any updates.

How to find PAN-OS systems on your network

From the Asset Inventory you can use the following query to locate potentially vulnerable systems:

os:"PAN-OS"

November 2024 (Multiple CVEs)

On November 18, 2024 Palo Alto Networks (PAN) issued a security advisory for a vulnerability that allows an unauthenticated attacker with access to the system's management PAN-OS web interface to gain administrator privileges on the device. There is limited evidence that CVE-2024-0012 is being exploited in the wild. This vulnerability is rated as critical with a 9.3 CVSS score. 

What is the impact?

An attacker that can access the web administration interface of a device running PAN-OS can gain administrative privileges on the system. This would allow the attacker control over the system, and additionally may allow the attacker paths to further exploits (for example, CVE-2024-9474).

Palo Alto has indicated that there is limited evidence of exploitation of this vulnerability in the wild. Palo Alto's Unit 42 research organization has authored a writeup on the vulnerability that includes some Indicators of Compromise (IoCs).

Note that CISA (the Cybersecurity and Infrastructure Security Agency) has added CVE-2024-0012 and CVE-2024-9474 to their Known Exploited Vulnerabilities catalog.

Are updates or workarounds available?

Palo Alto has released updates to address this vulnerability, and strongly recommends that users update as quickly as possible. They also recommend that users restrict access to vulnerable systems' web interfaces as quickly as possible, and prior to applying any updates.

How to find PAN-OS systems on your network

From the Asset Inventory you can use the following query to locate potentially vulnerable systems:

os:"PAN-OS"

CVE-2024-5910, CVE-2024-9463, and CVE-2024-9465

Palo Alto Networks (PAN) updated a security advisory advising customers to restrict access to the management interface of Next-Generation Firewalls (NGFW) due to an actively exploited zero-day vulnerability.

CISA announced that CVE-2024-5910, which was patched in July, is actively being exploited and was added to the Known Exploited Vulnerabilities (KEV) Catalog. Although not directly affecting PAN-OS, this vulnerability affects the Expedition migration tool, which could contain API keys, administrator credentials, and/or PAN-OS device configuration information.

Additionally, CISA announced that both CVE-2024-9463 (CVSS 9.9) and CVE-2024-9465 (CVSS 9.3) are actively being exploited and were also added to the Known Exploited Vulnerabilities (KEV) Catalog. Both vulnerabilities also affect the Expedition migration tool.

What is the impact?

Although no specific details of a remote code execution vulnerability were disclosed within the advisory, Palo Alto is actively investigating an active exploitation of a zero-day vulnerability against the management interfaces of NGFWs exposed to the public Internet.

CVE-2024-5910 allows for a remote attacker to reset application admin credentials on Expedition servers. Additionally, successful exploitation of the other two vulnerabilities above could allow for a remote attacker to execute arbitrary OS commands or reveal the contents of the underlying database.

Are updates or workarounds available?

Within the advisory, Palo Alto recommends restricting access to the management interface. Additionally, they advise following a set of best practices to secure the management interface. 

Palo Alto Networks released a patch for CVE-2024-5910 in July.

How to find PAN-OS systems on your network

From the Asset Inventory you can use the following query to locate potentially vulnerable systems:

os:"PAN-OS" type:"Firewall"

How to find Expedition servers on your network

From the Service Inventory you can use the following query to locate potentially vulnerable systems:

html.title:="Expedition Project"

October 10, 2024 vulnerabilities

Palo Alto Networks (PAN) released a security advisory with multiple vulnerabilities on PAN-OS firewalls that could lead to admin account takeover.

• CVE-2024-9463 is rated critical with CVSS score of 9.9, is an OS command injection vulnerability and potentially allows for  and execution of OS commands as root.
• CVE-2024-9464 is rated critical with CVSS score of 9.3, is an OS command injection vulnerability and potentially allows for the execution of OS commands as root.
• CVE-2024-9465 is rated critical with CVSS score of 9.2, is a SQL injection vulnerability and potentially allows a remote unauthenticated attacker to read the contents of the Expedition database.
• CVE-2024-9466 is rated high with CVSS score of 8.2, and potentially allows for an authenticated user to read sensitive information including passwords and API keys.
• CVE-2024-9467 is rated high with CVSS score of 7.0, is an XSS vulnerability and potentially allows for execution of malicious JavaScript code that could result in session hijacking.

If chained together through an exploit, a firewall running the vulnerable software could be completely taken over by an unauthenticated remote attacker. For more information, the team that disclosed the vulnerabilities to Palo Alto Networks, published a detailed analysis. According to the vendor, there was no known malicious exploitation of vulnerable systems at the time.

According to Palo Alto Networks, "The fixes for all listed issues are available in Expedition 1.2.96, and all later Expedition versions." They also recommended rotating all passwords and API keys after applying the latest patch to prevent future unauthorized access. Refer to the Workarounds and Mitigations section of the security advisory for information about potential workarounds and additional advice.

CVE-2024-3400

Palo Alto Networks (PAN) disclosed that certain versions of their PAN-OS software had a vulnerability that allowed for remote command injection.

CVE-2024-3400 was rated critical with CVSS score of 9.8 and indicated an unauthenticated attacker could execute arbitrary code with root privileges on the firewall. The vendor indicated that there was evidence of limited exploitation in the wild.

watchTowr posted a detailed analysis including the details needed for exploitation. This analysis covered two separate vulnerabilities; an arbitrary file creation vulnerability in the session handler, and a shell metacharacter injection issue that lead to remote execution through the telemetry script. PAN updated their guidance to state that "Disabling device telemetry is no longer an effective mitigation".

The following PAN-OS versions were affected by this vulnerability.

Palo Alto Networks indicated that PAN-OS 11.1, 11.0, and 10.2 versions with the configurations for both GlobalProtect gateway and device telemetry enabled.

Customers could verify this by checking for entries in the firewall web interface (Network > GlobalProtect > Gateways) and verify whether device telemetry was enabled by checking the firewall web interface (Device > Setup > Telemetry).

Palo Alto Networks recommended that customers with a Threat Prevention subscription block attacks for this vulnerability by enabling Threat ID 95187 (introduced in Applications and Threats content version 8833-8682) and applying vulnerability protection to GlobalProtect interfaces.

It was also recommended that telemetry be disabled until devices could be upgraded to an unaffected version of PAN-OS.

Rapid7 has disclosed that certain versions of Gogs are affected by an argument injection vulnerability within the pull request "Rebase before merging" style merge handling. The flaw is caused by a malicious pull request branch name being passed directly to the git rebase command without a -- delimiter to indicate the end of options. As a result, the branch name is interpreted as the --exec flag. Successful exploitation allows a remote, authenticated attacker to achieve remote code execution (RCE) as the Gogs server process user via a crafted pull request. Because Gogs ships with open registration enabled by default (DISABLE_REGISTRATION = false), the authentication requirement poses less of a barrier in default configurations. This vulnerability does not currently have a CVE ID assigned, and the vendor has not released a patch.

The following versions are affected

• Gogs: Versions 0.14.2 and 0.15.0+dev (commit b53d3162)
• Note: Prior versions supporting the "Rebase before merging" merge style are likely to be vulnerable as well.

What is Gogs?

Gogs is an open-source, self-hosted Git repository management system written in Go that provides a web-based interface for version control with minimal hardware resource requirements.

What is the impact?

Successful exploitation of the vulnerability would allow an attacker to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

There is currently no patched version of Gogs available. To mitigate risk, immediately disable open registration (DISABLE_REGISTRATION = true) and limit the Internet exposure of any Gogs instances. If applicable, restrict user repository creation (MAX_CREATION_LIMIT = 0) to reduce the immediate attack surface.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Gogs AND product:=Gogs

March 2026: CVE-2026-25921

Gogs has disclosed that certain versions are affected by a cross-repository Large File Storage (LFS) object overwrite vulnerability due to missing content hash verification. Git LFS is an open-source extension designed to manage large files, such as audio samples, videos, and datasets, more efficiently within Git repositories. Because Gogs stores all LFS objects in a single location without repository isolation, this flaw could allow a remote, unauthenticated adversary to overwrite existing objects. The vulnerability has been designated CVE-2026-25921 and has been rated critical with a CVSS score of 9.3.

The following versions are affected

• Gogs versions prior to 0.14.2

What is the impact?

Successful exploitation of the vulnerability enables an adversary to overwrite legitimate LFS objects with malicious content. This introduces a significant risk of a supply-chain attack; because the Gogs web interface does not present integrity warnings, users may unknowingly download and utilize compromised assets.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• Gogs upgrade to version 0.14.2 or later

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Gogs AND product:=Gogs

December 2025: CVE-2025-8110

Security researchers at Wiz have reported a 0-day vulnerability in Gogs. This flaw allows remote, authenticated attackers to overwrite arbitrary files on the vulnerable system. Successful exploitation of this vulnerability would allow an attacker to execute arbitrary code on the vulnerable system with the privileges of the Gogs server process.

This vulnerability has been assigned CVE-2025-8110 and has a CVSS score of 7.8.

Note that there is evidence that this vulnerability is being actively exploited in the wild.

The following versions are affected

• Gogs versions 0.13.3 and prior

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

There is currently no patched fixed version of Gogs available. Users are encouraged to disable auto-registration of users and avoid Internet exposure for any Gogs installations.

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially vulnerable assets:

_asset.protocol:=http AND protocol:=http AND favicon.ico.image.md5:=5f5b7539f014b9996959f5dcd063d383

Here’s what we do, we automate and make the whole business of vulnerability management smoother and easier for everyone involved, reporters of bugs and receivers of bugs alike.

We’ve known this for a while – pretty much the entire time I’ve been involved in vulnerability reporting. We’ve been watching the count of issued and reserved CVEs creep up, year over year, without exception. Here’s the last 10 years, according to CVEDetails.

The careful reader will note that for all of those years, we didn’t have MYTH🐙S breathing down our necks, and yet CVE disclosures have been marching up and to the right without fail for a decade. Now, the threat of AI-assisted vulnerability discovery is forcing the conversation for real with some pretty serious juicing of discovery and reporting rates.

I think we have a real shot here at modernizing vulnerability disclosure in general and CVE assignment in specific to keep up with the volume. Which is great, because who doesn’t love a new project? As a colleague in CVE-land once paraphrased, “let’s not let this crisis go to waste.” We’re actively working up some ideas and plans and schemes to imbue the whole CVE reservation-to-publication pipeline with some much-needed automation anyway; I know of at least three different CVE-connected working groups who are focusing on some variation of a “more, better, faster” goal for vulnerability disclosure. (The CNA Research Working Group has an open comment RFI available on this topic, right now, through June 5, 2026.)

One of the simplest things product owners can do is make it very easy and obvious on how to report vulnerabilities. Dropping a well-formatted, .well-known/security.txt file in the root of basically every website that talks about your software goes a long way toward pointing people (or agents) in the right direction and can help reduce misfired vulnerabilities landing in a public support queue.

Fight fire with fire

In the meantime, we cannot leave our vulnerability handlers on the sidelines. Since we know that bug-hunters are using increasingly common tooling to uncover vulnerabilities and telling product owners about them, I’m sorry to say that the receivers of these reports need to get on the AI train as well. We cannot be triaging, verifying, and fixing these bugs at mere human speeds any more, because we simply cannot keep up. One of the things LLMs are pretty good at, and are marketed for, is the triage stage of basically any support ticket system.

Vulnerabilities don’t need to be any different. Hooking an LLM into your intake should be able to tell you, pretty quickly, if this is actually a novel bug report. We’re seeing today that one of the side effects of widely available tooling is that the tools are uncovering the same bugs, over and over again.

And of course, you needn’t leave all the prompting fun to the bug-hunters. In most cases, once you know about a technical bug, a technical fix is usually pretty straightforward; PSIRTs can and should be using LLMs to whip up quick fixes to address the immediate issue, and then subject their (often complicated, years-spanning) codebase to a thorough AI-assisted code review to spot similar issues that are lurking in other parts of the code. Just like with anything AI, the results aren’t going to be perfect, but LLMs are, in their cold, mathy hearts, excellent pattern-matchers. Springboarding a code review off of a vulnerability report is a great way to get some focused security review with a prompt along the lines of, “Find other instances of this reported bug that might have cropped up in similar functions across this repository, and let me know if you find anything suspicious.” (By the way, don’t fall into desperation prompting traps like “and make no mistakes.” LLMs are probabilistic, not exactly mechanistic.)

