runZero Rapid Responses

Critical RCE vulnerability in PHP: Find impacted assets

2026-10-20T18:11:00-04:00

Critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619

Update (October 27, 2026): Evidence indicates that CVE-2026-109618 and CVE-2026-109619 are actively exploited in the wild, leading to their addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 26, 2026.
Update (October 21, 2026): This post has been updated with details from the PHP Project's security advisory, including affected versions, fixes, and mitigations.

The PHP Project has released a security update that addresses two critical vulnerabilities, collectively known as "php2shell". Both are rated CVSS 9.2 and can allow unauthenticated remote code execution:

CVE-2026-109618: PHP handles out-of-memory (OOM) errors by exiting the current context with longjmp(), which can interrupt PHP while request data is only partially initialized. Request cleanup may then read or branch on the invalid data, allowing an unauthenticated, remote attacker to execute arbitrary code. Crafted multipart requests can trigger the condition, and with Apache mod_php it can occur before any application code runs. The vulnerability has been designated CVE-2026-109618 and has been rated critical with a CVSS score of 9.2.
CVE-2026-109619: PHP retains global state that points to memory owned by a request. If that state is not reset before the request memory is freed, a later request handled by the same worker can use the stale state before normal initialization, allowing an unauthenticated, remote attacker to execute arbitrary code. The vulnerability has been designated CVE-2026-109619 and has been rated critical with a CVSS score of 9.2.

All PHP installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Applications that run on PHP, such as content management systems, e-commerce platforms, and web frameworks, may be exposed through a vulnerable PHP runtime.

The following versions are affected

PHP 8.2: Versions prior to 8.2.35
PHP 8.3: Versions prior to 8.3.36
PHP 8.4: Versions prior to 8.4.27
PHP 8.5: Versions prior to 8.5.12

Note: PHP 8.1 and earlier no longer receive updates from the PHP Project and should be considered vulnerable unless a distribution or LTS vendor has backported the fixes.

What is PHP?

PHP is a widely used open-source, general-purpose scripting language for web development. It runs web applications and content management systems, often through mod_php, PHP-FPM, or CGI.

What is the impact?

Successful exploitation of these vulnerabilities would allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process, potentially leading to full compromise of affected web applications and underlying server infrastructure.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

PHP 8.2: Upgrade to version 8.2.35 or later.
PHP 8.3: Upgrade to version 8.3.36 or later.
PHP 8.4: Upgrade to version 8.4.27 or later.
PHP 8.5: Upgrade to version 8.5.12 or later.
PHP 8.1 and earlier: Migrate to a supported fixed release, or obtain a backported fix from your distribution or LTS vendor.

Note: Linux distributions and LTS vendors received the patches in advance; check your vendor for updated packages. The PHP security team also provided minimal source backports for PHP 7.4, 8.0, and 8.1 for those building from source.

Mitigation:

Updating is the only complete mitigation. The following measures reduce exposure to specific attack paths but do not make an installation safe.
CVE-2026-109618: Set memory_limit=-1 in a way applications cannot override, set a low post_max_size, and enforce request size, multipart part, header, and nesting limits at the web server or proxy.
CVE-2026-109619: Set session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0, restart all workers, and remove invalid or deprecated per-request settings that emit diagnostics before request initialization.
Review the PHP security advisory and the linked GitHub Security Advisories for additional mitigation details.

Finding exposed PHP installations with runZero

From the Software Inventory, use the following query to locate systems running potentially vulnerable software:

vendor:=PHP AND product:=PHP

BIND high-severity vulnerabilities: Find impacted systems

2024-12-19T00:00:00-05:00

Latest BIND vulnerabilities:

Internet Systems Consortium (ISC) has disclosed four high-severity vulnerabilities affecting certain versions of ISC BIND:

CVE-2026-19630: Inbound DNS messages with a particular structure cause additional processing with no limit in a BIND resolver, allowing a remote attacker to exhaust CPU and memory and cause a denial of service. This vulnerability has been designated CVE-2026-19630 and has been rated high with a CVSS score of 7.5.
CVE-2026-94300: Replaying GSS-TSIG signed UDP messages corrupts memory in the BIND "named" process. An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid and, by also sending crafted queries to a zone the attacker controls, may cause the process to abort or potentially achieve remote code execution. This vulnerability has been designated CVE-2026-94300 and has been rated high with a CVSS score of 8.1.
CVE-2026-96888: A BIND resolver configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect, allowing a remote attacker to cause a denial of service. This vulnerability has been designated CVE-2026-96888 and has been rated high with a CVSS score of 7.5.
CVE-2026-97313: A recursive BIND server that allows recursive queries and has at least two RPZ zones, one with the default "recursive-only yes" and one with "recursive-only no", may exit with an assertion failure when it receives a query with RD=1 followed by a query with RD=0, allowing a remote attacker to cause a denial of service. This vulnerability has been designated CVE-2026-97313 and has been rated high with a CVSS score of 7.5.

The following versions are affected:

BIND 9.11 - 9.18: Versions 9.11.0 through 9.18.50 (CVE-2026-96888 affects versions 9.16.0 and later, and CVE-2026-97313 affects versions 9.16.0 and later)
BIND 9.20: Versions 9.20.0 through 9.20.29
BIND 9.21: Versions 9.21.0 through 9.21.26
BIND Supported Preview Edition 9.11-S1 - 9.18-S1: Versions 9.11.3-S1 through 9.18.50-S1 (CVE-2026-96888 affects versions 9.16.8-S1 and later)
BIND Supported Preview Edition 9.20-S1: Versions 9.20.9-S1 through 9.20.29-S1

No workarounds are known for any of these vulnerabilities.

What is BIND?

ISC BIND is open-source software, maintained by the Internet Systems Consortium (ISC), that implements the Domain Name System (DNS), which is the foundational protocol for translating human-readable domain names into IP addresses.

What is the impact?

Successful exploitation of these vulnerabilities would allow an unauthenticated remote attacker to cause a denial of service by crashing or exhausting resources on affected DNS resolvers, with the potential to execute arbitrary code on the underlying host if valid authentication messages can be captured and replayed.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

BIND 9.11 - 9.18: Migrate to a fixed release. Upgrade to 9.20.30 or later.
BIND 9.20: Upgrade to version 9.20.30 or later.
BIND 9.21: Upgrade to version 9.21.27 or later.
BIND Supported Preview Edition 9.11-S1 - 9.18-S1: Migrate to a fixed release. Upgrade to 9.20.30-S1 or later.
BIND Supported Preview Edition 9.20-S1: Upgrade to version 9.20.30-S1 or later.

BIND Supported Preview Edition 9.20-S1: Upgrade to version 9.20.30-S1 or later.

Finding exposed BIND systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=ISC AND product:=BIND AND (version:>0 AND (
  (version:>=9.11.0 AND version:<=9.18.50) OR
  (version:>=9.20.0 AND version:<=9.20.29) OR
  (version:>=9.21.0 AND version:<=9.21.26) OR
  (version:>="9.11.3-S1" AND version:<="9.18.50-S1") OR
  (version:>="9.20.9-S1" AND version:<="9.20.29-S1")))

October 2025: CVE-2025-40778, CVE-2025-40780, and CVE-2025-8677

Internet Systems Consortium (ISC) has disclosed multiple vulnerabilities affecting certain versions of ISC BIND:

A cache poisoning vulnerability related to unsolicited resource records (RRs) - records in a DNS response that were not directly requested by a query - is possible under certain circumstances. This vulnerability exists because BIND is too lenient when accepting such records from answers. Successful exploitation allows a remote, unauthenticated adversary to inject forged records into the cache during a query. This can affect the resolution of future queries, potentially hijacking traffic. This vulnerability has been designated CVE-2025-40778 and has been rated high with a CVSS score of 8.6.
A cache poisoning vulnerability exists due to a weakness in the pseudo-random number generator (PRNG). This weakness allows a remote, unauthenticated adversary to predict the source port and query ID that BIND will use. In specific circumstances, BIND can be tricked into caching spoofed responses from an adversary. This vulnerability has been designated CVE-2025-40780 and has been rated high with a CVSS score of 8.6.
A resource exhaustion vulnerability exists due to flaws in handling malformed DNSKEY records. Successful exploitation allows a remote, unauthenticated adversary to query for records within a specially crafted zone containing such records. This causes the server to consume excessive CPU resources, overwhelming it and significantly impacting performance, which leads to a denial-of-service (DoS) for legitimate clients. This vulnerability has been designated CVE-2025-8677 and has been rated high with a CVSS score of 7.5.

Authoritative services are believed to be unaffected by these vulnerabilities; however, resolvers are affected.

The following versions are affected:

BIND versions 9.11.0 through 9.16.50
- Note: This range is only affected by CVE-2025-40778 and CVE-2025-40780. The latter (CVE-2025-40780) only affects versions 9.16.0 through 9.16.50.
BIND versions 9.18.0 through 9.18.39
BIND versions 9.20.0 through 9.20.13
BIND versions 9.21.0 through 9.21.12
BIND Supported Preview Edition versions 9.11.3-S1 through 9.16.50-S1
- Note: This range is only affected by CVE-2025-40778 and CVE-2025-40780. The latter (CVE-2025-40780) only affects versions 9.16.8-S1 through 9.16.50-S1.
BIND Supported Preview Edition versions 9.18.11-S1 through 9.18.39-S1
BIND Supported Preview Edition versions 9.20.9-S1 through 9.20.13-S1

Note: BIND versions prior to 9.11.0 were not specifically assessed, but are also believed to be affected.

What is the impact?

Successful exploitation of the vulnerabilities would allow an adversary to affect the resolution of future queries, thereby potentially hijacking traffic, and disrupt service operation for legitimate clients.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

BIND versions 9.11.x through 9.18.x upgrade to version 9.18.41 or later
BIND versions 9.20.x upgrade to version 9.20.15 or later
BIND versions 9.21.x upgrade to version 9.21.14 or later
BIND Supported Preview Edition versions 9.11.3-S1 through 9.18.39-S1 upgrade to version 9.18.41-S1 or later
BIND Supported Preview Edition versions 9.20.9-S1 through 9.20.13-S1 upgrade to version 9.20.15-S1 or later

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=ISC AND product:=BIND AND (version:>0 AND (
  (version:>=9 AND version:<9.11.0) OR
  (version:>=9.11.0 AND version:<=9.16.50) OR
  (version:>=9.18.0 AND version:<=9.18.39) OR
  (version:>=9.20.0 AND version:<=9.20.13) OR
  (version:>=9.21.0 AND version:<=9.21.12) OR
  (version:>="9.11.3-S1" AND version:<="9.16.50-S1") OR
  (version:>="9.18.11-S1" AND version:<="9.18.39-S1") OR
  (version:>="9.20.9-S1" AND version:<="9.20.13-S1")))

December 2024: BIND 9.20 defect in QPzone implementation

ISC disclosed that authoritative servers might experience assertion failures or other unexpected events when using DNSSEC-signed zones using NSEC3 in the QPzone implementation which utilizes the QPDB in-memory database. This could potentially lead to a denial-of-service. There was no CVE attached to this notice.