Bug bounty value adds

Here’s a pro-tip for the bug bounty hunters of the world. Now that you know your AI-augmented tooling is likely to produce duplicate bug reports, you can make sure that your report floats to the top of the queue by using your mighty AI sidekick to sketch out a fix, as well as the initial attack. Even better, you could provide some indicators of compromise (IOCs) and other fingerprints describing how people can tell if your new bug is ever actually exploited in the wild. That way, even if it is a duplicate, your report is instantly more valuable than the last one, because it comes with some actually helpful pointers for the product owners.

Of course, you should also, ya know, actually do the work involved in bug hunting. Validate that your finding is actually real, has some articulable attacker value, and doesn’t require some wonky preconditions (or if it does, be clear about those). LLMs are still prone to hallucinations and wishful thinking, so it’s on you to validate the findings before firing them off.

I believe this kind of thoughtful, end-to-end reporting will separate the noise-producers from the truly helpful, and thus, the folks that do this for money should see more rewards for their work with just a little extra packaging.

I understand that fixing bugs isn’t your bag, oh noble vuln-spotters. But, this brief window of unique AI-assisted productivity on the findings side is going to further reduce your research product to mere commodity status. You’re going to need to come up with ways to make sure that your bug report is the most useful among dozens to hundreds, and I bet that packaging up some IOCs and patches will make yours stand out.

Drupal disclosed that certain versions of Drupal core are affected by a SQL injection vulnerability in the database abstraction API due to the improper neutralization of special elements. This flaw allows a remote, unauthenticated attacker to send specially crafted requests that result in arbitrary SQL execution on sites configured to use a PostgreSQL database. Successful exploitation allows an attacker to achieve information disclosure and, in select cases, privilege escalation, remote code execution (RCE), or other attacks. This vulnerability has been designated CVE-2026-9082 and has been rated critical with a CVSS score of 9.8.

There is evidence that this vulnerability is being actively exploited in the wild.

The following versions are affected:

• Drupal: Versions 8.9.0 to before 10.4.10
• Drupal: Versions 10.5.0 to before 10.5.10
• Drupal: Versions 10.6.0 to before 10.6.9
• Drupal: Versions 11.0.0 to before 11.1.10
• Drupal: Versions 11.2.0 to before 11.2.12
• Drupal: Versions 11.3.0 to before 11.3.10

Note: this vulnerability only affects sites configured to use a PostgreSQL database.

What is Drupal core?

Drupal core is the blank-slate version of the PHP-based content management system (CMS) and web application framework that includes only the essential tools needed to build, log into, and run a basic website.

What is the impact?

Successful exploitation of this vulnerability could result in information disclosure, privilege escalation, remote code execution (RCE), or other arbitrary attacks.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

• Drupal 8.9: Manually apply the patch SA-CORE-2026-004-8.9.patch.
• Drupal 9.x: Manually apply the Drupal 9.5 patch SA-CORE-2026-004-9.5.patch.
• Drupal 10.4.x or earlier: Upgrade to version 10.4.10 or later.
• Drupal 10.5.x: Upgrade to version 10.5.10 or later.
• Drupal 10.6.x: Upgrade to version 10.6.9 or later.
• Drupal 11.0.x or 11.1.x: Upgrade to version 11.1.10 or later.
• Drupal 11.2.x: Upgrade to version 11.2.12 or later.
• Drupal 11.3.x: Upgrade to version 11.3.10 or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Drupal AND product:=Drupal

Most organizations are still relying on legacy spreadsheets and "point-in-time" scans to meet these requirements. That is a recipe for failure. To achieve true NIS2 resilience, you must transition from passive observation to a full exposure management platform.

In case you need a quick refresher, article 21 of the NIS2 framework comprises 10 pillars:

Let’s talk about how runZero relates to each of these ten pillars and streamlines your path to compliance.

How runZero directly impacts: Risk Assessment, Security for Employees with Access to Data, and Assessment of Security Efficacy

Many organizations rely on third-party tools like EDRs for asset inventory, however these solutions leave significant gaps that could result in non-compliance and leave organizations exposed to compromise. NIS2 requires organizations to “adopt a mechanism to identify relevant assets and an assessment of the risks in that Member State.” But how can you be certain that you’ve identified all the assets and their associated risks?

You need a solution that safely scans and discovers external, internal, and cloud-based assets, including those that are missing security controls or that are impossible to deploy agents on – the unknowns and unmanageables.

runZero is the leader in reliable, agentless active scanning across IT, IoT, and OT. On average, enterprise organizations find 25% more assets with runZero than they were previously aware of, and in some cases, this number is exponentially greater. runZero’s best-in-class discovery of both assets and vulnerabilities yields tremendous impact on Pillar #1, Risk Assessment.

OT environments in particular are notorious for blind spots and, in the best cases, visibility is oftentimes restricted to IP-based devices. With the 4.9 release of our product, runZero can walk the backplane of a Modbus gateway to see every serial device connected to it. Since a single compromised thermostat can be connected to dozens of other devices that could serve as pivot points, this level of visibility is critical not only for compliance, but to ensure critical areas of your network are secure.

We uncover assets and CVEs, and we also discover multi-homed devices that can shatter segmentation. Multi-homed devices often act as a bridge, bypassing firewalls and other controls that are designed to prevent lateral movement. New capabilities in the 4.9 release enable you to map the path of least resistance an attacker can take across these devices. runZero’s network maps show you the unintended routes across environments that threaten security. We also identify outdated protocols that need to be deprecated to eliminate weaknesses that can be exploited. At the same time, runZero identifies expired certificates that undermine your security controls.

runZero gives you the single source of truth to anchor your risk policies and pinpoint exactly where you need to focus your attention.

How runZero directly impacts: Security Around Procured Systems and Supply Chain Security

This area represents one of the most significant expansions from the original NIS directive. It acknowledges that an organization's security perimeter is only as strong as its weakest third-party vendor. Several mandates in these pillars deal with the diligence in vetting suppliers and proper cybersecurity clauses in contractual agreements, which aren’t directly related to runZero.

But the goal for these expansions in NIS2 is to transition organizations away from "one-and-done" checkbox compliance. Entities must implement continuous monitoring mechanisms to supervise their supplier ecosystem. This means utilizing automated risk assessments, security ratings, and regular audits to ensure critical vendors maintain their security posture. runZero excels in the continuous monitoring mechanism for all internal, external, and cloud based parts of your entire attack surface.

Legacy scanners can miss third-party black boxes, vendor-managed systems, and unmanaged devices. runZero doesn’t miss any of these. Using a combination of active scanning, passive scanning, and turnkey integrations, runZero provides detailed asset inventories and identification of exposures helping ensure that all procured systems are identified and free from known vulnerabilities. runZero helps you secure the supply chain and ensures every procured system is hardened and visible, not a backdoor for an adversary.

How runZero directly impacts: Use of Multi-factor Authentication, Basic Computer Hygiene, Use of Cryptography and Encryption

Most breaches don't use zero-days; they often rely on simple oversights like unencrypted protocols, legacy assets, and forgotten accounts. That’s why pillars #4, #7, & #10 focus on enforcing foundational, day-to-day security routines that eliminate risks across the entire infrastructure.

runZero extracts high-fidelity metadata to unmask assets missing MFA, outdated operating systems, and weak network protocols. We highlight the gaps where your security stack (EDR/AV) is missing or disabled. runZero identifies and tracks these overlooked exposures with surgical precision, effectively tackling the requirements of these pillars.

How runZero directly impacts: Plan for Managing Business Operations During an Incident, Plan for Handling Security Incidents

While most of the requirements in these pillars involve having a disaster recovery and incident response plan in place and documented, another key aspect involves the timelines of reporting an incident to “supervisory authorities or the CSIRT within 24 hours of detecting a significant incident.” But how can you tell the difference between an isolated incident and a significant one? During a crisis, you don't have unlimited time to figure out how widespread a compromise can be as you race the clock towards containment.

Since the release of 4.9, runZero provides a live, offensive-mindset map of your infrastructure, showing you how a compromised device connects to others, or the public internet. This is the way you can begin to understand the scope of an incident. runZero gives you up-to-date, continuously refreshed asset inventory to track critical systems and support business continuity during an active incident. We combine our best in class discovery with the new Attack Path Mapping in release 4.9, showing you the blast radius of an attack in minutes, not days, so you can know when and what you need to disclose.

The Bottom Line

In today’s climate of AI-accelerated attacks, SecOps teams have less time than ever before to respond to attacks. NIS2 provides a framework to prove that you have done your due diligence to prepare for the inevitable. The risks of non-compliance are severe; with fines of up to €10 million or 2% of global annual turnover, compliance is a business priority not just a technical one. runZero can help.

See what others miss. Secure what others can't.

Interested in trying runZero? You can explore the platform for free for 21 days.

Vercel disclosed that self-hosted Next.js applications using the built-in Node.js server are vulnerable to server-side request forgery (SSRF) within the WebSocket upgrade handling mechanism. A remote, unauthenticated attacker can exploit this flaw by sending crafted WebSocket upgrade requests. Successful exploitation allows the server to proxy requests to arbitrary internal or external destinations. This can expose sensitive internal services or cloud infrastructure endpoints, such as the Instance Metadata Service (IMDS), a local HTTP endpoint used by virtual machines to retrieve configurations, IP addresses, and IAM roles via a link-local address. This vulnerability has been designated CVE-2026-44578 and has been rated high with a CVSS score of 8.6.

The following versions are affected:

• Next.js 13, 14, and 15: Versions 13.4.13 through 15.5.15
• Next.js 16: Versions 16.0.0 through 16.2.4

What is Vercel Next.js?

Next.js, an open-source React framework developed by Vercel, provides structure, routing, and rendering solutions for building full-stack web applications.

What is the impact?

Successful exploitation of this vulnerability would allow an attacker to proxy requests to arbitrary internal or external destinations, potentially exposing sensitive internal services or cloud infrastructure endpoints.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions:

• Next.js 13.x, 14.x, and 15.x: Upgrade to version 15.5.16 or later.
• Next.js 16.x: Upgrade to version 16.2.5 or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Vercel AND product:="Next.js"

December 2025: CVE-2025-55182

React disclosed a remote code execution (RCE) vulnerability in React Server Components that affects the React packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack in versions 19.0.0 through 19.2.0, as well as frameworks that use them, such as Next.js. The upstream vulnerability has been designated CVE-2025-55182 and has been rated critical with a CVSS score of 10.0. Next.js also disclosed the downstream RCE vulnerability impacting applications using the App Router.

This flaw stems from an issue in how React decodes payloads sent to React Server Function endpoints (used by client components to call async functions on the server). Successful exploitation allows a remote, unauthenticated adversary to send a specially crafted request and subsequently execute arbitrary code on the server.

There is evidence that this vulnerability is being actively exploited in the wild.

The following versions are affected

• Next.js 14.3.x versions 14.3.0-canary.77 and greater
• Next.js 15.0.x versions prior to 15.0.5
• Next.js 15.1.x versions prior to 15.1.9
• Next.js 15.2.x versions prior to 15.2.6
• Next.js 15.3.x versions prior to 15.3.6
• Next.js 15.4.x versions prior to 15.4.8
• Next.js 15.5.x versions prior to 15.5.7
• Next.js 16.0.x versions prior to 16.0.7

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• Next.js 15.0.x upgrade to version 15.0.5 or later
• Next.js 15.1.x upgrade to version 15.1.9 or later
• Next.js 15.2.x upgrade to version 15.2.6 or later
• Next.js 15.3.x upgrade to version 15.3.6 or later
• Next.js 15.4.x upgrade to version 15.4.8 or later
• Next.js 15.5.x upgrade to version 15.5.7 or later
• Next.js 16.0.x upgrade to version 16.0.7 or later

Note: Users of Next.js 14.3.x experimental canary releases should downgrade specifically to version 14.3.0-canary.76 or a 14.x stable release.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

(vendor:=Zeit OR vendor:=Vercel) AND (product:=Next.Js OR product:=Next.js)

Cisco disclosed certain versions of Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage) contain a vulnerability in the peering authentication mechanism. A remote, unauthenticated adversary could exploit this by sending crafted requests to an affected system to bypass authentication and obtain administrative privileges. By leveraging an internal, high-privileged, non-root user account, the adversary could access NETCONF, enabling them to manipulate the network configuration for the entire SD-WAN fabric. The vulnerability has been designated CVE-2026-20182 and has been rated critical with a CVSS score of 10.0.

There is evidence that this vulnerability is being actively exploited in the wild.

The following deployment environments are affected

• On-Premise deployments
• Cisco Hosted SD-WAN Cloud (Standard, Cisco Managed, and FedRAMP)

The following versions are affected

• Catalyst SD-WAN releases prior to 20.9
• Catalyst SD-WAN release 20.9 versions prior to 20.9.9.1
• Catalyst SD-WAN release 20.10 versions prior to 20.12.7.1
• Catalyst SD-WAN release 20.11 versions prior to 20.12.7.1
• Catalyst SD-WAN release 20.12 versions prior to 20.12.5.4
• Catalyst SD-WAN release 20.12 versions prior to 20.12.6.2
• Catalyst SD-WAN release 20.13 versions prior to 20.12.7.1
• Catalyst SD-WAN release 20.13 versions prior to 20.15.5.2
• Catalyst SD-WAN release 20.14 versions prior to 20.15.5.2
• Catalyst SD-WAN release 20.15 versions prior to 20.15.4.4
• Catalyst SD-WAN release 20.15 versions prior to 20.15.5.2
• Catalyst SD-WAN release 20.16 versions prior to 20.18.2.2
• Catalyst SD-WAN release 20.18 versions prior to 20.18.2.2
• Catalyst SD-WAN release 26.1 versions prior to 26.1.1.1

What is Cisco Catalyst SD-WAN Controller and Manager?

The Cisco Catalyst SD-WAN Controller serves as the centralized control-plane element, utilizing the Overlay Management Protocol (OMP) to manage routing intelligence, distribute security keys, and enforce network-wide policies. In contrast, the Cisco Catalyst SD-WAN Manager acts as the centralized management system, providing the graphical interface necessary for the configuration, monitoring, and orchestration of all devices within the fabric.

What is the impact?

Successful exploitation of the vulnerability would allow an adversary to obtain administrative privileges manipulate the network configuration for the entire SD-WAN fabric.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• Catalys SD-WAN releases prior to 20.9 migrate to a fixed release.
• Catalyst SD-WAN release 20.9 upgrade to version 20.9.9.1 and later.
• Catalyst SD-WAN release 20.10 upgrade to version 20.12.7.1 and later.
• Catalyst SD-WAN release 20.11 upgrade to version 20.12.7.1 and later.
• Catalyst SD-WAN release 20.12 upgrade to version 20.12.5.4 and later.
• Catalyst SD-WAN release 20.12 upgrade to version 20.12.6.2 and later.
• Catalyst SD-WAN release 20.13 upgrade to version 20.12.7.1 and later.
• Catalyst SD-WAN release 20.13 upgrade to version 20.15.5.2 and later.
• Catalyst SD-WAN release 20.14 upgrade to version 20.15.5.2 and later.
• Catalyst SD-WAN release 20.15 upgrade to version 20.15.4.4 and later.
• Catalyst SD-WAN release 20.15 upgrade to version 20.15.5.2 and later.
• Catalyst SD-WAN release 20.16 upgrade to version 20.18.2.2 and later.
• Catalyst SD-WAN release 20.18 upgrade to version 20.18.2.2 and later.
• Catalyst SD-WAN release 26.1 upgrade to version 26.1.1.1 and later.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Cisco vManage" OR os:="Cisco Viptela OS"

Note: The query locates Cisco Catalyst SD-WAN Manager installations.

March 2026 Cisco Catalyst SD-WAN vulnerability: CVE-2026-20127

Cisco disclosed certain versions of Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage) contain a vulnerability in the peering authentication mechanism. A remote, unauthenticated adversary could exploit this by sending crafted requests to an affected system to bypass authentication and obtain administrative privileges. By leveraging an internal, high-privileged, non-root user account, the adversary could access NETCONF, enabling them to manipulate the network configuration for the entire SD-WAN fabric. The vulnerability has been designated CVE-2026-20127 and has been rated critical with a CVSS score of 10.0.

There is evidence that this vulnerability is being actively exploited in the wild.

On March 11, 2026, CISA published V1: ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems. This version supersedes the actions outlined in the original February 25 directive, introducing updated remediation steps and new reporting requirements for affected organizations.

The following deployment environments are affected

• On-Premise deployments
• Cisco Hosted SD-WAN Cloud (Standard, Cisco Managed, and FedRAMP)

The following versions are affected

• Catalyst SD-WAN releases prior to 20.9
• Catalyst SD-WAN release 20.9 versions prior to 20.9.8.2
• Catalyst SD-WAN release 20.11 versions prior to 20.12.6.1
• Catalyst SD-WAN release 20.12.5 versions prior to 20.12.5.3
• Catalyst SD-WAN release 20.12.6 versions prior to 20.12.6.1
• Catalyst SD-WAN release 20.13 versions prior to 20.15.4.2
• Catalyst SD-WAN release 20.14 versions prior to 20.15.4.2
• Catalyst SD-WAN release 20.15 versions prior to 20.15.4.2
• Catalyst SD-WAN release 20.16 versions prior to 20.18.2.1
• Catalyst SD-WAN release 20.18 versions prior to 20.18.2.1

What is Cisco Catalyst SD-WAN Controller and Manager?

The Cisco Catalyst SD-WAN Controller serves as the centralized control-plane element, utilizing the Overlay Management Protocol (OMP) to manage routing intelligence, distribute security keys, and enforce network-wide policies. In contrast, the Cisco Catalyst SD-WAN Manager acts as the centralized management system, providing the graphical interface necessary for the configuration, monitoring, and orchestration of all devices within the fabric.

What is the impact?

Successful exploitation of the vulnerability would allow an adversary to obtain administrative privileges manipulate the network configuration for the entire SD-WAN fabric.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• Catalyst SD-WAN releases prior to 20.9 migrate to a fixed release
• Catalyst SD-WAN release 20.9 upgrade to version 20.9.8.2 and later
• Catalyst SD-WAN release 20.11 upgrade to version 20.12.6.1 and later
• Catalyst SD-WAN release 20.12.5 upgrade to version 20.12.5.3 and later
• Catalyst SD-WAN release 20.12.6 upgrade to version 20.12.6.1 and later
• Catalyst SD-WAN release 20.13 upgrade to version 20.15.4.2 and later
• Catalyst SD-WAN release 20.14 upgrade to version 20.15.4.2 and later
• Catalyst SD-WAN release 20.14 upgrade to version 20.15.4.2 and later
• Catalyst SD-WAN release 20.16 upgrade to version 20.18.2.1 and later
• Catalyst SD-WAN release 20.18 upgrade to version 20.18.2.1 and later

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Cisco vManage" OR os:="Cisco Viptela OS"

Note: The query locates Cisco Catalyst SD-WAN Manager installations.

Zero Trust assumes breach, meaning system owners should assume an adversary is already in the environment, and ZT principles are designed to limit threat actor movement and contain potential damage. Applying traditional information technology (IT) ZT principles to OT systems, however, is aspirational at best, and widely considered impossible given the fundamental differences between traditional IT and OT. Even so, this new federal guidance aims to remedy this problem by providing a set of ZT principles specifically designed for OT systems.

Why this matters today

Cyber attacks on OT systems are not new, but they have been increasing. You may have seen that CISA recently urged critical infrastructure operators to “fortify their systems against disruptive cyberattacks,” due to increased geopolitical tensions.

It’s easy to see why international adversaries find OT as an attractive target:

• OT is typically legacy-by-design; OT systems are often 20 or more years in active service.

• Modernizing OT is fantastically expensive; replacing one OT component often requires replacing many upstream and downstream components for compatibility.

• OT and IT are converging; like it or not, we’re seeing OT creep into traditional IT networks, sometimes by design, sometimes by accident, creating pathways from the internet to the industrial floor.

• Attacking OT is typically easier: traditional IT attackers usually have a goal of arbitrary code execution or user privilege escalation, often with stealth and persistence in mind. OT attackers, on the other hand, usually end up disabling the target with Denial of Service (DoS) effects with obvious real-world results.

• Successful cyberattacks against OT have direct, kinetic consequences by disrupting utilities, damaging the environment, causing loss of life, and more.

These factors all conflate to create a target environment that is often old, stationary, and fragile.

What can we do right now?

While, of course, we agree that Zero Trust as a design principle could go a long way to shore up OT defenses, and the guidance is definitely worth a read, the above reasons of “why OT is the way it is” are all fundamentally working against active change in OT buildouts. Any pivot in design among the Rockwells and Siemens (and all the other OT suppliers worldwide) will take years, if not decades to become common in the field, which doesn’t do us a ton of good today for all of the existing OT infrastructure.

But, before we move on. The guidance includes one point we’d like to specifically mention. It basically says you can use active scanning, but immediately follows with a note about having deep awareness of your systems before attempting it. We really don’t want OT operators to use this as a reason not to conduct active scanning! There are safe scanning solutions, like runZero, which are proven to not negatively impact system performance (according to an evaluation conducted by the U.S. Department of Energy’s National Renewable Energy Laboratory).

So, circling back to what to do now. We'd recommend taking the first step first: get ahead of attackers by actually mapping out what your OT attack surface looks like from an attacker’s perspective. You may have heard that we just released runZero 4.9, which brings just a ton of OT-specific smarts to the table, as well as some really fun attack path mapping visualizations and insights. Give it a whirl in your test lab today for free, and you’ll see what we mean.

But even with our new capabilities, runZero can’t go it alone: as an industry, we need to get over this idea that OT is so fragile you literally cannot look at it without causing problems. Yes, of course, be careful, thoughtful, and precise, but with today’s threat landscape, the belief that OT is so incredibly fragile that you cannot take steps to protect your environment beyond air-gaps and segmentation, isn’t based in reality. We’re taking steps to create and ship powerful capabilities that can actually help spot where bad guys are likely to turn their attention, so that you can instrument those points with surveillance and extra protections.

Researchers disclosed that certain versions of Exim are susceptible to a critical remote code execution (RCE) vulnerability caused by a use-after-free (UAF) condition in the BDAT body parsing path. The flaw is specifically triggered when Exim is configured to use GnuTLS, the default TLS library for many Debian-based distributions. The vulnerability occurs when a client sends a TLS close_notify alert mid-body during an SMTP CHUNKING (RFC 3030) transfer, followed by a final cleartext byte on the same TCP connection. This specific sequence leads to heap corruption, which a remote, unauthenticated attacker can leverage to execute arbitrary code on the system. The vulnerability, designated CVE-2026-45185, also known as Dead.Letter, is rated critical with a base CVSS score of 9.8.

The following versions are affected

• Exim: Versions prior to 4.99.3 (when configured with GnuTLS).

What is Exim?

Exim is an open-source Mail Transfer Agent (MTA) for Unix-like operating systems that manages the routing and delivery of email messages via SMTP using a highly flexible and programmable configuration system.

What is the impact?

Successful exploitation of the vulnerability could allow a remote, unauthenticated attacker to execute arbitrary code on the affected system.

Are updates or workarounds available?

Upgrade affected systems to the new versions

• Exim: Upgrade to 4.99.3 or later.

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially impacted assets:

product:=exim AND banner:"STARTTLS"

October 2023: CVE-2023-42116, CVE-2023-42117, CVE-2023-42118, CVE-2023-42119, and CVE-2023-42114

On September 27th 2023, Trend Micro's Zero Day Initiative (ZDI) published details of a critical zero-day vulnerability that allows an unauthenticated attacker the ability to remotely execute arbitrary code within the context of an Exim SMTP service account. In addition, ZDI disclosed five additional zero-day vulnerabilities with lower severity rankings:

• CVE-2023-42116: Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS v3.0 8.1)
• CVE-2023-42117: Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability (CVSS v3.0 8.1)
• CVE-2023-42118: Exim libspf2 Integer Underflow Remote Code Execution Vulnerability (CVSS v3.0 7.5)
• CVE-2023-42119: Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS v3.0 3.1)
• CVE-2023-42114: Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS v3.0 3.7)

What is Exim Mail?

Exim mail is an open source, message transfer agent (MTA) that runs on Unix/Linux operating systems. Exim is also the default MTA configured on Debian Linux distributions.

Are updates available?

Recently, maintainers of the Exim mail server issued a 4.96.1 patch that appears to resolve four of the six vulnerabilities listed above. Although the maintainers are still working to resolve the remaining vulnerabilities, if you are running Exim mail servers on your network, you should apply the security patch immediately.

How do I find potentially vulnerable Exim mail servers with runZero?

A Shodan search showed nearly 3.5 million Exim servers exposed to the internet. Their accessibility makes these mail transfer agents targets for attackers.

With runZero, you can find Exim mail servers in your inventory with this pre-built query. This query searches for any live asset that has the exim product exposed over SMTP.

product:exim

As always, any prebuilt queries are available from your runZero console. Check out the documentation for other useful inventory queries.

F5 published a security advisory that a high vulnerability was identified in multiple versions of NGINX products.

• CVE-2026-42945: A heap-based buffer overflow vulnerability exists in the ngx_http_rewrite_module component of NGINX products. This vulnerability has been designated CVE-2026-42945 and has been rated High with a CVSS score of 8.1.