What was the impact?

This issue affected all BIND versions from 9.20.0 to 9.20.4.

Were updates or workarounds available?

ISC stated they were not updating or withdrawing the 9.20 distributions. They did recommend the following either:

Recompiling BIND 9.20 with --with-zonedb=RBTDB
Installing the latest BIND 9.20.4 packages provided by ISC

How runZero users found potentially vulnerable systems

From the Services Inventory, use the following query to locate systems running potentially vulnerable software:

product:bind and (_service.product:="%BIND:9.20.0%" or _service.product:="%BIND:9.20.1%" or _service.product:="%BIND:9.20.3%" or _service.product:="%BIND:9.20.4%")

Arista VeloCloud Orchestrator CVE-2026-114625 (Critical)

2026-09-25T23:14:00-04:00

Critical Arista VeloCloud Orchestrator flaw: CVE-2026-114625

Arista Networks disclosed that self-hosted, on-prem deployments of VeloCloud Orchestrator contain a SQL injection vulnerability that allows a remote attacker to access privileged internal functionality and impact the VCO host. Any authenticated user, including one holding the lowest built-in tenant role (Enterprise Read Only), can gain operator privileges and masquerade as a local "superuser operator" user. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages. This vulnerability has been designated CVE-2026-114625 and has been rated critical with a CVSS score of 9.9.

Exploitation requires network access to the VCO web interface and an active certificate-based authentication setup between a VeloCloud Edge and the Orchestrator; tenant or operator credentials are not required. Hosted versions (including Dedicated instances) were also affected and have already been patched by Arista.

Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 23, 2026..

The following versions are affected

Arista VeloCloud Orchestrator 5.2.x: Versions prior to 5.2.3.18
Arista VeloCloud Orchestrator 6.1.x: Versions prior to 6.1.3.10
Arista VeloCloud Orchestrator 6.4.x: Versions prior to 6.4.2.12

Hosted and Dedicated versions of VeloCloud Orchestrator were affected and have already been patched by the vendor. End-of-support versions have not been assessed.

What is Arista VeloCloud Orchestrator (VCO)?

Arista VeloCloud Orchestrator (VCO) is the centralized management and orchestration component of the VeloCloud SD-WAN solution, used to configure, monitor, and manage VeloCloud Edge devices across an enterprise network.

What is the impact?

Successful exploitation of this vulnerability would allow a low-privileged authenticated attacker to gain full administrative control of the central management orchestrator, potentially resulting in complete system compromise and data exposure across the enterprise network.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Arista VeloCloud Orchestrator 5.2.x: Upgrade to version 5.2.3.18 or later.
Arista VeloCloud Orchestrator 6.1.x: Upgrade to version 6.1.3.10 or later.
Arista VeloCloud Orchestrator 6.4.x: Upgrade to version 6.4.2.12 or later.

Note: Customers on a release train that is no longer supported should contact Arista TAC to discuss upgrade options. Until a fixed version is deployed, restrict access to the VCO web interface to trusted administrative networks, and block the source IP addresses 74.82.197.86 and 38.54.50.151, which Arista has observed conducting attacks.

Finding exposed Arista VeloCloud Orchestrator appliances with runZero

From the Software Inventory, use the following query to locate systems running potentially vulnerable software:

vendor:="Arista" AND product:="VeloCloud Orchestrator"

September: CVE-2026-93952

Arista Networks disclosed that certain versions of on-premises VeloCloud Orchestrator (VCO) contain an improper input validation vulnerability. An attacker can exploit this flaw to access privileged internal functionality and compromise the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and its managed data. This vulnerability has been designated CVE-2026-93952 and has been rated critical with a CVSS score of 9.5.

Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 22, 2026.

The following versions are affected

VCO 5.2.x: Versions 5.2.0 through 5.2.3.15
VCO 6.1.x: Versions 6.1.0 through 6.1.3.7
VCO 6.4.x: Versions 6.4.0 through 6.4.2.7
VCO 7.0.x: Versions 7.0.0 through 7.0.0.2

What is the impact?

Successful exploitation of this vulnerability would allow an unauthenticated remote attacker with network access to the web interface to compromise internal administrative functionality and gain complete control over the confidentiality, integrity, and availability of the orchestrator host and its managed enterprise network data.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

VCO 5.2.x: Upgrade to version 5.2.3.16 or later.
VCO 6.1.x: No fixed version is currently available.
VCO 6.4.x: Upgrade to version 6.4.2.8 or later.
VCO 7.0.x: No fixed version is currently available.

Note: Arista has not yet released fixes for the 6.1.x and 7.0.x release trains. As a temporary mitigation while patching is pending, restrict VCO web interface access to trusted administrative networks.

Finding exposed Arista VeloCloud Orchestrator appliances with runZero

From the Service inventory, use the following query to locate potentially impacted installations:

_asset.protocol:=http AND protocol:=http AND (http.body:"single-spa-application:@velocloud/vco-header" OR last.http.body:"single-spa-application:@velocloud/vco-header")

Critical GitLab CVE-2026-110264: Find impacted systems

2022-02-28T03:00:00-05:00

Critical GitLab vulnerability: CVE-2026-110264

GitLab disclosed self-managed installations of GitLab CE and EE contain a critical integer overflow vulnerability in the regular expression compiler. Under certain conditions, an unauthenticated attacker can supply a specially crafted regular expression to execute arbitrary code on the GitLab server. The vulnerability has been designated CVE-2026-110264 and has been rated critical with a CVSS score of 10.0.

The following versions are affected

GitLab CE & EE 7.0 - 18.11.x: Versions 7.0 through 18.11.12
GitLab CE & EE 19.0.x: Versions 19.0.0 through 19.0.9
GitLab CE & EE 19.1.x: Versions 19.1.0 through 19.1.8
GitLab CE & EE 19.2.x: Versions 19.2.0 through 19.2.8
GitLab CE & EE 19.3.x: Versions 19.3.0 through 19.3.5
GitLab CE & EE 19.4.x: Versions 19.4.0 through 19.4.2
GitLab CE & EE 19.5.x: Version 19.5.0

What are GitLab Community Edition (CE) and Enterprise Edition (EE)?

GitLab Community Edition (CE) provides core Git repository management and CI/CD pipelines, while Enterprise Edition (EE) includes all CE capabilities alongside advanced security, compliance, and enterprise scalability features.

What is the impact?

Successful exploitation of this vulnerability would allow an unauthenticated attacker to execute arbitrary code and gain unauthorized control over affected self-managed GitLab servers.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

GitLab CE & EE 7.0 - 18.11.x: Upgrade to version 18.11.13 or later.
GitLab CE & EE 19.0.x: Upgrade to version 19.0.10 or later.
GitLab CE & EE 19.1.x: Upgrade to version 19.1.9 or later.
GitLab CE & EE 19.2.x: Upgrade to version 19.2.9 or later.
GitLab CE & EE 19.3.x: Upgrade to version 19.3.6 or later.
GitLab CE & EE 19.4.x: Upgrade to version 19.4.3 or later.
GitLab CE & EE 19.5.x: Upgrade to version 19.5.1 or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate systems running potentially vulnerable software:

vendor:="GitLab" AND product:="GitLab" AND version:>0 AND
  ((version:>="7.0.0" AND version:<"18.11.13") OR
  (version:>="19.0.0" AND version:<"19.0.10") OR
  (version:>="19.1.0" AND version:<"19.1.9") OR
  (version:>="19.2.0" AND version:<"19.2.9") OR
  (version:>="19.3.0" AND version:<"19.3.6") OR
  (version:>="19.4.0" AND version:<"19.4.3") OR
  (version:>="19.5.0" AND version:<"19.5.1"))

October 2026: CVE-2026-97229

GitLab disclosed self-managed installations of GitLab CE and EE contain a critical integer overflow vulnerability in the CI/CD regular expression compiler. Due to insufficient regular expression validation, an unauthenticated attacker can supply a specially crafted regular expression in a CI/CD configuration to execute arbitrary code on the GitLab server. The vulnerability has been designated CVE-2026-97229 and has been rated critical with a CVSS score of 10.0.

The following versions are affected

GitLab CE & EE 19.2.x: Versions 19.2.0 through 19.2.7
GitLab CE & EE 19.3.x: Versions 19.3.0 through 19.3.4
GitLab CE & EE 19.4.x: Versions 19.4.0 through 19.4.1

What are GitLab Community Edition (CE) and Enterprise Edition (EE)?

What is the impact?

Successful exploitation of this vulnerability would allow an unauthenticated remote attacker to execute arbitrary code on the underlying server, resulting in complete system compromise, full loss of confidentiality for hosted source code and CI/CD secrets, and potential compromise of connected enterprise infrastructure.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

GitLab CE & EE 19.2.x: Upgrade to version 19.2.8 or later.
GitLab CE & EE 19.3.x: Upgrade to version 19.3.5 or later.
GitLab CE & EE 19.4.x: Upgrade to version 19.4.2 or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate systems running potentially vulnerable software:

vendor:="GitLab" AND product:="GitLab" AND version:>0 AND
  ((version:>="19.2.0" AND version:<"19.2.8") OR
  (version:>="19.3.0" AND version:<"19.3.5") OR
  (version:>="19.4.0" AND version:<"19.4.2"))

September 2026: CVE-2026-85706

GitLab disclosed self-managed installations of GitLab CE and EE contain a critical path traversal vulnerability in the repository commits API. Due to improper path confinement and missing authentication enforcement, a remote, unauthenticated attacker can read arbitrary server files. Successful exploitation may lead to the exposure of sensitive configuration data, system credentials, or source code. The vulnerability has been designated CVE-2026-85706 and has been rated critical with a CVSS score of 10.0.

The following versions are affected

GitLab CE & EE 18.x - 19.1.x: Versions 18.7.0 through 19.1.7
GitLab CE & EE 19.2.x: Versions 19.2.0 through 19.2.5
GitLab CE & EE 19.3.x: Versions 19.3.0 through 19.3.1

What are GitLab Community Edition (CE) and Enterprise Edition (EE)?

What is the impact?