The following versions are affected:

• NGINX Plus: Versions R32 through R36
• NGINX Open Source: Versions 1.0.0 through 1.30.0
• NGINX Open Source: Versions 0.6.27 through 0.9.7
• NGINX Instance Manager: Versions 2.16.0 through 2.21.1
• F5 WAF for NGINX: Versions 5.9.0 through 5.12.1
• NGINX App Protect WAF: Versions 5.1.0 through 5.8.0
• NGINX App Protect WAF: Versions 4.9.0 through 4.16.0
• F5 DoS for NGINX: Version 4.8.0
• NGINX App Protect DoS: Versions 4.3.0 through 4.7.0
• NGINX Gateway Fabric: Versions 2.0.0 through 2.5.1
• NGINX Gateway Fabric: Versions 1.3.0 through 1.6.2
• NGINX Ingress Controller: Versions 5.0.0 through 5.4.1
• NGINX Ingress Controller: Versions 4.0.0 through 4.0.1
• NGINX Ingress Controller: Versions 3.5.0 through 3.7.2

What is NGINX?

Nginx is a high-performance, open-source software used primarily as a web server and reverse proxy to efficiently handle large volumes of simultaneous connections. It is widely favored for its speed and stability, often serving as a load balancer or HTTP cache to optimize the delivery of web content.

What is the impact?

A remote, unauthenticated attacker could exploit this vulnerability by sending crafted HTTP requests that trigger the vulnerable rewrite processing path, potentially allowing NGINX worker process restart (DoS). In environments where Address Space Layout Randomization (ASLR) is disabled, exploitation may also allow arbitrary code execution.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions:

• NGINX Plus Rx: Upgrade to R36 P4, R32 P6 or later
• NGINX Open Source: Upgrade to 1.31.0, 1.30.1 or later
  

To mitigate the vulnerability, users are encouraged to use named captures instead of unnamed captures within rewrite rules:

For example, the following rewrite directive uses unnamed capture groups: $1 and $2:

rewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1&tab=$2 last;

For this example, replacing $1 and $2 with $user_id and $section:

rewrite ^/users/(?<user_id>[0-9]+)/profile/(?<section>.*)$ /profile.php?id=$user_id&tab=$section last;

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

((vendor:="F5" OR vendor:="NGINX") AND 
  (product:="nginx plus" OR product:="nginx" OR product:="nginx ingress controller"))

Fortinet disclosed in an advisory that a critical vulnerability was identified in multiple versions of FortiAuthenticator.

• CVE-2026-44277: An improper access control vulnerability exists in Fortinet FortiAuthenticator due to insufficient authorization checks. A remote attacker with no privileges could exploit this vulnerability via a network-based attack vector, potentially allowing the execution of unauthorized code or commands. This vulnerability has been designated CVE-2026-44277 and has been rated critical with a CVSS score of 9.1.

The following versions are affected:

• FortiAuthenticator 8.0: 8.0.0, 8.0.2
• FortiAuthenticator 6.6: Versions 6.6.0 through 6.6.8
• FortiAuthenticator 6.5: Versions 6.5.0 through 6.5.6

What is Fortinet FortiAuthenticator?

FortiAuthenticator is a centralized Identity and Access Management (IAM) solution that provides secure, identity-based access across a network by managing user authentication, multi-factor authentication (MFA), and single sign-on (SSO). It acts as a gatekeeper that integrates with existing directories to ensure only authorized users and devices can access critical resources across the Fortinet Security Fabric and third-party systems.

What is the impact?

Successful exploitation of these vulnerabilities would allow an attacker to gain unauthorized API access, enabling them to escalate privileges and execute code or commands on the vulnerable host.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions:

• FortiAuthenticator 8.0: Upgrade to 8.0.3 or later
• FortiAuthenticator 6.6: Upgrade to 6.6.9 or later
• FortiAuthenticator 6.5: Upgrade to 6.5.7 or later

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:FortiAuthenticator

Fortinet disclosed in an advisory that a critical vulnerability was identified in versions of FortiSandbox.

• CVE-2026-26083: A missing authorization vulnerability exists in multiple Fortinet FortiSandbox products due to improper access control enforcement. A remote, unauthenticated attacker could exploit this vulnerability by sending crafted HTTP requests, potentially allowing the execution of unauthorized code or commands. This vulnerability has been designated CVE-2026-26083 and has been rated critical with a CVSS score of 9.1.

The following versions are affected:

• FortiSandbox 5.0: Versions 5.0.0 through 5.0.1
• FortiSandbox 4.4: Versions 4.4.0 through 4.4.8
• FortiSandbox Cloud 24: All versions
• FortiSandbox Cloud 23: All versions
• FortiSandbox Cloud 5.0: 5.0.2 through 5.0.5
• FortiSandbox PaaS 23.4: 23.4 all versions
• FortiSandbox PaaS 23.3: 23.3 all versions
• FortiSandbox PaaS 23.1: 23.1 all versions 
• FortiSandbox PaaS 22.2: 22.2 all versions
• FortiSandbox PaaS 22.1: 22.1 all versions
• FortiSandbox PaaS 21.4: 21.4 all versions
• FortiSandbox PaaS 21.3: 21.3 all versions
• FortiSandbox PaaS 5.0: 5.0.0 through 5.0.1
• FortiSandbox PaaS 4.4: 4.4.5 through 4.4.8

What is Fortinet FortiSandbox?

Fortinet FortiSandbox is a security appliance that identifies unknown threats by executing suspicious files in isolated virtual environments to monitor their behavior and then automates a response by sharing that intelligence across the network to block the detected threat.

What is the impact?

Successful exploitation of these vulnerabilities would allow an attacker to gain unauthorized API access, enabling them to escalate privileges and execute code or commands on the vulnerable host.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions:

• FortiSandbox 5.0: Upgrade to 5.0.2 or later
• FortiSandbox 4.4: Upgrade to 4.4.9 or later
• FortiSandbox PaaS 5.0: Upgrade to 5.0.2 or later
• FortiSandbox PaaS 4.4: Upgrade to 4.4.9 or later
• FortiSandbox PaaS: Migrate to a fixed release
• FortiSandbox Cloud: Migrate to a fixed release

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

os:="Fortinet FortiSandbox%"

April 2026 Fortinet FortiSandbox vulnerabilities: CVE-2026-39808, and CVE-2026-39813

Fortinet disclosed in two advisories that multiple vulnerabilities have been identified in versions of FortiSandbox.

• CVE-2026-39808: An OS command injection vulnerability exists within an API endpoint due to the improper neutralization of special elements. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted HTTP requests, potentially allowing for the execution of unauthorized code or commands. This vulnerability has been designated CVE-2026-39808 and has been rated critical with a CVSS score of 9.1.
• CVE-2026-39813: An API privilege escalation vulnerability exists due to a path traversal flaw. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted HTTP requests to the JRPC API. Successful exploitation may allow an attacker to bypass authentication and escalate privileges on the system. This vulnerability has been designated CVE-2026-39813 and has been rated critical with a CVSS score of 9.1.

The following versions are affected:

• FortiSandbox 4.4: Versions 4.4.0 through 4.4.8 (affected by both CVEs)
• FortiSandbox 5.0: Versions 5.0.0 through 5.0.5 (affected by CVE-2026-39813 only)

What is Fortinet FortiSandbox?

Fortinet FortiSandbox is a security appliance that identifies unknown threats by executing suspicious files in isolated virtual environments to monitor their behavior and then automates a response by sharing that intelligence across the network to block the detected threat.

What is the impact?

Successful exploitation of these vulnerabilities would allow an attacker to gain unauthorized API access, enabling them to escalate privileges and execute code or commands on the vulnerable host.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions:

• FortiSandbox 4.4: Upgrade to 4.4.9 or later
• FortiSandbox 5.0: Upgrade to 5.0.6 or later

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

os:="Fortinet FortiSandbox%"

Threat actors thrive on these assumptions.

But runZero makes zero assumptions. We discover, validate, and map the potential attack paths for you.

With the release of runZero 4.9, two powerhouse capabilities combine to eliminate this critical visibility gap and reveal exactly how attackers will exploit your network, so you can prevent it.

Understand the entire iceberg, not just the tip

Using safe, protocol-native queries, runZero recursively walks the backplane to identify the many hidden sub-devices sitting behind Modbus and BACnet gateways. Where traditional tools see only a single gateway IP address, runZero unveils the entire field-level topology of vulnerable PLCs and nested devices downstream of the gateway. Not only do we discover these critical, hidden devices, we fingerprint their attributes and any exposures. Like a ship's sonar that shows the entire iceberg lurking under the waterline, runZero dives deep behind the gateway to see the entire attack surface.

Since OT environments behind the gateway are usually flat, an attack on one of these hidden assets represents a massive lateral movement risk. Compromising a single downstream PLC can grant an adversary control over the physical outputs — the switches that manage everything from safety valves to high-voltage equipment.

So, seeing these devices and reducing their vulnerability is only the first step. The next critical step is validating how accessible (or not) they really are to a threat actor.

See the path of least resistance for attackers

After deep discovery, runZero leaves assumptions behind by showing you how an attacker could reach those devices, externally or internally. Interactive attack path mapping illuminates avenues of attack that most security professionals may never discover. It models the complex trajectories an adversary would use, exposing the "accidental routes" and multi-homed devices (like jump boxes) that bypass your carefully planned segmentation.

Other vulnerability scanners miss these risks since they are focused only on known vulnerabilities. runZero shows you these paths of least resistance, allowing defenders to focus on the critical exposures and assets that pose the most devastating risk.

The Payoff

Together, these capabilities completely transform your defensive strategy. Without runZero, you have incomplete visibility plus untested assumptions of your network segmentation. But with runZero, you’ve got complete and automatic discovery, plus attack path mapping that trades assumptions for validation. With runZero, you can map the unmappable, secure every path, and safeguard your OT environments.

Start your free 21 day trial and begin your own discovery now.

Researchers disclosed that certain versions of Ollama are susceptible to a heap out-of-bounds read vulnerability within the GGUF model loader. A remote, unauthenticated attacker could exploit this by sending a specially crafted GGUF file to the /api/create endpoint. When the server processes a GGUF file where the declared tensor offset and size exceed the file's actual length, the functions in fs/ggml/gguf.go and server/quantization.go (WriteTo()) read past the allocated heap buffer during the quantization process.

The resulting memory leak may expose sensitive information, including environment variables, API keys, system prompts, and concurrent user conversation data. This data can then be exfiltrated by uploading the resulting model artifact to an attacker-controlled registry via the /api/push endpoint. In the upstream distribution, the /api/create and /api/push endpoints lack authentication. While default deployments bind to 127.0.0.1, the documented OLLAMA_HOST=0.0.0.0 configuration is common in practice, leading to significant public Internet exposure. This vulnerability has been designated CVE-2026-7482, also known as Bleeding Llama, and has been rated critical with a CVSS score of 9.1.

The following versions are affected:

• Ollama: Versions prior to 0.17.1

What is Ollama?

Ollama is an open-source framework designed for the local deployment, management, and execution of large language models (LLMs) on personal computing hardware.

What is the impact?

Successful exploitation of this vulnerability could expose sensitive information, including environment variables, API keys, system prompts, and concurrent user conversation data.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

• Ollama: Upgrade to 0.17.1 or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Ollama AND product:=Ollama AND source:runzero

Google disclosed that certain Android versions are susceptible to an authentication bypass vulnerability within the wireless ADB mutual authentication process. This is due to a logic error in the adbd_tls_verify_cert function of the auth.cpp subcomponent in the ADB daemon (adbd). An unauthenticated attacker with adjacent network access can exploit this flaw to achieve remote code execution (RCE) as the shell user. This exploit requires no additional privileges and no user interaction. This vulnerability has been designated CVE-2026-0073 and has been rated high with a CVSS score of 8.8.

The following versions are affected:

• Android 14: Prior to the 2026-05-01 security patch level.
• Android 15: Prior to the 2026-05-01 security patch level.
• Android 16: Prior to the 2026-05-01 security patch level.
• Android 16-qpr2: Prior to the 2026-05-01 security patch level.

What is Android Wireless Android Debug Bridge (ADB)?

Android Wireless Android Debug Bridge (ADB) is a communication feature that enables remote shell command execution, application installation, and system debugging over a local Wi-Fi network using the TCP/IP protocol, removing the need for a physical USB connection.

What is the impact?

Successful exploitation of the vulnerabilities allows an unauthenticated attacker with adjacent network access to achieve remote code execution (RCE) as the shell user.

Are updates or workarounds available?

Upgrade affected systems to the 2026-05-01 security patch level or later.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

protocol:=adb AND os:Android

Progress Software has disclosed that certain versions of MOVEit Automation are susceptible to two vulnerabilities within the service backend command port interfaces.

• CVE-2026-4670: An authentication bypass vulnerability that allows a remote, unauthenticated attacker to gain unauthorized access to the system. This vulnerability has been designated CVE-2026-4670 and has been rated critical with a CVSS score of 9.8.
• CVE-2026-5174: An improper input validation vulnerability that allows a remote, low-privileged attacker to elevate their privileges. This vulnerability has been designated CVE-2026-5174 and has been rated high with a CVSS score of 7.7.

The following versions are affected:

• MOVEit Automation: Version 2024.1.7 (16.1.7) and prior
• MOVEit Automation: Version 2025.0.8 (17.0.8) and prior
• MOVEit Automation: Version 2025.1.4 (17.1.4) and prior (Affected by CVE-2026-5174 only)

What is Progress MOVEit Automation?

Progress MOVEit Automation is a managed file transfer (MFT) orchestration tool used to automate the scheduled or event-driven movement and processing of data between disparate servers, cloud storage environments, and applications via a centralized management interface.

What is the impact?

Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access, obtain administrative control, or expose sensitive data.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

• MOVEit Automation 2024.x.x and prior: Upgrade to 2024.1.8 or later.
• MOVEit Automation 2025.0.x: Upgrade to 2025.0.9 or later.
• MOVEit Automation 2025.1.x: Upgrade to 2025.1.5 or later.

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially impacted assets:

_asset.protocol:http AND protocol:http AND (html.title:="MOVEit Automation%" OR last.html.title:="MOVEit Automation%")

Apache disclosed that certain versions of Apache HTTP Server are affected by a double free vulnerability that may lead to remote code execution (RCE). This flaw occurs within the HTTP/2 protocol implementation when a stream undergoes an "early reset." While further technical details are not publicly available at this time, the vulnerability involves a memory management error triggered during specific HTTP/2 communication sequences. The vulnerability, designated CVE-2026-23918, is rated high with a base CVSS score of 8.8.

The following versions are affected

• Apache HTTP Server: Version 2.4.66

What is Apache HTTP Server?

Apache HTTP Server is an open-source, cross-platform application that serves web content by processing requests via the Hypertext Transfer Protocol (HTTP).

What is the impact?

Successful exploitation of the vulnerability could allow a low-privileged remote attacker to execute arbitrary code on the affected system.

Are updates or workarounds available?

Upgrade affected systems to the new versions

• Apache HTTP Server: Version 2.4.67

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Apache AND product:=HTTPD AND version:>0 AND version:=2.4.66

October 2021: CVE-2021-41773

The Apache Software Foundation recently announced a path traversal vulnerability present in version 2.4.49 of the Apache HTTP Server software. Due to insufficient coverage of potential path traversal characters in the URL, an unauthenticated attacker can read files outside of the document root and even execute system commands in some configurations. While this vulnerability (CVE-2021-41773) only affects version 2.4.49 (and 2.4.50 as a variant), it was exploited in the wild to Apache publishing their security advisory.

Update: The 2.4.50 fix was incomplete and we strongly recommend upgrading to 2.4.51 or newer.

How to find potentially vulnerable Apache HTTP Servers

From the Service Inventory, use the following pre-built query to locate vulnerable Apache HTTP Server instances in your network:

product:"apache httpd" AND protocol:http AND (http.head.server:"Apache/2.4.49" OR http.head.server:"Apache/2.4.50")

As always, any prebuilt queries we create are available from our Queries Library. Check out the library for other useful inventory queries.

Try runZero

Don't have runZero and need help finding your Apache HTTP Server instances? Start your trial today.

cPanel disclosed that certain versions of cPanel & WHM are affected by a critical login authentication vulnerability. While public details are currently limited, the changelogs for the affected versions cite a fix for an issue regarding session loading and saving (CPANEL-52908), released on April 28, 2026. This vulnerability does not currently have a CVE ID assigned.

Update (April 29, 2026): New details identify this as an authentication bypass vulnerability in the login flow, enabling remote, unauthenticated attackers to gain unauthorized access to the control panel. This vulnerability has been designated CVE-2026-41940 and has been rated critical with a CVSS score of 9.8.

Update (April 30, 2026): There is evidence that this vulnerability is being actively exploited in the wild.

The following versions are affected:

• cPanel & WHM 110.0.x: Versions prior to 110.0.97 (11.110.0.97)
• cPanel & WHM 118.0.x: Versions prior to 118.0.63 (11.118.0.63)
• cPanel & WHM 126.0.x: Versions prior to 126.0.54 (11.126.0.54)
• cPanel & WHM 132.0.x: Versions prior to 132.0.29 (11.132.0.29)
• cPanel & WHM 134.0.x: Versions prior to 134.0.20 (11.134.0.20)
• cPanel & WHM 136.0.x: Versions prior to 136.0.5 (11.136.0.5)

Note: Servers running end-of-life or unsupported versions are also likely affected. It is strongly recommended that you upgrade your server to a supported, patched version immediately.

What are cPanel & WHM?

cPanel & WHM comprises two primary components: WebHost Manager (WHM), the administrative interface for server-level infrastructure, and cPanel, the user-facing control panel for managing individual hosting accounts.

What is the impact?

Successful exploitation of this vulnerability could allow an adversary to gain unauthorized access to affected servers.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

• cPanel & WHM 110.0.x: 110.0.97 (11.110.0.97) or later.
• cPanel & WHM 118.0.x: 118.0.63 (11.118.0.63) or later.
• cPanel & WHM 126.0.x: 126.0.54 (11.126.0.54) or later.
• cPanel & WHM 132.0.x: 132.0.29 (11.132.0.29) or later.
• cPanel & WHM 134.0.x: 134.0.20 (11.134.0.20) or later.
• cPanel & WHM 136.0.x: 136.0.5 (11.136.0.5) or later.
• Unsupported Versions: Upgrade to one of the supported versions detailed above.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=cPanel AND (product:=cPanel OR product:=WHM)

On April 24, 2026, researchers publicly disclosed an audit identifying 89 exploitable vulnerabilities. These issues primarily involve missing input validation across all writable Map(String,String) fields within eight XAPI object types. Consequently, an attacker with the vm-admin management role could theoretically "achieve full host filesystem read/write [access]" and execute "cross-VM data exfiltration" or "pool-wide compromise." The report claims these actions are possible through "single API calls with no exploit code," requiring neither a root shell nor triggering security alerts. These vulnerabilities reportedly persisted since the inception of the XAPI codebase (circa 2006). The researchers assigned a CVSS distribution of 5 critical, 28 high, 46 medium, and 10 low, stating that all versions of Citrix XenServer / Hypervisor, XCP-ng, and XAPI-based distributions were affected.

On April 28, 2026, the Xen Project (upstream) and XCP-ng (downstream) released advisories addressing these claims. The Xen Project issued technical advisories XSA-483 through XSA-489 to address the core source code. Notably, XSA-489 serves as a direct rebuttal to the April 24 audit, concluding that only five of the 89 claims were actionable. The remainder were identified as intended Role-Based Access Control (RBAC) functionality or, in several instances, appeared to be "AI hallucinations" within the researcher's report. Simultaneously, XCP-ng published a blog providing specific security and maintenance updates focused on the practical impact on XCP-ng environments.

The following vulnerabilities have been confirmed by the vendors:

• CVE-2026-23556 (VSA-2026-007, XSA-483): A flaw where oxenstored keeps quota-related use counts across domain destruction. XCP-ng notes this could allow a privileged user in a guest domain to trigger a denial-of-service (DoS) condition by preventing other domains from starting; the XCP-ng advisory classifies this impact as critical.
• CVE-2026-23557 (XSA-484): A denial-of-service (DoS) vulnerability via the XS_RESET_WATCHES command in xenstored.
• CVE-2026-31786 (XSA-485): A Linux kernel out-of-bounds read via a Xen-related sysfs file, potentially leaking sensitive information.
• CVE-2026-23558 (VSA-2026-008, XSA-486): A race condition in grant table v2 status page mapping. XCP-ng notes this use-after-free (UAF) flaw could allow a privileged user in a HVM or PVH guest domain to escalate their privileges to the hypervisor level; the XCP-ng advisory classifies this impact as critical.
• CVE-2026-31787 (XSA-487): A Linux kernel double-free in the Xen privcmd driver; as it requires root privileges, the Xen Project considers the crash potential not security-relevant.
• CVE-2025-54505 (VSA-2026-010, XSA-488): Addresses "Floating Point Divider State Sampling" on certain AMD CPUs. While not a XCP-ng software vulnerability, this update mitigates a hardware issue to prevent a guest VM from inferring data from another VM; the XCP-ng advisory classifies this impact as moderate.
• XAPI RBAC Escalation (VSA-2026-011, XSA-489): This advisory confirms five actionable vulnerabilities: CVE-2026-23559, CVE-2026-23560, CVE-2026-23561, CVE-2026-23562, and CVE-2026-42486. While the first three may allow vm-admin role users to escalate to root privileges in the control domain, the flaw relies on advanced RBAC features not typically exposed in standard management tools or documentation; the XCP-ng advisory classifies this impact as low. This would only impact users with a specific configuration involving an XCP-ng pool using Active Directory for user management where the managed user has the XAPI role vm-admin.
  

Note: Current advisories suggest that Xen Project vulnerabilities CVE-2026-23557, CVE-2026-31786, CVE-2026-31787, CVE-2026-23562, and CVE-2026-42486 have not yet been addressed specifically by XCP-ng updates.

The following versions are affected:

• XCP-ng: Version 8.3

Note: XCP-ng 8.3 LTS is currently the only release not marked end-of-life (EOL). Therefore, older versions are likely susceptible to these vulnerabilities but fall outside the scope of current security patching and support.

What is XCP-ng?

XCP-ng (Xen Cloud Platform - next generation) is a bare-metal hypervisor based on the open-source Xen project that enables multiple virtual machines to run concurrently on a single physical server.

What is the impact?

Successful exploitation of the vulnerabilities allows a remote, authenticated attacker to gain unauthorized host filesystem control and breach VM isolation boundaries.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

• XCP-ng 8.3: Upgrade to package xen-4.17.6-6.2.xcpng8.3 or later.
• XCP-ng 8.2 and prior: These versions are EOL. Users should evaluate environmental risk and migrate to a supported release.

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially impacted assets:

_asset.protocol:http AND protocol:http AND (html.title:="Welcome to XCP-ng%" OR html.title:="XO Lite")

For years, the industry has relied on the "segmentation illusion"— the comfortable but incorrect assumption that critical industrial assets are air-gapped or safely tucked away behind layers of firewalls. Today, the threat landscape is rapidly evolving due to geopolitical dynamics and AI-powered attacks that are designed to quickly identify segmentation weaknesses, along with other common footholds like internet-exposed OT assets, unpatchable legacy systems, and untrustworthy IT/OT boundaries that turn a minor business breach into a total operational shutdown.

Our latest release is designed to give defenders the high-fidelity asset, network, and security intelligence they need to win in this environment. With the new features in runZero 4.9, you can see exactly how an attacker could move through your network via a series of pivot points, allowing you to harden critical choke points and remediate exposures before they are exploited. We’ve also expanded our OT telemetry to provide deep insights into the role and risk profile of every device in increasingly converged environments.

Here's a quick demo of the new features, or keep reading to learn more:

Map the unmappable. Secure every path.

Most OT practitioners have been taught that active scanning is dangerous. We’ve already proven that’s a myth in numerous deployments and in robust testing conducted by the U.S. Department of Energy’s National Renewable Energy Laboratory. runZero’s scan engine is purpose-built for safety. By using safe, protocol-specific probes and granular throttling, we extract high-fidelity metadata — firmware versions, screenshots, and even secondary interfaces — without requiring a single credential or endpoint agent.

One of the breakthroughs in this release is our ability to map the unmappable. We are one of the only solutions that can now enumerate "sub-assets" sitting behind protocol gateways like Modbus, BACnet, KNXnet, and EtherNet/IP. If you have a gateway with 20 PLCs behind it, we don't just see the gateway; we see the entire field-level topology.

Other capabilities that runZero’s latest release brings to the fight, include:

Topology maps that actually scale (and are fun to explore!)

Our new 2D and 3D maps let you zoom from a global overview all the way down to individual sites and subnets, enabling you to quickly spot exposures even in environments with hundreds of thousands of assets. No more untangling the network spaghetti; these maps provide clear visuals that make sense of even the most complex environments. With hybrid Layer 2 and Layer 3 views, you can finally see how your physical and logical networks actually overlap. Other new features include the ability to:

• Geolocate assets instantly: We use public and egress IP data to pinpoint where your gear is physically sitting across the globe and have added tools so you can search for nearby devices to gain critical environmental context.