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to read arbitrary server files, potentially exposing sensitive system credentials, application configuration data, or internal source code.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

GitLab CE & EE 18.x - 19.1.x: Upgrade to version 19.1.8 or later.
GitLab CE & EE 19.2.x: Upgrade to version 19.2.6 or later.
GitLab CE & EE 19.3.x: Upgrade to version 19.3.2 or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate systems running potentially vulnerable software:

vendor:="GitLab" AND product:="GitLab"

August 2026: CVE-2026-19478 and CVE-2026-19650

GitLab disclosed two vulnerabilities affect certain self-managed versions of GitLab CE and EE.

CVE-2026-19478: A code injection vulnerability via a GraphQL directive. Successful exploitation allows a remote, unauthenticated attacker to modify or delete public projects and user data. The vulnerability has been designated CVE-2026-19478 and has been rated high with a CVSS score of 9.4.
CVE-2026-19650: A Cross-Site Request Forgery (CSRF) vulnerability in the GraphQL multiplex query handler. Improper request validation allows a remote, unauthenticated attacker to execute arbitrary GraphQL mutations via standard GET requests. The vulnerability has been designated CVE-2026-19650 and has been rated high with a CVSS score of 7.1.

The following versions are affected

GitLab CE & EE 18.x: Versions 18.2 through 18.11.10
GitLab CE & EE 19.0.x: Versions 19.0 through 19.0.7
GitLab CE & EE 19.1.x: Versions 19.1 through 19.1.5
GitLab CE & EE 19.2.x: Versions 19.2 through 19.2.3

What is the impact?

Successful exploitation of these vulnerabilities would allow a remote, unauthenticated attacker to tamper with or delete public projects and user data, or force authenticated users into executing unauthorized state-changing actions across affected instances.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

GitLab CE & EE 18.x: Upgrade to version 18.11.11 or later.
GitLab CE & EE 19.0.x: Upgrade to version 19.0.8 or later.
GitLab CE & EE 19.1.x: Upgrade to version 19.1.6 or later.
GitLab CE & EE 19.2.x: Upgrade to version 19.2.4 or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate systems running potentially vulnerable software:

vendor:="GitLab" AND product:="GitLab"

March 2025: CVE-2025-25291 and CVE-2025-25292

GitLab has issued critical patch releases to resolve another Security Assertion Markup Language (SAML) authentication bypass vulnerability that affects self-hosted instances of both GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability isn't specific to GitLab however. The root issue resides within an open source Ruby library that GitLab uses to handle SAML authentication requests.

CVE-2025-25291 and CVE-2025-25292 are rated critical with CVSS score of 8.8, and potentially allows for an attacker to bypass SAML authentication.

What is the impact?

According to GitLab, successful exploitation of this vulnerability allows for an attacker to gain access to a self-hosted GitLab instance, if configured to provide authentication using SAML. They have also noted that an attacker would need to have "comprised a valid user account to perform the authentication bypass".

Are updates or workarounds available?

For customers running self-hosted instances of GitLab, patches are available for download through their website. GitLab is advising customers running self-hosted instances to "upgrade to the latest version as soon as possible". If unable to patch the systems, the security advisory also includes mitigation instructions, which consist of enabling two-factor authentication and disabling the SAML two-factor bypass settings within GitLab. They also recommend requiring "admin approval for automatically created new users".

For more information, refer to the Security fixes of the patch release linked above.

For customers subscribed to GitLab's SaaS product (gitlab.com), no additional action is required.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate systems running potentially vulnerable software:

product:gitlab and ((version:>17.9 and version:<17.9.2) or (version:>17.8 and version:<17.8.5) or (version:>17.7 and version:<17.7.7))

September 17, 2024 (CVE-2024-45409)

GitLab has issued a critical patch release to resolve a Security Assertion Markup Language (SAML) authentication bypass vulnerability that affects self-hosted instances of both GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability isn't specific to GitLab however. The root issue resides within two open source Ruby libraries that GitLab uses to handle SAML authentication requests.

CVE-2024-45409 is rated critical with CVSS score of 10.0, and potentially allows for an attacker to bypass SAML authentication.

What is the impact?

According to GitLab, successful exploitation of this vulnerability allows for an unauthenticated attacker to gain access to a self-hosted GitLab instance, if configured to provide authentication using SAML.

Are updates or workarounds available?

For customers running self-hosted instances of GitLab, patches are available for download through their website. GitLab is advising customers running self-hosted instances to "upgrade to the latest version as soon as possible". If unable to patch the systems, the security advisory also includes mitigation instructions, which consist of enabling two-factor authentication and disabling the SAML two-factor bypass settings within GitLab. For more information, refer to the Security fixes of the patch release linked above.

For customers subscribed to GitLab's SaaS product (gitlab.com), no additional action is required.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

product:gitlab

September 11, 2024 (CVE-2024-6678)

On September 11, GitLab has issued a patch release for seventeen vulnerabilities that affect both GitLab Community Edition (CE) and Enterprise Edition (EE).

CVE-2024-6678 is rated critical with CVSS score of 9.9, and potentially allows for unauthorized resource access by an attacker.

In addition to the critical CVE, three high-severity vulnerabilities were also disclosed in the patch release.

CVE-2024-8640 is rated high with CVSS score of 8.5, which can lead to the remote execution of arbitrary code.
CVE-2024-8635 is rated high with CVSS score of 7.7, which can result in unauthorized access to resources.
CVE-2024-8124 is rated high with CVSS score of 7.5, which can result in a Denial of Service.

What is the impact?

According to GitLab, successful exploitation of this vulnerability allows for an attacker to "trigger a pipeline as an arbitrary user under certain circumstances".

Are updates or workarounds available?

For customers running self-hosted instances of GitLab, patches are available for download through their website. For customers already subscribed to GitLab's SaaS product (gitlab.com), no additional action is required.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

product:gitlab

February 2022 (CVE-2022-0735)

The development team at GitLab issued a new critical security release that patches seven recently-disclosed vulnerabilities in GitLab software. Reported by customers, security researchers, and GitLab team members, these vulnerabilities are located in various components of the software and affect both GitLab Community and Enterprise editions:

CVE-2022-0735 (CVSS "critical" score of 9.6) - Unauthorized users can steal runner registration tokens via quick actions commands
CVE-2022-0549 (CVSS "medium" score of 6.5) - Unprivileged users can add other users to groups via the API
CVE-2022-0751 (CVSS "medium" score of 6.5) - snippet content can be manipulated to display inaccurate/misleading data from an unauthorized user
CVE-2022-0741 (CVSS "medium" score of 5.8) - Environment variables can be leaked via sendmail
CVE-2021-4191 (CVSS "medium" score of 5.3) - User enumeration of private GitLab instances (with restricted sign-ups) can be possible by unauthenticated users via the GraphQL API
CVE-2022-0738 (CVSS "medium" score of 4.2) - User passwords can be leaked when adding pull mirrors with SSH credentials
CVE-2022-0489 (CVSS "low" score of 3.5) - A denial-of-service condition can be trigger by using the math feature with a specific formula in issue comments

Is an update available?

To avoid possible exploitation of the above vulnerabilities, GitLab recommends all admins update to GitLab versions 14.8.2, 14.7.4, and 14.6.5 for Community Edition (CE) and Enterprise Edition (EE) installations. If upgrading instances isn't viable in the near-term, GitLab does provide a hotpatch for the runner token disclosure vulnerability–the most severe vulnerability of the bunch–for a number of GitLab versions, suitable as a temporary mitigation until a full update can be performed.

How do I find potentially vulnerable GitLab instances with runZero?

From the Asset Inventory, use the following pre-built query to locate GitLab assets within your network that are potentially vulnerable:

product:gitlab

As always, any prebuilt queries we create are available from our Queries Library. Check out the library for other useful inventory queries.

Cisco Secure Email Gateway CVE-2026-76519

2025-12-17T16:49:00-05:00

Cisco Secure Email Gateway vulnerability: CVE-2026-76519

Cisco disclosed that certain versions of Cisco AsyncOS Software for Cisco Secure Email Gateway are affected by an arbitrary file write vulnerability within the Advanced Malware Protection (AMP) feature. The flaw stems from improper handling of email attachments on systems where the File Reputation service is enabled, assigned to a mail policy, and running Content Scanner Tools earlier than version 25.3.0.5525. An unauthenticated, remote attacker can exploit this by sending a specially crafted email attachment through an affected device, allowing them to write arbitrary files to the underlying operating system and execute commands with root privileges. The vulnerability has been designated CVE-2026-76519 and has been rated critical with a CVSS score of 9.8.

Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 14, 2026.

The following versions are affected

Cisco Secure Email Gateway 15.5: Versions prior to 15.5.5-014
Cisco Secure Email Gateway 16.0: All versions
Cisco Secure Email Gateway 16.5: Versions prior to 16.5.0-780

Cisco recommends that customers running releases earlier than 16.5 migrate to 16.5.0-780.

What is Cisco Secure Email Gateway?

Cisco Secure Email Gateway is an email security appliance, available as a physical, virtual, or cloud gateway, that protects organizations from spam, phishing, and malware. Its Advanced Malware Protection (AMP) feature uses a file reputation service to evaluate email attachments.

What is the impact?

Successful exploitation of this vulnerability would allow an unauthenticated, remote attacker to achieve full, root-level compromise of the underlying operating system on affected devices.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Cisco Secure Email Gateway 15.5: Upgrade to 15.5.5-014 or later.
Cisco Secure Email Gateway 16.0: Migrate to a fixed release.
Cisco Secure Email Gateway 16.5: Upgrade to 16.5.0-780 or later.
Cisco Secure Email Gateway releases earlier than 16.5: Migrate to 16.5.0-780.

Note: The fix is also distributed to all licensed and supported AsyncOS releases through Content Scanner Tools version 25.3.0.5525 or later, which can be applied without a software upgrade or restart. Use the contentscannerupdate CLI command or enable automatic updates under Security Services > Service Updates. Cisco Secure Email Cloud Gateway customers do not need to take action.

Find exposed Cisco Secure Email Gateway's with runZero

From the Service inventory, use the following query to locate potentially vulnerable assets:

_asset.protocol:=http AND protocol:=http AND last.html.title:"Cisco%Gateway%C" AND NOT last.html.title:"Cloud"

September 2026: CVE-2026-76461

Cisco has reported a vulnerability in their Secure Email Gateway product. This flaw allows remote, unauthenticated attackers to execute arbitrary code on the vulnerable system. Successful exploitation could allow complete system compromise.

This vulnerability has been assigned CVE-2026-76461 and is rated highly critical has a CVSS score of 9.8.

Note that there is evidence that this vulnerability is being actively exploited in the wild.