• Hunt and search in the map views: Get eyes on high-risk assets, pivot points, end-of-life systems, specific device types, and exposures by searching and filtering directly in the map view.

• Spot the "weird": Quickly flag anomalies, like a misplaced Windows laptop sitting in a segmented production zone where it definitely doesn't belong, as well as outliers that don’t look like the others (pro tip: this usually means they’re risky devices).

Interactive attack path mapping

Want to know how an attacker would move around your network? You can now visualize trajectories from initial compromise to operational impact.

• Trace the attack path: Set a source and a target to see the exact pivot points and bridges an attacker would use to traverse your environment.

• Find the choke points: See which critical assets could grant attackers access to your crown jewels.

Multi-homed and bridge detection

Automatically surface devices connected to multiple networks and bypass your carefully planned segmentation and firewall strategies.

Go beyond the gateway

Other tools stop at the protocol gateway. We don’t. runZero uses safe, protocol-native queries to peer behind gateways and unmask the downstream PLCs and field-level devices sitting on serial and fieldbus networks.

Unmask protocol exposures

Gain asset intelligence across your entire attack surface with an expanded library of 220+ protocols. This release delivers deep visibility into dozens of "insecure by design" industrial protocols — like Modbus, BACnet, EtherNet/IP, and Siemens S7comm — which are commonly targeted by attackers attempting to pivot from the network to physical operations.

Real-world risk prioritization

Not every exposure is a hair-on-fire emergency. We help you focus on the segmentation gaps and vulnerabilities that actually put your operations at risk.

Device classification and even-deeper fingerprinting

We analyze thousands of distinct asset attributes to ensure you have definitive insights into exactly what a device is and what it’s doing on your network. The latest release adds asset categorization and function tags that you can use to search, filter, and explore.

Sleek UI/UX enhancements — now with new dark and light modes

We’ve overhauled the interface to make data exploration faster and easier across any sized environment, even the massive ones. And yes, we finally added dark mode, because we know what it’s like to stare at a screen in a dimly lit SOC at 2am — plus, it just looks cool. If you prefer the high-contrast life, there’s a new light mode, too. Or, stick with the "classic" view — whatever helps you hunt best!

Real-world scenario: IT-origin with OT blast radius

To illustrate the power of this release, let's look at a scenario to see how our new capabilities turn raw telemetry into a defensive strategy.

The biggest threat to industrial operations usually isn't a "Stuxnet-style" custom exploit; it’s an IT-originated event that cascades into OT because the boundary between the two is weak. In this case, the culprit isn't a complex hack — it’s a single, forgotten workstation that shatters the "segmentation illusion" and turns a network breach into a total factory floor shutdown.

The dangerous, but intentional "administrative" bridge

Imagine an attacker gaining a foothold in the corporate IT network through a security camera using default credentials (yes, we can help you find that). These cameras are oftentimes inside the network, but out-of-the-box settings tell firewalls to port forward internet traffic to them, exposing them to the world.

While searching for high-value targets, the attacker discovers a technician’s laptop on the same wireless network as the camera. This laptop is plugged into the factory network — but for internet access, the technician is still using the corporate wireless network, and unfortunately has also enabled RDP.

The attacker is able to log in to this laptop with the default technician account, and the laptop becomes the first hop from the internet-exposed camera to the factory LAN, bypassing the main firewall.

From the compromised laptop, the attacker is able to reach the factory LAN, and although the network is mostly segmented correctly, a sole Rockwell Automation controller is attached.

The attacker is able to enumerate the Ethernet/IP (CIP) of the controller and identify additional targets accessible through the protocol gateway, providing full access to RTUs without credentials

By sending an unauthorized "Stop" command through the gateway to the RTU, the attacker shuts down every downstream PLC — halting a $100M production line and disrupting a series of robotic arms and equipment.

The defender’s edge

But never fear, defenders. runZero’s new capabilities would help you thwart this attack:

• Visualize the trajectory: Our new attack path mapping highlights the exact route from the corporate network, through the laptop, and into the production subnet.

• Identify the choke point: runZero flags the laptop running RDP as high risk, showing you precisely where your security policy has been bypassed.

• See the downstream impact: While the attacker only sees a gateway, runZero’s sub-asset discovery peers behind it to reveal the PLCs controlling the robotic arms and production line equipment. By querying the gateway via specialized industrial protocols like CIP or Modbus, runZero unmasks the field-level devices that were previously invisible to the security team.

Why it matters

This isn't just a hypothetical "worst-case" scenario — it is a statistical reality. In a recent representative sample of large manufacturing environments, runZero found that 30% of all OT assets are only one hop away from an internet-exposed device, and 90% are within just two hops.

These findings highlight how easily a single forgotten workstation can turn a minor IT breach into a catastrophic operational shutdown. Even in "secure" networks, segmentation is frequently bypassed — often intentionally — to make remote maintenance easier for vendors or technicians.

By surfacing these risky assets and identifying the hidden attack paths they create, runZero enables you to move beyond the "segmentation illusion," harden your boundaries, and ensure your air gap is a reality, not just an assumption.

In-depth intelligence built for converged environments

Whether you are managing a national telecom, a global manufacturer, or a critical utility, runZero provides the unified source of truth needed to bridge the gap between IT and OT security operations. We don't just find your assets; we visualize reachability and highlight true risk. Because in a world of millions of nodes, the only one that matters is the one an attacker can exploit.

How to get started with runZero

Try the Platform: Interested in seeing runZero in action? You can explore the platform for free for 21 days, and following your trial, you can transition to our free Community Edition (for environments with fewer than 100 assets).

Learn More: Explore our platform and resources for more information about runZero.

The Xen Project (upstream) and Citrix (downstream) released separate but related advisories to address these claims. The Xen Project issued technical advisories XSA-483 through XSA-489 to address the core source code. Notably, XSA-489 serves as a direct rebuttal to the April 24 audit, concluding that only five of the 89 claims were actionable. The remainder were identified as intended RBAC functionality or, in several instances, appeared to be "AI hallucinations" within the researcher's report. Simultaneously, Citrix released Security Bulletin CTX696527 to provide specific updates and hotfixes for commercial users, focusing on the practical impact to the XenServer environments.

The following vulnerabilities have been confirmed by the vendors:

• CVE-2026-23556 (XSA-483): A flaw where oxenstored keeps quota-related use counts across domain destruction. Citrix notes this could allow a privileged user in a guest VM to cause the host to crash or become unresponsive.
• CVE-2026-23557 (XSA-484): A Denial of Service (DoS) vulnerability via the XS_RESET_WATCHES command in xenstored.
• CVE-2026-31786 (XSA-485): A Linux kernel out-of-bounds read via a Xen-related sysfs file, potentially leaking sensitive information.
• CVE-2026-23558 (XSA-486): A race condition in grant table v2 status page mapping. Citrix notes this could allow a privileged user in a guest VM to compromise the host under specific circumstances.
• CVE-2026-31787 (XSA-487): A Linux kernel double-free in the Xen privcmd driver; as it requires root privileges, the Xen Project considers the crash potential not security-relevant.
• CVE-2025-54505 (XSA-488): Addresses "Floating Point Divider State Sampling" on certain AMD CPUs. While not a XenServer software vulnerability, this update mitigates a hardware issue to prevent a guest VM from inferring data from a different VM.
• XAPI RBAC Escalation (XSA-489): This advisory confirms five actionable vulnerabilities: CVE-2026-23559, CVE-2026-23560, CVE-2026-23561, CVE-2026-23562, and CVE-2026-42486. Citrix warns that the first three in particular may allow host administrators to gain access beyond the limits of their assigned RBAC role.

Note: Current advisories suggest that Xen Project vulnerabilities CVE-2026-23557, CVE-2026-31786, CVE-2026-31787, CVE-2026-23562, and CVE-2026-42486 have not yet been addressed specifically by Citrix updates.

The following versions of Citrix Hypervisor / XenServer are affected:

• Citrix XenServer version 8.4

Note: Citrix XenServer 9.x is currently in Public Preview and not covered by standard security bulletins; as such, it may be affected by these issues.

Initial Advisory (April 24, 2026)

On April 24, 2026, researchers publicly disclosed an audit identifying 89 exploitable vulnerabilities. These issues primarily involve missing input validation across all writable Map(String,String) fields within eight XAPI object types. Consequently, an attacker with the vm-admin management role "can achieve full host filesystem read/write [access], cross-VM data exfiltration, storage protocol injection, cross-hypervisor lateral movement, and pool-wide compromise through single API calls with no exploit code, no root shell, and no security alerts." These vulnerabilities have persisted since the inception of the XAPI codebase (circa 2006). The researchers assigned the following CVSS severity distribution: 5 critical, 28 high, 46 medium, and 10 low. These vulnerabilities do not currently have CVE IDs assigned.

What is Citrix XenServer?

Citrix XenServer, formerly known as Citrix Hypervisor, is a bare-metal hypervisor based on the open-source Xen project that enables multiple virtual machines to run concurrently on a single physical server.

What is the impact?

Successful exploitation of the vulnerabilities allows a remote, authenticated attacker to gain unauthorized host filesystem control and breach VM isolation boundaries.

Are updates or workarounds available?

For Citrix XenServer versions 8.4 and prior, the vendor recommends updating to the latest version of Citrix XenServer via the Early Access or Normal update channels.

Note: Citrix XenServer versions 9.x are Public Preview releases and do not receive security bulletins; therefore, users should evaluate their environment's risk and consider migrating to a stable, supported release.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

os:="Citrix XenServer"

September 2024: CVE-2024-45817

Citrix released a security update to address vulnerabilities in their XenServer and Hypervisor virtualization products.

Citrix outlines that the following affects both XenServer 8 and Citrix Hypervisor 8.2 CU1 LTSR and could allow a malicious administrator of a guest VM to cause the host to crash or become unresponsive.

• CVE-2024-45817 has not been rated, but affects how the state of the system could end up in deadlock due to a recursive call guarded by a mutex on x86's APIC (Advanced Programmable Interrupt Controller) architecture when reporting errors to a status.

• CVE-2022-24805 is not rated, but affects net-snmp and allows for a classic buffer overflow.
• CVE-2022-24809 is not rated, but affects net-snmp and allows for a NULL pointer dereference.

Both of these can be triggered by a user with read-only credentials.

What is the impact?

The vulnerabilities may all be triggered by guest or read-only credentials which increases the likelihood of them occurring.

Are updates or workarounds available?

Citrix recommends limiting access to management interfaces as well as upgrading to one of the following versions:

• XenServer 8
• Citrix Hypervisor 8.2 CU1 LTSR

How do I find potentially vulnerable systems with runZero?

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

(product:citrix and type:hypervisor) or product:xenserver

GitHub disclosed that certain versions of GitHub Enterprise Server (GHES) are affected by a remote code execution (RCE) vulnerability due to improper neutralization of special elements. Successful exploitation could allow an authenticated, low-privileged user with push access to any repository, including one they created themselves, to achieve arbitrary command execution on the GitHub server via a single git push using crafted push option values containing an unsanitized delimiter character. This vulnerability has been designated CVE-2026-3854 and has been rated high with a CVSS score of 8.7.

The following versions are affected:

• GHES 3.14.x: Versions prior to 3.14.25
• GHES 3.15.x: Versions prior to 3.15.20
• GHES 3.16.x: Versions prior to 3.16.16
• GHES 3.17.x: Versions prior to 3.17.13
• GHES 3.18.x: Versions prior to 3.18.7
• GHES 3.19.x: Versions prior to 3.19.4

What is GitHub Enterprise Server?

GitHub Enterprise Server is a self-hosted version of GitHub that allows organizations to run an isolated instance of the platform on their own physical or virtual infrastructure, independent of external cloud services.

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

• GHES 3.14.x: Upgrade to 3.14.25 or later.
• GHES 3.15.x: Upgrade to 3.15.20 or later.
• GHES 3.16.x: Upgrade to 3.16.16 or later.
• GHES 3.17.x: Upgrade to 3.17.13 or later.
• GHES 3.18.x: Upgrade to 3.18.7 or later.
• GHES 3.19.x: Upgrade to 3.19.4 or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=GitHub AND product:="Enterprise%"

CrowdStrike disclosed that certain versions of self-hosted LogScale are susceptible to an unauthenticated path traversal vulnerability. A remote, unauthenticated attacker could exploit a specific, exposed cluster API endpoint to read arbitrary files from the server filesystem. This vulnerability has been designated CVE-2026-40050 and has been rated critical with a CVSS score of 9.1. This vulnerability does not affect Next-Gen SIEM customers.

The following versions are affected:

• LogScale Self-Hosted (GA): Versions 1.224.0 through 1.234.0 (inclusive)
• LogScale Self-Hosted (LTS): Version 1.228.0 and 1.228.1

What is CrowdStrike Falcon LogScale?

CrowdStrike Falcon LogScale (formerly Humio) is a log management and observability platform that ingests, stores, and enables real-time search of large-volume streaming data using an index-free architecture.

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to read arbitrary files on the vulnerable host.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

• LogScale 1.228.x: Upgrade to 1.228.2 (LTS) or later.
• LogScale 1.224.0 through 1.234.0: Upgrade to 1.233.1, 1.234.1, 1.235.1, or later.

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially impacted assets:

_asset.protocol:http AND protocol:http AND (http.head.server:="Humio-%" OR last.http.head.server:="Humio-%")

Just to catch you up: VulnCon is an annual symposium organized jointly by FIRST (the Forum of Incident Responders and Security Teams) and the CVE program. We just wrapped up the third year of this event, and it’s already pretty well-established globally as THE place to be for several hundred government and industry practitioners from all over the world who share my penchant for vulnerability-gazing.

As with previous years, VulnCon featured lectures and workshops all about the twisty little passages where vulnerability discovery, dissemination, and defense intersect, all with an aim of helping each other and our many diverse cybersecurity and information security communities deal with the inevitability of shipping software bugs.

AI isn’t pronounced “Aiiiii!”

While VulnCon is very, very niche compared to broader expos and conferences like RSAC, InfoSec Europe, and Black Hat, we could not escape the general tech industry’s infatuation with AI. Approximately 2^32-1 words have already been written on the predicted impact of Anthropic’s Claude Mythos and Glasswing, ranging from total panic to blaisé indifference. I’m here to report that the general attitude of attendees – who are, across the board, established experts in their security specialties – is, truly, cautiously optimistic in a very middle-path sort of way. I got the sense that we are agreed that AI tooling has graduated from speculative, to novel, to quite nearly normal in many vulnerability research pipelines, and network defenders who haven’t started implementing some kind of AI assistance in live incident response are likely going to have a bad time in the back half of 2026 and beyond.

The optimistic part of this take is that we can use the same kinds of AI tooling to rapidly catch up and keep pace with the relentless rate of vulnerability discovery. After all, AI doesn’t merely play offense or defense – it’s truly dual-use (if not pan-use, if that’s a word). General purpose large language models (LLMs) already are doing a much, much better job of uncovering and validating technical vulnerabilities, insecure defaults, and misconfigurations than they were even two years ago.

Even if nothing changes in the way the AI superpowers develop and grow AI capabilities, all of us squishy-brained, biochemical decision makers can use much of the same tooling to catch up and manage the ever-increasing march of individual vulnerabilities, up and down the defensive stack—from building the next generation of tools defenders need for assessment and visibility to integrated, orchestrated incident response when breaches do occur.

We’re all in this together

The conference struck me as a very “we’re all on the same side here” kind of affair, permeating most conversations I was fortunate to be involved in. Notably, we heard from, and got to spend considerable quality time with, our friends and colleagues in government, both domestically and internationally.

Probably the most significant programming choice was that the kick-off address was a joint presentation from CISA and ENISA. These are two great agencies that agent great together, and when it comes to managing and improving the CVE program (the world isn’t ready to just give up on a quarter century of lessons learned). So, while it’s clear that the last year has been pretty rocky in CVE-land, we definitely don’t want a return to the bad old days of regional or industry specific grab bags of unconnected, disparate databases of technical vulnerability intelligence.

On the other end of the spectrum, the update from the National Vulnerability Database (better known as the NVD) was reported pretty bleakly, as the National Institute of Science and Technology (NIST) continues to struggle with annotating every new CVE. Instead, the NVD has committed to a new prioritization scheme. Of course, we all want to know what CVEs are actually worth knowing about, but the critical (and dare I say, cynical) read is that NVD just keeps losing ground here.

However, I don’t think this winnowing down of the CVE target space is as disastrous as it’s being reported as. After all, I’m pretty happy with how CISA’s Vulnrichment platform and program has been chugging along, bringing much-needed enrichment and transparency to vulnerabilities. In my opinion, Vulnrichment has already mostly supplanted NIST’s efforts, at least when it comes to first-pass risk-ratings when vendors and CNAs don’t step up. In fact, KEVology (to pick a totally random and not-at-all self-serving example) relies on and normalizes around Vulnrichment quite a bit, and I suspect most downstream consumers of broad CVE data are in the same boat.

In the end, getting CVE aligned with this brave new world of supercharged rates of vulnerability disclosure certainly won’t happen by accident, and there’s no one weird trick to fix what’s broken about CVE assignment and management. This will all require real work, beyond mere wishing and talking, but I’m confident that we can rise to the challenge. As a CVE board member, I can promise that I’ll do what I can to make sure that we don’t lose the plot here.

See for yourself

Almost all of the presentations were live streamed and recorded, so I’m very much looking forward to catching some of the talks that were tough to choose between on VulnCon’s three-track agenda. I’ll update this space when those recordings are available, and I’ll bug the organizers to pull that trigger sooner rather than later. There was a ton of good content this year, so I’m excited to share it with runZero’s blog fans.

Next year, VulnCon will take place the immediate week before BSidesSF and RSAC, which hopefully will make international attendance even easier to justify; come for the real vuln talk in Arizona, stay for the ridiculously overproduced expo booth antics one state over in California.

The remaining principles (numbers five through eight) in the guidance detail how OT system owners can set themselves up for success against adversaries, including recommendations for preventing breaches and detecting them if they occur. The final four principles are pivotal for system owners to get right.

Principle 5: Harden your OT boundary

Many OT systems are difficult to update or replace, increasing the prevalence of obsolete assets and weak security controls. Because of this inability to modernize, oftentimes the primary defense against external threats to OT systems is their network boundary. As such, organizations should invest in modern, modular, and easily replaceable boundary protections. Additionally, the guidance suggests a robust checklist of actions to help harden your OT boundary:

• Change default passwords

  • Default credentials provide an easy-to-fix and easy-to-exploit avenue for attackers to gain initial access.

• Enforce the principle of least privilege

  • Human-to-machine and machine-to-machine connectivity should follow the concept of least privilege, following joiners, movers, leavers (JML) processes to ensure proper access rights throughout user lifecycles.

• Restrict unused services and ports

  • Only required ports and protocols should be exposed on assets.

• Implement phishing-resistant multi-factor authentication (MFA) for external services

  • Phish-resistant MFA should be implemented where possible for human-to-machine connectivity.

• Use context-aware access

  • Where possible, controls should be enabled that enforce connectivity based on attributes of the connection, like device location, time of access, or OS version.

• Enforce security requirements on third parties

  • Controls should be applied to third-party connections into the OT environment. NCSC’s previous guidance provides more details about this in principle five.

• Enforce unidirectional traffic flows

• Where possible, organizations should use Cross Domain Solutions and Data Diodes to help facilitate secure data transfers between untrusted and trusted domains.

As the convergence between OT and IT progresses, implementing principle five is critical for OT system owners in order to define and harden the boundary between OT and IT in their environments.

Principle 6: Limit the impact of compromise

There is a saying that goes, “You should be prepared for WHEN you get breached, not IF.” Organizations should take steps to limit the impact of a breach before it happens. OT systems owners need to focus on two risks:

• Contamination

  • Contamination refers to malicious or insecure code that makes its way into a trusted environment, often through the abuse of weak configurations, bad implementation, or vulnerable products.

• Lateral movement

  • Lateral movement describes how attackers expand their reach to neighboring nodes after initial access. Lateral movement can involve scanning, compromising hosts with stolen credentials, escalating privileges to gain access to systems, and more. Lateral movement should be seen as a threat both from external attackers and from insider and third-party threats.

Strategies for OT (and all) system owners to protect their environments include:

• Segmentation

  • Organizations should segment their networks behind firewalls or network architecture, dividing the network into smaller, functionally isolated networks, to reduce risk.

  • Microsegmentation: Microsegmentation applies controls on a much more granular level, usually at the host level, to restrict services, protocols, or specific clients from communicating.

  • Separation of duties: Separation of duties ensures that no one person has the ‘keys to the kingdom’. If you divide the responsibilities of individuals or systems within the environment, it limits exposure in the event of a breach or an insider threat.

• The browse down principle

  • The browse down principle states that you should trust the device on which administrative work is done as much as, or more than, the system you are managing. In essence, you don't want to manage a trusted system with an untrusted device.

• Boundary controls
  • Principle five discusses ways for organizations to harden their boundary, and principle six provides additional recommendations:

    • Host-based Controls

    • Static network controls

    • Dynamic network controls

    • Threat detection and response.

The best time for OT system owners to plan for a breach was yesterday, and the second-best time is today. OT system owners need to take proper precautions now to ensure that when, not if, a breach occurs, they are ready.

Principle 7: Ensure all connectivity is logged and monitored

While it's important to take all possible steps to prevent a breach, the last line of defense organizations have is their alerting and logging implementation. The ideal implementation of a good collection and alerting system is to empower system owners to expediently detect, contain, or prevent a breach, rather than simply collect logs.

There are at least four considerations OT system owners should look to address when a log collection and analysis program is implemented:

• Unauthorized activity

  • Any change in an OT (or IT) environment should come through strict change management procedures. Having a strong change management program, along with the ability to monitor for and alert on unauthorized changes, should be a major consideration.

• Anomaly detection

  • There should be detection of traffic patterns that deviate from the norm, or baseline, of known-good network traffic. Anomaly-based detection should not replace actual controls designed to prevent undesired traffic.

• Break-glass

  • Break-glass or use only in case of emergency access should be used only in emergency situations. Any use thereof should trigger an alarm of the highest criticality to the Security Operations Center (SOC). Break-glass account abuse is often how bad actors try to gain access to an environment through legitimate means.

• Data flow monitoring

  • Continuously monitoring data both within and across network segments and the OT boundary enables early detection of compromise.

NCSC has extensive guidance on proper log implementation, but principle seven serves as a brief reminder that logging for the sake of logging is not enough. Logs should be actionable within an organization to detect a breach and, if possible, prevent it from spreading.

Principle 8: Establish an isolation plan

There may be times when it's necessary to isolate OT environments from external influences, for example, if there is a compromise in connected IT systems or an increased threat from adversaries. OT systems should be designed, where possible, to still provide critical functions while isolated. It's essential that an isolation plan is designed and tested to ensure that critical functions remain operational while preventing unforeseen or unintended consequences during isolation.

There are three primary isolation strategies that an organization could consider:

• Site isolation

  • Site isolation works well in flat networks or networks without sophisticated security measures. Site isolation primarily involves removing or terminating external connections, either physically (e.g., cable disconnect) or via software (e.g., firewall configuration)

• Application or service-specific isolation

  • If an organization has successfully implemented the secure connectivity controls outlined in the guidance, application isolation might be more effective than site isolation. Application isolation enables an organization to isolate affected services or assets using the controls outlined in the guidance, such as microsegmentation.

• Site isolation with hardware-enforced trusted communications

  • This isolation plan allows organizations that have used either data diodes, a CDS, or other hardware-based traffic enforcement to isolate their network while keeping the hardware enforced data flows open. This allows isolating the trusted network from the untrusted network while still enabling secure data transfer.

Isolation plans, just like breach contingency plans, should be built and tested before they are needed. Ideally, isolation plans will never be needed, but with the evolving threat landscape, organizations should take action now to be prepared in the event isolation is needed.

How runZero can help

In our previous blog on this guidance, we mentioned five ways we help organizations protect and secure their OT systems. Those features of runZero also apply to principles five through eight, but there are more ways that runZero can help secure OT environments:

1. Default password checks

   • runZero can run default password checks to discover assets and software that have not changed their default settings.

2. Discover gaps in coverage

   • runZero can surface hidden assets, assets missing security controls, and assets that are bridging networks they shouldn't.

3. Alerting on unauthorized changes

   • runZero provides a comprehensive asset inventory and can detect and alert when assets are added or removed from a network, or when asset changes occur.

4. Edge device detection

   • Many organizations think they know where their edge lies, but runZero can expose assets with network connections you didn’t know existed.

If you stuck with us through all three blog posts, thanks for being here! These weren’t short posts, but neither was the guidance. If you need help protecting your OT assets, runZero is here to help. Try us out for free, or get in touch with us today.

If you missed the livestream, here’s a quick look at the themes and sessions from the day hosted by runZero’s Tod Beardsley and Rob King.