The following versions are affected

15.5.4-012 and earlier
16.0.3-044 and earlier
16.5.0 before 16.5.0-780

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

15.5.5-014 and later
16.0.4-302 and later
16.5.0-780 and later

Find exposed Cisco Secure Email Gateway's with runZero

From the Service inventory, use the following query to locate potentially vulnerable assets:

_asset.protocol:=http AND protocol:=http AND last.html.title:"Cisco%Gateway%C" AND NOT last.html.title:"Cloud"

December 2025 advisory:

Cisco reported a vulnerability in their Secure Email Gateway product. This flaw allowed remote, unauthenticated attackers to execute arbitrary code on the vulnerable system. Successful exploitation could have allowed complete system compromise.

This vulnerability was assigned CVE-2025-20393, was rated highly critical, and had a CVSS score of 10.0.

Note that there was evidence that this vulnerability was being actively exploited in the wild.

All versions of Cisco Secure Email Gateway except Cisco Secure Email Gateway Cloud were affected.

What was the impact?

Successful exploitation of these vulnerabilities would have allowed an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Were updates or workarounds available?

There was no patched fixed version of this product available at the time. The vendor recommended disabling the "Spam Quarantine" feature and isolating potentially vulnerable systems behind network access controls.

How runZero users found potentially vulnerable systems

From the Service inventory, users ran the following query to locate potentially vulnerable assets:

_asset.protocol:=http AND protocol:=http AND last.html.title:"Cisco%Gateway%C" AND NOT last.html.title:"Cloud"

BeyondTrust CVE-2026-102764: Find impacted appliances

2024-12-20T00:00:00-05:00

Latest BeyondTrust vulnerability: CVE-2026-102764

Update (October 16, 2026): Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 16, 2026.

BeyondTrust disclosed that certain versions of BeyondTrust Remote Support are affected by an improper origin validation vulnerability in internal messaging components of the appliance. The components do not adequately validate the origin of the messages they receive, which, under the right conditions, allows an attacker to perform file operations on the appliance. The vulnerability has been designated CVE-2026-102764 and has been rated critical with a CVSS score of 9.3.

There is evidence that this vulnerability is being actively exploited in the wild; BeyondTrust reported that a threat actor compromised a Remote Support SaaS instance on August 29, 2026.

The following versions are affected

BeyondTrust Remote Support: Versions 26.2.3 and prior.

What is BeyondTrust Remote Support?

BeyondTrust Remote Support (RS) is an enterprise platform designed for help desks to securely access and troubleshoot end-user devices or mobile platforms across any network without a VPN.

What is the impact?

Successful exploitation of this vulnerability would allow an unauthenticated attacker to execute arbitrary file operations on the appliance under specific conditions, potentially leading to unauthorized access or full compromise of the affected Remote Support deployment.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

BeyondTrust Remote Support: Apply the BT26-05 patch.

Note: Self-hosted customers should manually apply the patch if their instance is not subscribed to automatic updates in the appliance interface. Customers running a Remote Support version older than 24.3.1 must first upgrade to a newer version to apply the patch.

Finding exposed BeyondTrust appliances with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="BeyondTrust" AND product:="Remote Support" AND source:runzero

July 2026: Multiple CVEs

BeyondTrust disclosed multiple pre-authentication authorization vulnerabilities affecting certain versions of both Remote Support (RS) and Privileged Remote Access (PRA). The vulnerabilities have been designated CVE-2026-40138, CVE-2026-40139, CVE-2026-40140, & CVE-2026-40141 and has the highest risk of the vulnerabilities been rated critical with a CVSS score of 9.2.

What are BeyondTrust Remote Support, and Privileged Remote Access?

BeyondTrust Remote Support (RS) is an enterprise platform designed for help desks to securely access and troubleshoot end-user devices or mobile platforms across any network without a VPN.

BeyondTrust Privileged Remote Access (PRA) is a zero-trust security solution providing vendors and internal admins with granular, audited access to critical infrastructure without granting full network visibility.

What is the impact?

Successful exploitation of these issues may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to appliances, impact availability, access internal appliance data, and in some configurations gain authenticated privilege escalation.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Remote Support (RS) versions 25.3.2 and prior upgrade to version 25.3.3 and later
Privileged Remote Access (PRA) versions 25.3.2 and prior upgrade to version 25.3.3 and later

How to find potentially vulnerable systems with runZero

From the Services Inventory, use the following query to locate potentially impacted assets:

_asset.protocol:=http AND protocol:=http AND
  (product:="BeyondTrust Remote Support" OR product:="BeyondTrust Privileged Remote Access")
  AND _service.product:beyondtrust

February 2026: CVE-2026-1731

BeyondTrust disclosed a pre-authentication remote code execution (RCE) vulnerability affecting certain versions of both Remote Support (RS) and Privileged Remote Access (PRA). This flaw is triggered via specially crafted client requests sent to the appliance. Successful exploitation could allow a remote, unauthenticated adversary to execute arbitrary operating system commands in the context of the site user, potentially leading to full system compromise. The vulnerability has been designated CVE-2026-1731 and has been rated critical with a CVSS score of 9.9.

There is evidence that this vulnerability is being actively exploited in the wild.

The following versions are affected:

Remote Support (RS) versions 25.3.1 and prior
Privileged Remote Access (PRA) versions 24.3.4 and prior

What is the impact?

Successful exploitation of the vulnerability would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Remote Support (RS) versions 21.3 and older upgrade to a newer version to apply patch BT26-02-RS
Remote Support (RS) versions 25.3.1 and prior upgrade to version 25.3.2 and later
Privileged Remote Access (PRA) versions 22.1 and older upgrade to a newer version to apply patch BT26-02-PRA
Privileged Remote Access (PRA) versions 24.3.4 and prior upgrade to version 25.1.1 and later

How to find potentially vulnerable systems with runZero

From the Services Inventory, use the following query to locate potentially impacted assets:

_asset.protocol:=http AND protocol:=http AND
  (product:="BeyondTrust Remote Support" OR
  product:="Beyond Trust Remote Support" OR
  product:="BeyondTrust BeyondTrust Remote Support" OR
  product:="BeyondTrust Privileged Remote Access")
  AND _service.product:beyondtrust

January 2025: CVE-2024-12356

BeyondTrust disclosed that affects their Privileged Remote Access (PRA) and Remote Support (RS) appliances. This has also been added to the CISA KEV as it has been exploited in the wild.

CVE-2024-12356 is rated highly-critical with a CVSS score of 9.8. Successful exploitation of this vulnerability would allow an attacker execute arbitrary commands on the appliance.

What is the impact?

The issue impacts PRA and RS versions 24.3.1 and earlier.

Are updates or workarounds available?

BeyondTrust has released a patch for all supported iterations of PRA and RS versions 22.1.x and higher and has applied the patch to cloud customers earlier this week.

How do I find potentially vulnerable systems with runZero?

From the Services Inventory, use the following query to locate systems running potentially vulnerable software:

vendor:BeyondTrust or http.body:BeyondTrust

From the Assets Inventory, use the following query to locate systems running potentially vulnerable software:

os:BeyondTrust OR hw:BeyondTrust OR os:Bomgar OR hw:Bomgar

Atlassian CVE-2026-21589: How to find impacted systems

2025-02-20T10:04:00-05:00

Critical Atlassian disclosure: CVE-2026-21589

Atlassian disclosed that certain versions of Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Software, and Jira Service Management contain an arbitrary file access vulnerability that allows an unauthenticated, remote attacker to access specific files within the web application root directory. Exploitation requires prior knowledge of the target file's exact name and path; the vulnerability does not allow an attacker to enumerate or list directory contents. In some configurations, sensitive files may be reachable this way, increasing the impact of exploitation. Atlassian Cloud sites have been patched and Atlassian's investigation found no evidence of exploitation against Cloud. This vulnerability has been designated CVE-2026-21589 and has been rated critical with a CVSS score of 9.3.

The following versions are affected:

Bamboo Data Center: All versions prior to 10.2.24 or 12.1.12.
Bitbucket Data Center: All versions prior to 9.4.26, 10.2.8, or 10.5.1.
Confluence Data Center: All versions prior to 9.2.26 or 10.2.19.
Crowd Data Center: All versions prior to 6.3.7, 7.0.3, 7.1.7, or 7.2.4.
Crucible: All versions prior to 4.9.15.
Fisheye: All versions prior to 4.9.15.
Jira Software Data Center: All versions prior to 9.12.40, 10.3.26, or 11.3.12.
Jira Service Management Data Center: All versions prior to 5.12.40, 10.3.26, or 11.3.12.

What are Atlassian Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Software, and Jira Service Management?

Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Software, and Jira Service Management are Atlassian's self-managed products for CI/CD, source control, collaboration, identity, code review, and issue tracking.

What is the impact?

Successful exploitation of this vulnerability would allow an unauthenticated, remote attacker to read arbitrary files within the web application root directory, potentially leading to the exposure of sensitive configuration data or credentials.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Bamboo Data Center: Upgrade to version 10.2.24, 12.1.12, or later.
Bitbucket Data Center: Upgrade to version 9.4.26, 10.2.8, 10.5.1, or later.
Confluence Data Center: Upgrade to version 9.2.26, 10.2.19, or later.
Crowd Data Center: Upgrade to version 6.3.7, 7.0.3, 7.1.7, 7.2.4, or later.
Crucible: Upgrade to version 4.9.15 or later.
Fisheye: Upgrade to version 4.9.15 or later.
Jira Software Data Center: Upgrade to version 9.12.40, 10.3.26, 11.3.12, or later.
Jira Service Management Data Center: Upgrade to version 5.12.40, 10.3.26, 11.3.12, or later.

Workaround:

If you are unable to patch immediately, remove the instance from the internet or apply a Web Application Firewall (WAF) rule to block requests with URLs containing ".." immediately adjacent to "/", "\", or "::" (including URL-encoded variants).
Atlassian has also published product-specific Tomcat RewriteValve mitigations in each advisory.

Finding exposed Atlassian installations with runZero

From the Software Inventory, use the following query to locate potentially impacted installations:

vendor:=Atlassian AND (product:=Confluence OR product:=Jira OR product:=Bitbucket OR product:=Crowd OR product:=Bamboo OR product:=Fisheye) AND source:runzero

Note: This query does not currently detect Crucible instances.

February 2025:

Atlassian issued a security bulletin for high and critical vulnerabilities found within third-party dependencies used within their products. The affected products include: Bamboo, Bitbucket, Confluence, Crowd, and JIRA.

Three of the critical vulnerabilities were found within the embedded Apache Tomcat web server. The first two: CVE-2024-50379, CVE-2024-56337 with a CVSS score of 9.8, affects Confluence Data Center and Server as well as Crowd Data Center and Server with the potential for a remote attacker to execute arbitrary code. CVE-2024-52316, also with a CVSS score of 9.8, affects Crowd Data Center and Server, potentially allows for an authentication bypass by a remote attacker.