The vulnerability crisis: Quality, prediction, and noise

Right now, the industry is overwhelmed by a flood of CVEs, and we’re pretty sure this is just the beginning of a pretty steep slope. With vulnerability disclosures at an all-time high, the debate over quality versus quantity is more important than ever. In the ‘CVE quagmire’ segment, Jerry Gamblin (RogoLabs) told Tod that we’re facing an average of more than 160 new CVEs per day. He highlighted that while we’re hearing a lot about the potential for an artificial intelligence (AI) tsunami of bugs, we still haven’t addressed people-generated bugs and the inconsistent metadata that have hindered security teams for decades. On a positive note, they discussed how projects like RogoLabs’ CVE.ICU is making the CVE program more transparent, and how the upcoming Schema 6.0 could also help by requiring better, machine-readable data for automated discovery and fixes.

Next, we had the perfect follow-up session, ‘Predicting exploitation’with Jay Jacobs (Empirical Security), exploring the practice of predicting vulnerability exploitation. Jacobs detailed the evolution of the Exploit Prediction Scoring System (EPSS) from a research initiative into a vital, daily-published API that provides probability scores and percentile rankings for hundreds of thousands of CVEs.

They discussed how EPSS differs from other scoring systems and frameworks, specifically explaining the relationship between a probability score and the percentile rank. Jacobs also addressed common misconceptions about low-probability scores, noting that even a small percentage can be highly significant when measured across a massive population of vulnerabilities.

Rounding out our discussions on CVEs was the 'Mute the sirens' session with Mark Lambert (ArmorCode). Given the increasing volume and velocity of vulnerabilities, Lambert explains how an important step in reducing the noise includes determining what actually needs to be fixed, and it’s not just about picking the critical ones. He noted that they leverage threat intelligence from CISA’s KEV and EPSS to determine what’s being actively exploited, which is particularly important given that nearly all CVEs are never actually exploited in the real world.

Then, they further analyze this vulnerability intelligence by using integrations with other solutions to get an inventory of assets, determine what’s externally facing, and understand if a fix is urgently needed from a business-priority perspective. Using this unified exposure management approach goes beyond focusing only on traditional CVEs to include issues found through penetration testing and static analysis, providing a comprehensive picture of an organization’s security posture.

Research-driven reporting in cybersecurity journalism

With more AI-generated content and smaller newsrooms, cybersecurity journalism faces new challenges. In the 'Signal vs. slop' session, current and former reporters discussed how research-driven reporting is changing. Our panel of experts included Bill Brenner (CYBR.SEC.Media), Dennis Fisher (Decipher), and Steve Ragan (1Password).

The group discussed how reduced funding for traditional media has pushed many journalists to work for and with vendors directly, where brand journalism now fills the gap left by shrinking newsrooms, creating challenges for editorial independence amid the pressures of advertising and sponsored content. They also reflected on how large language models (LLMs) are affecting the quality of security reporting and how the rise of automated content lacks the human insight needed for good communication.

Expanding on the cybersecurity journalist’s perspective, the 'On the frontlines of investigative journalism' session with investigative journalist and author Joseph Menn examined the intersection of technology, crime, geopolitics, and hacktivism.

Menn shared with Tod that today’s most interesting stories aren’t just about business deals or stock prices; they focus on the complex areas where organized crime groups and state-sponsored intelligence operations overlap, especially in places like Russia and China.

They also discussed Menn’s book, Cult of the Dead Cow. They talked about the group's role in pressuring tech giants like Microsoft to take security seriously, effectively shifting the industry from a culture of hobbyist tinkering to one of professionalized defense and public policy influence.

Bridging the physical and digital divide

In the 'From risk to resilience' session, Mary Gannon (GuidePoint Security) and Patrick Gillespie (GuidePoint Security) talked with Rob about how IT and Operational Technology (OT) are converging. They discussed the unique challenges of securing industrial systems in sectors such as manufacturing and mining, where older software like Windows 98 and even Windows 3.1 is still in use. They pointed out that while bringing IT and OT together offers benefits such as real-time data and remote work, it also poses serious safety risks.

One key takeaway is the importance of knowing what assets are on your network. Many OT organizations don’t have a clear picture of what’s connected, often because the security teams don’t actually own the physical equipment. They explained that in OT, the priorities are different: IT cares most about keeping data private, while OT focuses on safety and keeping systems running. That’s why things like immediate patching aren’t always possible — shutting down a system could put people’s lives at risk.

This shift from physical assets to decentralized systems is also redefining the very concept of a network perimeter. In the ‘Perimeters and pathways’ session with Jared Atkinson (SpecterOps), Zakir Durumeric (Censys), and HD Moore (runZero), our experts stressed that the idea of a single, clear network perimeter is outdated, replaced by a satellite model of thousands of cloud accounts, remote control systems, and data-sovereignty-compliant providers. They also pointed out that network infrastructure, like firewalls, VPNs, and LTE modems, is now a top target for initial access, blurring the line between internal and external assets.

They discussed the pathways attackers take once they gain initial access, and how defenders can use solutions to map identity-based attack paths through systems. The conversation also noted that fingerprinting internal TLS services and searching for matching hashes on the public internet reveals hidden connections and misconfigurations, such as management ports exposed to guest wireless networks that completely bypass intended segmentation.

And this is especially risky at ‘The network edge,’ where old hardware like routers that no longer get updates are easy targets for attackers. During this session, Kimber Duke (VulnCheck) and Patrick Garrity (VulnCheck) discussed the critical intersection of end-of-life (EOL) hardware and this notion of a porous network edge with Tod.

Our experts revealed that edge devices, such as consumer routers and firewalls, are some of the most targeted assets for exploitation. They also talked about the zombie cycle of the internet, where unpatched, unsupported devices remain online indefinitely, creating a massive, static attack surface. Unfortunately, this problem is exacerbated by Internet Service Providers (ISPs) that continue to issue EOL hardware to new customers as well as the lack of consumer awareness regarding router updates.

As the conversation shifted to AI, our experts noted that they’re seeing a mix of valid bugs and ‘AI slop,’ and they anticipate the volume of valid vulnerabilities to increase geometrically over time.

The AI frontier: Bounties and asymmetric defense

And speaking of AI (which is nearly impossible to avoid in San Francisco, it turns out), it was also a focus in several sessions, including the discussion Tod had with Casey Ellis (Bugcrowd) about ‘Bug bounties in the age of AI.’ They talked about how AI is making it easier for both attackers and defenders, but that the primary drivers of security research still depend on human intent and quick decision-making. They also discussed the challenge of the 'defender's dilemma,' where attackers can try new things quickly and with little risk, while defenders must secure entire environments and face severe operational consequences if their automated 'agents' cause a production outage.

As the session continued, Ellis stressed the importance of vulnerability research and the need to standardize disclosure practices, which is why he’s focusing on disclose.io to make vulnerability disclosure and vulnerability report acceptance easier through standardized legal templates and a vendor-neutral database of disclosure policies.

As noted earlier, we weren’t done with AI yet. 'The infinite eye' segment with Jonathan Cran (Mallory) and HD Moore (runZero) talked with Tod about how AI-powered threat intelligence is giving defenders a real edge in a noisy security landscape. The conversation highlights a major shift in vulnerability management; defenders are transitioning away from waiting for official CVE numbers to tracking emerging threats through GitHub issues, mailing lists, and security advisories. By being more intentional about embracing the strengths of LLMs to filter out slop and fake exploits, defenders can answer critical questions much faster about their exposure in minutes, often beating CVE assignment and official vulnerability databases to the punch.

Strengthening the shield: Community and visibility

In the 'Force multiplied' session, Rishiraj Sharma (ProjectDiscovery) and Tod discussed how the open-source framework Nuclei has revolutionized how security teams validate vulnerabilities. Sharma explained that Nuclei was created to cut through the noise from traditional scanners, which often flag thousands of potentially vulnerable instances based solely on version detection. Instead, Nuclei lets security pros outline the exact steps a person would take to verify an exploit, making it clear which assets are really at risk and need immediate attention.

Thanks to input from pentesters, bug bounty hunters, and researchers worldwide, Nuclei can now create verified exploit templates in just hours instead of days. Sharma also noted that ProjectDiscovery’s bug bounty program incentivizes researchers to write new templates and validate existing ones to ensure high quality and reduce false positives.

A new kind of RSAC experience

At the end of the day, the best part of runZero Day wasn’t just one session — it was the insights shared and the format. By moving the conversation beyond the Moscone Center, we were able to broaden the audience for the major themes of the cybersecurity industry and RSAC to the world beyond Silicon Valley.

In the end, we hope you dip into the recorded stream, and if you just can’t get enough, you should definitely join the next runZero Hour, where Tod and Rob will chat it up with Caroline Wong, author of The AI Cybersecurity Handbook. They’ll talk more about the ups and downs of our machine-brained tooling in our day-to-day practice of cybersecurity.

First off, I’m glad to get these CVE out the door, which may sound a little strange. After all, nobody’s happy when their product ships with vulnerabilities. But, this does give me, incorrigible vulnerability-gazer todb, a reason to tout runZero’s overarching commitment to transparently communicate with our customers, users, and fans about the occasional bug that we happen to write, then find, and then fix. Best of all, there’s no reason to believe any of these were exploited in the wild (and we did check; if we ever find indicators of compromise, the affected customers would be the first to know).

In our role as a designated CVE Numbering Authority (or CNA), we are now expected to voluntarily (and, dare I say, enthusiastically), publish CVE records noting vulnerabilities that affect our own software. This first batch covers several months of bug-writing, concluding with CVE identifiers for an even dozen vulnerabilities. While most of them are pretty boring (everything in the set requires you to already be at least an authorized runZero user, and most are in the CVSS 5.8 Medium range) we’re committed to showing some uncomfortable proof that we actually do practice what we preach when it comes to security audits. We take our compliance requirements quite seriously, and we are going beyond an auditor’s checkbox when it comes to rolling out fixes before anything actually bad happens.

Going forward, we’re targeting the first Tuesday of every month for these CVE rollups, in order to give our customers and users a chance to apply fixes as we release them. To be clear, I expect there will be first-Tuesdays that go by with nary a bug to document. You'll notice that our most recent security issue was back in February, and I'm writing this in April, so you can expect to see a monthly report when there's something to share.

I’d also like to note that runZero has spent its entire corporate life offering security fixes as regular point releases, and we don’t expect to change that cadence now we’re a CNA. Instead, we’re offering our customers the best of both worlds: rapid fixes for security issues (no matter how minor they seem), and follow up documentation for the folks who continue to rely on the CVE ecosystem for alerting. This works for us because the runZero Platform is, at heart, a SaaS offering, which means that most of our users get these fixes without any heavy lifting or other action on their part. However, we’re also used in high security environments that require an on-prem, air-gapped installation. Ironically, this means that those high-security customers may miss out on security fixes for a while, so we’re hopeful that publishing these CVEs might nudge them along to getting not just security fixes, but all of our sweet new features and refinements that they miss out on with a slower-than-instant update cycle.

Of course, in the unlikely event that things go really off the rails and someone else discovers and publishes a vulnerability of ours before we do ourselves, we’ll be first on the scene with a fix and a CVE in hand.

So, nobody likes shipping vulns, but the least we can do is be clear about our vulnerabilities when we find and fix them, both practically in release notes, and logistically for the global CVE community. Everybody writes bugs, but not everyone is on board with owning them, and that’s why I’m (weirdly) pleased to announce our twelve newly minted CVEs. For more details, swing by runZero’s Security Advisories page, or just look these up directly with your favorite CVE client.

CVEs for April, 2026

The below are ordered by CVSS general ratings (High to Low, there were no Criticals). All runZero Platform hosted customers have already been fixed, while on-prem customers will need to update to the latest version.

High

• CVE-2026-5373: runZero Platform superuser privilege escalation, CVSS 8.1 (High)

Medium

• CVE-2026-5372: runZero Platform SQL injection in saved queries, CVSS 6.4 (Medium)
• CVE-2026-5376: runZero Platform session timeout failure, CVSS 5.9 (Medium)
• CVE-2026-5374: runZero Platform MCP information leak, CVSS 5.8 (Medium)
• CVE-2026-5378: runZero Platform user creation leak, CVSS 5.8 (Medium)
• CVE-2026-5384: runZero Platform incorrect credential scope, CVSS 5.8 (Medium)
• CVE-2026-5380: runZero Platform clear-text secret exposure, CVSS 5.3 (Medium)
• CVE-2026-5383: runZero Explorer missing authorization check (CVSS 4.4 (Medium)

Low

• CVE-2026-5379: runZero Platform MCP certification information leak, CVSS 3.0 (Low)
• CVE-2026-5382: runZero Platform MCP endpoint information leak, CVSS 3.0 (Low)
• CVE-2026-5375: runZero Platform API credential information leak, CVSS 2.7 (Low)
• CVE-2026-5381: runZero Platform task information leak, CVSS 2.2 (Low)