One high vulnerability found within the protocol buffer library CVE-2024-7254, with a CVSS score of 8.7, affects Bamboo Data Center and Server in addition to Jira Data Center and Server, potentially leading to a denial of service (DoS).

Another high vulnerability found with the Avro serialization library CVE-2024-47561, with a CVSS score of 7.3, affects Bitbucket Data Center and Server potentially allowing for a remote attacker to execute arbitrary code.

What is the impact?

Bamboo, Crowd, and JIRA are vulnerable to denial of service vulnerabilities. Bitbucket, Confluence, and Crowd are vulnerable to unauthenticated remote execution of arbitrary code by a remote attacker. Crowd is also vulnerable to a broken authentication vulnerability.

Atlassian has indicated that there are no known active exploitations of the of the vulnerabilities. However, they recommend updating to the latest software revisions as soon as possible.

Are updates available?

Updates are available and detailed within the security bulletin.

How do I find potentially vulnerable instances with runZero?

From the Service Inventory, use the following query to locate systems running potentially vulnerable software:

(product:confluence OR (_asset.protocol:http AND protocol:http AND has:http.head.xConfluenceRequestTime)) OR (product:bamboo OR (_asset.protocol:http AND protocol:http AND _service.favicon.ico.image.mmh3:=-1379982221)) OR (product:bitbucket OR (_asset.protocol:http AND protocol:http AND _service.favicon.ico.image.mmh3:=667017222)) OR (product:crowd OR (_asset.protocol:http AND protocol:http AND _service.favicon.ico.image.mmh3:=-1231308448)) OR (product:jira OR (_asset.protocol:http AND protocol:http AND (_service.favicon.ico.image.mmh3:=628535358 OR _service.favicon.ico.image.mmh3:=855273746)))

SonicWall SonicOS vulnerabilities: Find impacted appliances

2024-09-06T10:00:00-04:00

Critical SonicWall SMA1000 vulnerabilities:

SonicWall disclosed that certain versions of SonicWall SMA1000 appliances are affected by multiple vulnerabilities:

CVE-2026-102255: A pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 Work Place interface, caused by an unintended alternate access path (forward proxy), allows a remote, unauthenticated attacker to direct the appliance to issue requests on their behalf, reach internal functionality, and perform unauthorized operations. The vulnerability has been designated CVE-2026-102255 and has been rated critical with a CVSS score of 10.0.
CVE-2026-102256: An OS command injection vulnerability in the SMA1000 appliance allows a remote attacker authenticated as an administrator to execute arbitrary OS commands, resulting in remote code execution. The vulnerability has been designated CVE-2026-102256 and has been rated high with a CVSS score of 7.8.
CVE-2026-102257: A Zip Slip vulnerability in the SMA1000 Appliance Management Console (AMC) interface allows an authenticated, high-privilege attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution. The vulnerability has been designated CVE-2026-102257 and has been rated high with a CVSS score of 7.2.
CVE-2026-102258: A stored cross-site scripting (XSS) vulnerability in the SMA1000 Appliance Management Console (AMC) allows a remote attacker authenticated as an administrator to store and potentially execute arbitrary JavaScript code in the AMC. The vulnerability has been designated CVE-2026-102258 and has been rated medium with a CVSS score of 6.1.

The following versions are affected

SonicWall SMA1000 (models 6210, 7210, and 8200v) 12.4: Versions 12.4.3-03526 (platform-hotfix) and older
SonicWall SMA1000 (models 6210, 7210, and 8200v) 12.5: Versions 12.5.0-02952 (platform-hotfix) and older

Note: These vulnerabilities do not affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.

What is SonicWall SMA1000?

SonicWall Secure Mobile Access (SMA) 1000 Series appliances are enterprise gateways that provide secure, policy-enforced Zero Trust and SSL VPN remote access to applications and network resources across on-premises, hybrid, and cloud environments.

What is the impact?

Successful exploitation of these vulnerabilities would allow an unauthenticated remote attacker to bypass access controls and perform unauthorized internal operations, or an authenticated attacker to achieve complete system compromise through arbitrary OS command execution on affected gateways.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

SonicWall SMA1000 (models 6210, 7210, and 8200v) 12.4: Upgrade to platform-hotfix 12.4.3-03670 or later.
SonicWall SMA1000 (models 6210, 7210, and 8200v) 12.5: Upgrade to platform-hotfix 12.5.0-03082 or later.

Finding exposed SonicWall SMA1000 appliances with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="SonicWall SMA1000" AND os:="SonicWall SMA1000" AND os_version:>0 AND (os_version:>=12.4 AND os_version:<12.6)

September 2026: CVE-2026-83548 & CVE-2026-83549

SonicWall disclosed that certain versions of the SMA1000 series appliances are susceptible to the following vulnerabilities:

CVE-2026-83548: A Server-Side Request Forgery (SSRF) vulnerability allows a remote unauthenticated attacker to access internal server resources and unintended locations. This vulnerability has been designated CVE-2026-83548 and has been rated critical with a CVSS score of 10.0.
CVE-2026-83549: A authenticated remote code execution (RCE) vulnerability in the SMA1000 could allow an attacker with authenticated access to execute OS commands. This vulnerability has been designated CVE-2026-83549 and has been rated high with a CVSS score of 7.8.

There is evidence that these vulnerabilities are being actively exploited in the wild and the vulnerability has been added to the CISA KEV list September 2nd, 2026.

The following versions are affected:

SMA1000 Models - 6210, 7210, 8200v
- 12.4.3-03453
- 12.5.0-02835

What is SonicWall SMA1000?

SonicWall Secure Mobile Access (SMA) 1000 series appliances are hardware security devices that provide zero-trust and secure access gateway support for businesses.

What is the impact?

Successful exploitation of the vulnerabilities allows an unauthenticated attacker with network access to gain unauthorized access to management functionality, potentially allowing an attacker to access administrative endpoints and if the vulnerabilities can be chained potentially remote code execution.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

Version 12.4.3-03526 or later
Version 12.5.0-02952 or later

Finding exposed SonicWall SMA1000 series with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="SonicWall SMA1000" AND os_version:>0 AND (os_version:=12.4.3 OR os_version:=12.5.0)

July 2026: CVE-2026-15409 and CVE-2026-15410

SonicWall disclosed that certain versions of the SMA1000 series appliances are susceptible to the following vulnerabilities:

CVE-2026-15409: A Server-Side Request Forgery (SSRF) vulnerability allows a remote unauthenticated attacker to access internal server resources and unintended locations. This vulnerability has been designated CVE-2026-15409 and has been rated critical with a CVSS score of 10.0.
CVE-2026-15410: A authenticated remote code execution (RCE) vulnerability in the SMA1000 Appliance Management Console (AMC) could allow an attacker with administrator permissions to execute OS commands. This vulnerability has been designated CVE-2026-15410 and has been rated high with a CVSS score of 7.2.

There is evidence that these vulnerabilities are being actively exploited in the wild and the vulnerability has been added to the CISA KEV list July 14th, 2026.

The following versions are affected:

SMA1000 Models - 6210, 7210, 8200v
- 12.4.3-03245
- 12.4.3-03387
- 12.4.3-03434
- 12.5.0-02283
- 12.5.0-02624
- 12.5.0-02800

What is the impact?

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

Version 12.4.3-03453 or later
Version 12.5.0-02835 or later

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="SonicWall SMA1000" AND os_version:>0 AND (os_version:=12.4.3 OR os_version:=12.5.0)

May 2026: CVE-2026-0204, CVE-2026-0205, and CVE-2026-0206

SonicWall disclosed that certain versions of SonicOS across Gen 6, Gen 7, and Gen 8 firewall platforms are susceptible to the following vulnerabilities:

CVE-2026-0204: A flaw in the access control mechanism may expose management interface functions under specific conditions. An unauthenticated attacker with adjacent network access could gain unauthorized access to management functionality, potentially leading to security control bypasses or administrative misuse. This vulnerability has been designated CVE-2026-0204 and has been rated high with a CVSS score of 8.0.
CVE-2026-0205: A post-authentication path traversal vulnerability allows an authenticated attacker with adjacent network access to interact with restricted services. This vulnerability has been designated CVE-2026-0205 and has been rated medium with a CVSS score of 6.8.
CVE-2026-0206: A post-authentication stack-based buffer overflow allows a remote, high-privileged attacker to cause a denial-of-service (DoS) by crashing the firewall. This vulnerability has been designated CVE-2026-0206 and has been rated medium with a CVSS score of 4.9.

While unconfirmed, the initial authentication bypass (CVE-2026-0204) may provide an unauthenticated attacker with the privileges necessary to chain and exploit the subsequent path traversal and buffer overflow vulnerabilities.

The following versions are affected:

Gen 6 Series (TZ 300/400/500/600, NSA 2650–6650, SOHO 250, SM 9200–9650): SonicOS version 6.5.5.1-6n and prior.
Gen 7 Series (TZ 270–670, NSa 2700–6700, NSsp 10700–15700, NSv 270-870): SonicOS 7.0.1-5169 and prior, and 7.3.1-7013 and prior.
Gen 8 Series (TZ 80–680, NSa 2800–5800): SonicOS version 8.1.0-8017 and prior.

What is the impact?

Successful exploitation of the vulnerabilities allows an unauthenticated attacker with adjacent network access to gain unauthorized access to management functionality, potentially leading to security control bypasses.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

Gen 6 Series: Upgrade to SonicOS version 6.5.5.2-28n or later.
Gen 7 Series: Upgrade to SonicOS version 7.3.2-7010 or later.
Gen 8 Series: Upgrade to SonicOS version 8.2.0-8009 or later.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="SonicWall%" AND os:="SonicWall SonicOS%" AND
  os_version:>0 AND ((os_version:<"6.5.5.2-28n") OR
  (os_version:>="7" AND os_version:<"7.3.2-7010") OR
  (os_version:>="8" AND os_version:<"8.2.0-8009"))

July 2025: SMA1000 series, multiple vulnerabilities

SonicWall has disclosed four vulnerabilities, across two advisories (SNWLID-2025-0014 and SNWLID-2025-0012), in certain versions of SMA 100 series products (SMA 210, 410 and 500v).

An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote adversary with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution (RCE). This vulnerability has been designated CVE-2025-40599 and has been rated critical with a CVSS score of 9.1.
A stack-based buffer overflow vulnerability in the SMA 100 series web interface may allow a remote, unauthenticated adversary to achieve remote code execution (RCE) or cause a denial-of-service (DoS) condition. This vulnerability has been designated CVE-2025-40596 and has been rated high with a CVSS score of 7.3.
A heap-based buffer overflow vulnerability in the SMA 100 series web interface may allow a remote, unauthenticated adversary to achieve remote code execution (RCE) or cause a denial-of-service (DoS) condition. This vulnerability has been designated CVE-2025-40597 and has been rated high with a CVSS score of 7.5.
A reflected cross-site scripting (XSS) vulnerability in the SMA 100 series web interface may allow a remote, unauthenticated adversary to execute arbitrary client-side JavaScript code in a victim's web browser. This vulnerability has been designated CVE-2025-40598 and has been rated medium with a CVSS score of 6.1.

The following versions are affected

SMA 100 Series (SMA 210, 410, 500v) version 10.2.1.15-81sv and prior versions

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable device, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

SMA 100 Series (SMA 210, 410, 500v) upgrade to version 10.2.2.1-90sv or later

There is no evidence these vulnerabilities are being exploited in the wild. However, due to latest threat intelligence from Google Threat Intelligence Group (GTIG), which highlights potential risks, SonicWall is strongly advising all organizations using SMA 100 series products to take additional measures detailed in the comments section of the security advisory SNWLID-2025-0014.

How to find potentially vulnerable systems with runZero

From the Asset Inventory , use the following query to locate potentially vulnerable assets:

hw:="SonicWall SMA100"

May 2025: SMA1000 series, multiple vulnerabilities

SonicWall has issued an advisory for its SMA100 Series appliances.

CVE-2025-32819 and has been rated high with a CVSS score of 8.8.
CVE-2025-32820 and has been rated high with a CVSS score of 8.3.
CVE-2025-32821 and has been rated medium with a CVSS score of 6.7.

What is the impact?

When chained together, the vulnerabilities could allow a remote authenticated attacker to bypass system checks leading to potential remote code execution. It does not affect SonicWall Firewall or SMA 1000 series appliances.

Are updates or workarounds available?

The vendor advises users to update to platform-hotfix (10.2.1.15-81sv or later) as soon as possible. The vendor also advises its customers to configure multifactor authentication (MFA) and enable WAF on the appliance.

How to find potentially vulnerable systems with runZero

From the Service Inventory, use the following query to locate systems running potentially vulnerable firmware:

hw:"SonicWall SMA100" OR (_asset.protocol:http AND http.head.server:="SonicWALL SSL-VPN Web Server")

January 2025: SMA1000 Series

SonicWall has issued an advisory for its SMA1000 Series appliances. The vendor reported that this vulnerability may be actively exploited in the wild.

This vulnerability has been designated CVE-2025-23006 and has been assigned a CVSS score of 9.8 (critical).

What is the impact?

The vulnerability would allow for a remote unauthenticated attacker to execute arbitrary operating system commands. The vulnerability was discovered within the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC). It does not affect SonicWall Firewall or SMA 100 series appliances.

Are updates or workarounds available?

The vendor advises users to update to platform-hotfix (12.4.3-02854 or later) as soon as possible. The vendor also advises its customers to follow the steps outlined in the Best Practices section of the SMA1000 Administration Guide. Access to the console should also be restricted to trusted networks.

How to find potentially vulnerable systems with runZero

From the Service Inventory, use the following query to locate systems running potentially vulnerable firmware:

hw:"SonicWall SMA1000" OR _asset.protocol:http (last.html.title:="Appliance Management Console Login" OR last.html.title:="Central Management Console Login" OR http.head.server:="SMA/%" OR (favicon.ico.image.mmh3:"16866410" AND (last.html.title:"WorkPlace" OR html.title:"WorkPlace")))

September 2024: SonicOS and SSLVPN

SonicWall disclosed a vulnerability that affects SonicOS management access and SSLVPN software on SonicWall Gen 5, Gen 6, in addition to Gen 7 devices running SonicOS version 7.0.1-5035 or earlier.

CVE-2024-40766 is rated critical with CVSS score of 9.3, and potentially allows for unauthorized resource access by an attacker.

What is the impact?

Successful exploitation of this vulnerability potentially results in unauthorized resource access and in some cases could lead to a DoS after causing vulnerable devices to crash.

Are updates or workarounds available?

SonicWall recommends restricting management access to trusted sources or disabling WAN management from the public Internet. Additionally, SonicWall has released updated firmware which is available for download from mysonicwall.com.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:"SonicWall"

Ivanti Connect Secure CVE-2026-104935: Find impacted appliances

2026-10-13T14:01:00-04:00

Critical Ivanti Connect Secure vulnerability: CVE-2026-104935

Ivanti disclosed certain versions of Ivanti Connect Secure are affected by an authentication bypass by spoofing vulnerability. A remote, unauthenticated attacker can exploit it to execute arbitrary commands on the appliance. The vulnerability has been designated CVE-2026-104935 and has been rated high with a CVSS score of 8.6.

Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026.

The following versions are affected

Ivanti Connect Secure 25.1: Versions 25.1.1.1 and prior, and versions 25.1.2.2 and prior
Ivanti Connect Secure 22.8: Versions 22.8R2.4 and prior

Ivanti Connect Secure 22.7R2.14 and prior, and 25.1.3.0 and later, are not affected.

What is Ivanti Connect Secure (ICS)?

Ivanti Connect Secure (ICS) (formerly Pulse Connect Secure) is a secure remote access and virtual private network (VPN) solution.

What is the impact?

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to bypass authentication and execute arbitrary commands on the affected appliance, resulting in complete device compromise and unauthorized control of the secure remote access environment.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Ivanti Connect Secure 25.1: Upgrade to version 25.1.1.2 (ISA6000 or ISA8000) or 25.1.3.0 or later (ISA4500, ISA6500, or ISA8500).
Ivanti Connect Secure 22.8: Upgrade to version 22.8R2.5, or preferably migrate to 25.1.1.2 or later.

Note: Ivanti Connect Secure 22.7 and 22.8 reach end of life on January 31, 2027; plan to transition to the 25.1 line before that date. Migrating to 25.1.3.0 requires the new ISA4500, ISA6500, or ISA8500 platform, or new virtual or cloud devices built from the 25.1.3.0 template. Run the Integrity Checker Tool regularly and review the indicators of compromise published by Volexity.

Finding exposed Ivanti Connect Secure appliances with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="Ivanti" AND product:="Connect Secure"

NetScaler ADC & Gateway vulnerabilities: Find impacted systems

2023-07-21T12:30:00-04:00

Actively exploited Citrix NetScaler vulnerability: CVE-2026-88779

Citrix published Security Bulletin CTX697174 disclosing a memory overflow vulnerability in customer-managed installations of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). A remote, unauthenticated attacker can trigger improper restriction of operations within the bounds of a memory buffer, leading to unpredictable or erroneous behavior or a denial-of-service (DoS) condition. This vulnerability has been designated CVE-2026-88779 and has been rated high with a CVSS score of 8.7.

Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 4, 2026.

The following versions are affected

NetScaler ADC and NetScaler Gateway 14.1: Versions prior to 14.1-73.41
NetScaler ADC and NetScaler Gateway 13.1: Versions prior to 13.1-64.28
NetScaler ADC 14.1-FIPS: Versions prior to 14.1-73.41 FIPS
NetScaler ADC 13.1-FIPS and 13.1-NDcPP: Versions prior to 13.1-37.282

What are Citrix NetScaler ADC and Citrix NetScaler Gateway?

Citrix NetScaler ADC (formerly Citrix ADC) is an application delivery controller that provides load balancing, traffic optimization, and web application security. Citrix NetScaler Gateway (formerly Citrix Gateway) is a secure remote access solution that handles user authentication and encrypted connections to internal applications and virtual desktops.

What is the impact?

Successful exploitation of these vulnerabilities would allow an unauthenticated remote attacker to execute arbitrary code with elevated privileges, potentially resulting in complete compromise of affected NetScaler appliances.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

NetScaler ADC and NetScaler Gateway 14.1: Upgrade to version 14.1-73.41 or later.
NetScaler ADC and NetScaler Gateway 13.1: Upgrade to version 13.1-64.28 or later.
NetScaler ADC 14.1-FIPS: Upgrade to version 14.1-73.41 FIPS or later.
NetScaler ADC 13.1-FIPS and 13.1-NDcPP: Upgrade to version 13.1-37.282 FIPS/NDcPP or later.

Finding exposed NetScaler ADC's and Gateway's with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

September 2026: CVE-2026-88771 through CVE-2026-88778

Update (September 28, 2026): The Rapid Response initially flagged unconfirmed reports of active exploitation prior to Citrix's disclosure of the CVEs below.

Citrix published Security Bulletin CTX697096, documenting eight vulnerabilities that impact customer-managed installations of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway).

CVE-2026-88771: Improper input validation allows an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability has been designated CVE-2026-88771 and has been rated critical with a CVSS score of 9.5.
CVE-2026-88772: Improper restriction of operations within the bounds of a memory buffer allows an unauthenticated, remote attacker to achieve remote code execution (RCE) or cause a denial-of-service condition. The vulnerability has been designated CVE-2026-88772 and has been rated critical with a CVSS score of 9.5.
CVE-2026-88773: Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) allows a remote attacker to manipulate how requests and responses are processed. The vulnerability has been designated CVE-2026-88773 and has been rated critical with a CVSS score of 9.3.
CVE-2026-88774: Improper use of HTTP URL based expressions in a feature policy allows a remote attacker to bypass configured policy restrictions. The vulnerability has been designated CVE-2026-88774 and has been rated high with a CVSS score of 7.0.
CVE-2026-88775: A memory overflow condition can lead to unpredictable or erroneous behavior or a denial-of-service condition. The vulnerability has been designated CVE-2026-88775 and has been rated high with a CVSS score of 8.8.
CVE-2026-88776: A memory overflow condition can lead to unpredictable or erroneous behavior or a denial-of-service condition. The vulnerability has been designated CVE-2026-88776 and has been rated high with a CVSS score of 8.8.
CVE-2026-88777: A memory overflow condition can lead to unpredictable or erroneous behavior or a denial-of-service condition. The vulnerability has been designated CVE-2026-88777 and has been rated high with a CVSS score of 8.8.
CVE-2026-88778: Use of a predictable exact value derived from previous values allows a remote attacker to predict a security-sensitive value. The vulnerability has been designated CVE-2026-88778 and has been rated high with a CVSS score of 8.8.

Evidence indicates that CVE-2026-88771 and CVE-2026-88772 are actively exploited in the wild, leading to their addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 27, 2026.

The following versions are affected

NetScaler ADC and NetScaler Gateway 14.1: Versions prior to 14.1-73.37
NetScaler ADC and NetScaler Gateway 13.1: Versions prior to 13.1-64.23
NetScaler ADC 14.1-FIPS: Versions prior to 14.1-73.37 FIPS
NetScaler ADC 13.1-FIPS and 13.1-NDcPP: Versions prior to 13.1-37.279 FIPS/NDcPP

What is the impact?

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

NetScaler ADC and NetScaler Gateway 14.1: Upgrade to version 14.1-73.37 or later.
NetScaler ADC and NetScaler Gateway 13.1: Upgrade to version 13.1-64.23 or later.
NetScaler ADC 14.1-FIPS: Upgrade to version 14.1-73.37 FIPS or later.
NetScaler ADC 13.1-FIPS and 13.1-NDcPP: Upgrade to version 13.1-37.279 FIPS/NDcPP or later.

Finding exposed NetScaler ADC's and Gateway's with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

August 2026: CVE-2026-19489 and CVE-2026-19490

Citrix published Security Bulletin CTX696939, documenting two vulnerabilities that impact customer-managed installations of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway).

CVE-2026-19489: A memory overflow vulnerability leading to unpredictable behavior or a denial-of-service (DoS) condition when the Session Initiation Protocol (SIP) Application Layer Gateway (ALG) is enabled on a Large Scale NAT (LSN) group configuration. Successful exploitation allows a remote, unauthenticated attacker to cause a DoS and potentially achieve remote code execution (RCE), though RCE has not been confirmed. This vulnerability has been rated high with a CVSS score of 8.8.
CVE-2026-19490: An authentication bypass vulnerability using an alternate path in appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an Authentication, Authorization, and Auditing (AAA) virtual server. Affected instances are subject to version-specific prerequisites; please review the vendor advisory for specific details. Successful exploitation allows a remote, unauthenticated attacker to gain unauthorized access to the system. This vulnerability has been rated critical with a CVSS score of 9.3.

The following versions are affected

NetScaler ADC and NetScaler Gateway 14.1: Versions prior to 14.1-73.32
NetScaler ADC and NetScaler Gateway 13.1: Versions prior to 13.1-63.21
NetScaler ADC 14.1-FIPS: Versions prior to 14.1-73.32 FIPS
NetScaler ADC 13.1-FIPS and 13.1-NDcPP: Versions prior to 13.1-37.277

Note: Citrix ADC / NetScaler 13.0 and prior have reached end of life. Citrix has made no statements regarding the vulnerabilities in these versions, but they are possibly affected as well.

What is the impact?

Successful exploitation of these vulnerabilities would allow a remote, unauthenticated attacker to gain unauthorized access to target appliances, disrupt system availability, or potentially execute arbitrary code.

Are updates or workarounds available?

Citrix recommends upgrading affected systems to one of the following versions as soon as possible:

NetScaler ADC and NetScaler Gateway 14.1: Upgrade to version 14.1-73.32 or later.
NetScaler ADC and NetScaler Gateway 13.1: Upgrade to version 13.1-63.21 or later.
NetScaler ADC 14.1-FIPS: Upgrade to version 14.1-73.32 FIPS or later.
NetScaler ADC 13.1-FIPS and 13.1-NDcPP: Upgrade to version 13.1-37.277 FIPS/NDcPP or later.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

July 2026: Multiple CVE's

Citrix has published Security Bulletin CTX696604, documenting multiple vulnerabilities that impact customer-managed installations of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). In certain gateway and load-balancing configurations, these devices are vulnerable to multiple vulnerabilities:

CVE-2026-8451 - Insufficient input validation leading to memory overread. This vulnerability is considered high with a CVSS score of 8.8.
CVE-2026-8452 - Memory overflow vulnerability. This vulnerability is considered high, with a CVSS score of 8.8.
CVE-2026-8655 - Memory overflow vulnerability. This vulnerability is considered high, with a CVSS score of 8.8.
CVE-2026-10816 - Unauthenticated arbitrary file read. This vulnerability is considered high, with a CVSS score of 7.1.
CVE-2026-13474 - Denial of service through malformed HTTP/2 requests. This vulnerability is considered high, with a CVSS score of 8.7.

Update (August 26, 2026): There is evidence that CVE-2026-8452 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 26, 2026.

The following versions are affected:

NetScaler ADC: Versions 14.1 BEFORE 72.61
NetScaler ADC: Versions 14.1 FIPs BEFORE 72.61
NetScaler ADC: Versions 13.1 BEFORE 63.18
NetScaler ADC: Versions 13.1 FIPS and NDcPP BEFORE 37.272
NetScaler Gateway: Versions 14.1 BEFORE 72.61
NetScaler Gateway: Versions 13.1 BEFORE 63.18

Note: Citrix ADC / NetScaler 13.0 and prior have reached end of life. Citrix has made no statements regarding the vulnerabilities in these versions, but they are possibly affected as well.

What is the impact?

Citrix has not published guidance on the impact of these vulnerabilities. Given the values that they have provided for the CVSS score it likely that successful exploitation of these vulnerabilities could result in full system compromise.

Are updates or workarounds available?

Citrix recommends upgrading affected systems to one of the following versions as soon as possible:

NetScaler ADC and NetScaler Gateway 14.1-72.61 and later releases
NetScaler ADC and NetScaler Gateway 13.1-63.18 and later releases of 13.1
NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.272 and later releases of 13.1-FIPS and 13.1-NDcPP

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

March 2026 (CVE-2026-3055, CVE-2026-4368)

Citrix has published Security Bulletin CTX696300, documenting multiple vulnerabilities that impact customer-managed installations of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). In certain gateway and load-balancing configurations, these devices are vulnerable to multiple vulnerabilities:

CVE-2026-3055 - Insufficient input validation leading to memory overread. This vulnerability is considered critical with a CVSS score of 9.3.
CVE-2026-4368 - A race condition could lead to user session mixup. This vulnerability is considered severe, with a CVSS score of 7.7.

The following versions are affected:

NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-66.59
NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-62.23
NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.262

Note: Citrix ADC / NetScaler 13.0 and prior have reached end of life. Citrix has made no statements regarding the vulnerabilities in these versions, but they are possibly affected as well.

What is the impact?

Are updates or workarounds available?

Citrix recommends upgrading affected systems to one of the following versions as soon as possible:

NetScaler ADC and NetScaler Gateway 14.1-66.59 and later releases
NetScaler ADC and NetScaler Gateway 13.1-62.23 and later releases of 13.1
NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.262 and later releases of 13.1-FIPS and 13.1-NDcPP

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

September 2025 (Multiple CVEs)

Citrix has published Security Bulletin CTX694938, documenting multiple vulnerabilities that impact customer-managed installations of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). In certain gateway and load-balancing configurations, these devices are vulnerable to multiple vulnerabilities:

CVE-2025-7775 - A memory corruption vulnerability that could allow a remote attacker to execute arbitrary code on the system. This vulnerability is considered critical with a CVSS score of 9.2.
CVE-2025-7776 - A memory corruption vulnerability that could allow a remote attacker to create a denial-of-service condition. This vulnerability is considered severe, with a CVSS score of 8.8.
CVE-2025-8424 - An improper authentication vulnerability that could allow a remote attacker to gain access to sensitive system resources without proper authorization. This vulnerability is considered severe, with a CVSS score of 8.7.

There is evidence that CVE-2025-775 is being actively exploited in the wild.

The following versions are affected:

NetScaler ADC and NetScaler Gateway 14.1  before 14.1-47.48
NetScaler ADC and NetScaler Gateway 13.1  before 13.1-59.22
NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.241-FIPS and NDcPP
NetScaler ADC 12.1-FIPS and NDcPP before 12.1-55.330-FIPS and NDcPP

What is the impact?

Successful exploitation of this vulnerability could allow an adversary to execute arbitrary code on the vulnerable system, potentially leading to total system compromise or a denial-of-service condition.

Are updates or workarounds available?

Citrix recommends upgrading affected systems to one of the following versions as soon as possible:

NetScaler ADC and NetScaler Gateway 14.1-47.48 and later releases
NetScaler ADC and NetScaler Gateway 13.1-59.22 and later releases of 13.1
NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.241 and later releases of 13.1-FIPS and 13.1-NDcPP
NetScaler ADC 12.1-FIPS and 12.1-NDcPP 12.1-55.330 and later releases of 12.1-FIPS and 12.1-NDcPP

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

June 2025 (CVE-2025-6543)

Citrix published Security Bulletin CTX694788 that documented a vulnerability that impacts customer-managed installations of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or Authentication, Authorization and Auditing (AAA) virtual server are affected by a memory overflow vulnerability. This vulnerability has been designated CVE-2025-6543 and has been rated critical with a CVSS score of 9.2.

There is evidence that this vulnerability is being actively exploited in the wild.

The following versions are affected

NetScaler ADC and NetScaler Gateway 14.1 prior to 14.1-47.46
NetScaler ADC and NetScaler Gateway 13.1 prior to 13.1-59.19
NetScaler ADC 13.1-FIPS and NDcPP prior to 13.1-37.236-FIPS and NDcPP

What is the impact?

Successful exploitation of this vulnerability could allow an adversary to make unintended changes to control flow, potentially allowing remote code execution (RCE) or causing denial-of-service (DoS).

Are updates or workarounds available?

Citrix recommends upgrading affected systems to one of the following versions as soon as possible:

NetScaler ADC and NetScaler Gateway to version 14.1-47.46 and later releases
NetScaler ADC and NetScaler Gateway to version 13.1-59.19 and later releases of 13.1
NetScaler ADC 13.1-FIPS and 13.1-NDcPP to version 13.1-37.236 and later releases of 13.1-FIPS and 13.1-NDcPP

NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 are end-of-life (EOL) and no longer supported. It is recommended to upgrade to one of the currently supported versions that address the vulnerabilities.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

June 2025 (CVE-2025-5777, CVE-2025-5349)

Citrix published Security Bulletin CTX693420 that documented two vulnerabilities that impact customer-managed installations of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). There is evidence that one of the vulnerabilities, designated by CVE-2025-5777, is being actively exploited in the wild.

NetScaler configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or Authentication, Authorization and Auditing (AAA) virtual server are at risk of an insufficient input validation vulnerability leading to memory out-of-bounds read in the NetScaler Management Interface which could allow access to secret values, bypass of protection mechanism, DoS or other unexpected results. This vulnerability has been designated CVE-2025-5777 and has been rated critical with a CVSS score of 9.3.
An attacker with access to the NetScaler appliance IP (NSIP) address, Cluster Management IP (CLIP) address or local Global Server Load Balancing (GSLB) Site IP (GSLBIP) address could utilize an improper access control vulnerability to gain access the the NetScaler Management Interface and its management functions. This vulnerability has been designated CVE-2025-5349 and has been rated high with a CVSS score of 8.7.

The following versions are affected

NetScaler ADC and NetScaler Gateway 14.1 prior to 14.1-43.56
NetScaler ADC and NetScaler Gateway 13.1 prior to 13.1-58.32
NetScaler ADC 13.1-FIPS and NDcPP prior to 13.1-37.235-FIPS and NDcPP
NetScaler ADC 12.1-FIPS prior to 12.1-55.328-FIPS

What is the impact?

Successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive information, potentially disrupt system operations and cause a denial-of-service, or gain control over the NetScaler Management Interface and its management functions potentially leading to system compromise.

Are updates or workarounds available?

Citrix recommends upgrading affected systems to one of the following versions as soon as possible:

NetScaler ADC and NetScaler Gateway to version 14.1-43.56 and later releases
NetScaler ADC and NetScaler Gateway to version 13.1-58.32 and later releases of 13.1
NetScaler ADC 13.1-FIPS and 13.1-NDcPP to version 13.1-37.235 and later releases of 13.1-FIPS and 13.1-NDcPP
NetScaler ADC 12.1-FIPS to version 12.1-55.328 and later releases of 12.1-FIPS

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

February 2025 (CVE-2024-12284)

Citrix issued a security bulletin for the on-premise NetScaler Console (formerly NetScaler ADM) and NetScaler Agent products. CVE-2024-12284 is rated high with a CVSS score of 8.8, which could lead to privilege escalation.

What is the impact?

For customers running an on-premise installation of NetScaler Console with NetScaler Console Agents deployed, an authenticated remote attacker could "execute commands without additional authorization". NetScaler emphasized that an attacker must be authenticated, which limits the potential impact.

Are updates or workarounds available?

Citrix recommends upgrading to one of the following versions as soon as possible:

NetScaler Console 14.1-38.53 and later releases
NetScaler Console 13.1-56.18 and later releases of 13.1
NetScaler Agent 14.1-38.53 and later releases
NetScaler Agent 13.1-56.18 and later releases of 13.1

How to find potentially vulnerable systems with runZero

From the Service Inventory, use the following query to locate systems running potentially vulnerable software:

_asset.protocol:http AND protocol:http AND html.title:="NetScaler Console"

June 2024 (CVE-2023-6548, CVE-2023-6549)

In January Citrix published Security Bulletin CTX584986 that documented two vulnerabilities that impact NetScaler ADCs and Gateways. The most severe of these, CVE-2023-6549, was discovered and documented by BishopFox.

CVE-2023-6549 is rated high with a CVSS score of 8.2. This vulnerability is an unauthenticated out-of-bounds memory read which could be exploited to collect information from the appliance’s process memory, including HTTP request bodies. While serious, this is not thought to be a bad as the Citrix Bleed vulnerability due to the new vulnerability being less likely to leak high risk data.

CVE-2023-6548 is rated medium with a CVSS score of 5.5. This vulnerability is a code injection flaw that allows remote code injection by an authenticated attacker (with low privileged) with access to a management interface on one of the NSIP, CLIP or SNIP interfaces.

What is the impact?

The vulnerability would enable an attacker to remotely obtain sensitive information from a NetScaler appliance configured as a Gateway or AAA virtual server via a very commonly connected Web interface, and without requiring authentication. CVE-2023-6549 is nearly identical to the Citrix Bleed vulnerability (CVE-2023-4966), except it is less likely to return highly sensitive information to an attacker. CVE-2023-6548 could be used by an attacker with credentials to execute code.

Are updates or workarounds available?

Citrix recommends limiting access to management interfaces as well as upgrading to one of the following versions:

NetScaler ADC and NetScaler Gateway 14.1-12.35 and later releases
NetScaler ADC and NetScaler Gateway  13.1-51.15 and later releases of 13.1
NetScaler ADC and NetScaler Gateway 13.0-92.21 and later releases of 13.0
NetScaler ADC 13.1-FIPS 13.1-37.176 and later releases of 13.1-FIPS 
NetScaler ADC 12.1-FIPS 12.1-55.302 and later releases of 12.1-FIPS 
NetScaler ADC 12.1-NDcPP 12.1-55.302 and later releases of 12.1-NDcPP

Warning: NetScaler ADC and NetScaler Gateway version 12.1 is now End Of Life (EOL). Citrix advises customers to upgrade their appliances to one supported version that addresses the vulnerabilities.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

product:netscaler OR product:"citrix adc"

July 2023 (CVE-2023-3519)

In July, 2023, Citrix alerted customers to three vulnerabilities in its NetScaler ADC and NetScaler Gateway products. Surfaced by researchers at Resillion, these vulnerabilities included a critical flaw currently being exploited in the wild to give attackers unauthenticated remote code execution on vulnerable NetScaler targets (CVE-2023-3519). Compromised organizations included a critical infrastructure entity in the U.S., where attackers gained access the previous month and successfully exfiltrated Active Directory data. And at the time of publication, there appear to be over 5,000 public-facing vulnerable NetScaler targets.

What was the impact?

The three reported vulnerabilities affecting NetScaler ADC and Gateway products were of various types, and each include different preconditions required for exploitation:

Unauthenticated remote code execution (CVE-2023-3519; CVSS score 9.8 - "critical")
- Successful exploitation required the NetScaler target be configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or "authentication, authorization, and auditing" (AAA) virtual server.
Reflected cross-site scripting (XSS) (CVE-2023-3466; CVSS score 8.3 - "high")
- Successful exploitation required the victim to be on the same network as the vulnerable NetScaler target when the victim loaded a malicious link (planted by the attacker) in their web browser.
Privilege escalation to root administrator (nsroot) (CVE-2023-3467; CVSS score 8.0 - "high")
- Successful exploitation required an attacker having achieved command-line access on a vulnerable NetScaler target.

U.S.-based CISA reported attackers exploiting CVE-2023-3519 to install webshells used in further network exploration and data exfiltration, causing CVE-2023-3519 to be added to CISA's Known Exploited Vulnerabilities Catalog. Other common attacker goals, like establishing persistence, lateral movement, and malware deployment, were all potential outcomes following successful exploitation.

Citrix made patched firmware updates available. Admins were advised to update older firmware on vulnerable NetScaler devices as soon as possible.

CISA also made additional information available around indicators of compromise and mitigations.

How to find potentially vulnerable systems with runZero

From the Asset inventory, they used the following prebuilt query to locate NetScaler instances on their network:

hw:="Citrix NetScaler%" OR hw:="Citrix ADC%" OR os:="Citrix NetScaler%" OR os:="Citrix ADC"

Results from the above query should be triaged to verify they are affected ADC or Gateway products and if they are running updated firmware versions.

The following query could also be used in on the Software and Services inventory pages to locate NetScaler software:

product:netscaler

Results from the above query should be triaged to verify they are affected ADC or Gateway products and if they are updated versions.

As always, any prebuilt queries are available from your runZero console. Check out the documentation for other useful inventory queries.

Zammad vulnerabilities: Find impacted installations

2026-10-02T18:29:00-04:00

Zammad vulnerabilities: CVE-2026-102489 and CVE-2026-102490

While investigating a separate incident (DIVD-2026-00014), the Dutch Institute for Vulnerability Disclosure (DIVD) identified (DIVD-2026-00015) two vulnerabilities in Zammad:

CVE-2026-102489: A session hijacking vulnerability classified under CWE-384 (Session Fixation) that allows aremote attacker to hijack a Zammad user's session, potentially leading to remote code execution (RCE) under the context of the local zammad user. The vulnerability has been designated CVE-2026-102489 and has been rated high with a CVSS score of 8.7.
CVE-2026-102490: A local privilege escalation vulnerability enabling the local zammad user to escalate privileges to root. The vulnerability has been designated CVE-2026-102490 and has been rated high with a CVSS score of 8.5.

Evidence indicates that CVE-2026-102489 and CVE-2026-102490 are actively exploited in the wild, leading to their addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 2, 2026.

The following versions are affected

Zammad: Versions 1.5.0 through 7.1.0-alpha.

Exploitability Notes:

CVE-2026-102489: Directly affects versions 6.3.0 through 6.5.4. Versions 7.0.0 through 7.1.3 contain the underlying code flaw but are not exploitable in practice due to runtime environment conditions on those releases.
CVE-2026-102490: Reported to affect versions 1.5.0 through 7.1.0-alpha. The vendor disputes this report, stating it has not received technical details from DIVD to confirm the flaw, its scope, or affected releases.

What is Zammad?

Zammad is an open source help desk and ticketing system that organizations self-host to manage customer support requests across email, chat, and social channels.

What is the impact?

Successful exploitation of these vulnerabilities would allow an unauthenticated remote attacker to compromise user sessions and potentially achieve complete root-level takeover of the host operating system.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Zammad: Upgrade to version 7.2.0 or later.

Remediation Notes:

CVE-2026-102489: Version 7.2.0 includes security hardening to resolve this vulnerability.
CVE-2026-102490: Zammad has not released an official patch as of this writing. Follow Zammad's security advisories (https://github.com/zammad/zamm...) for patch updates.
End-of-Support (EOS) Systems: Versions 6.5 and earlier have reached end-of-support and no longer receive security fixes. Administrators should upgrade to a supported release regardless of specific exploitability metrics.

Finding exposed Zammad installations with runZero

From the Service inventory, use the following query to locate potentially impacted installations:

_asset.protocol:=http AND protocol:=http AND favicon.ico.image.mmh3:="-1687285536"

Fortinet FortiMail CVE-2026-104286: Find impacted applicances

2026-10-01T18:31:00-04:00

Fortinet FortiMail: CVE-2026-104286

Fortinet disclosed that certain versions of FortiMail contain an improper limitation of a pathname to a restricted directory ('path traversal') and improper neutralization of NULL byte vulnerabilities. These flaws allow an unauthenticated, remote attacker to write arbitrary files to the underlying system via crafted HTTP or HTTPS requests. This vulnerability has been designated CVE-2026-104286 and has been rated critical with a CVSS score of 9.8.

Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 1, 2026.

The following versions are affected

FortiMail 8.0: Versions 8.0.0 through 8.0.1
FortiMail 7.6: Versions 7.6.0 through 7.6.6
FortiMail 7.4: Versions 7.4.0 through 7.4.8
FortiMail 7.2: Versions 7.2.0 through 7.2.9

What is Fortinet FortiMail?

FortiMail is Fortinet's email security appliance, providing antispam, antivirus, and data loss prevention capabilities for inbound and outbound mail traffic.

What is the impact?

Successful exploitation of these vulnerabilities would allow an unauthenticated, remote attacker to write arbitrary files to the underlying system, potentially leading to unauthorized system compromise or loss of availability.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

FortiMail 8.0: Upgrade to version 8.0.2 or later.
FortiMail 7.6: Upgrade to version 7.6.7 or later.
FortiMail 7.4: Upgrade to version 7.4.9 or later.
FortiMail 7.2: Upgrade to the 7.4 branch or later.

Workaround:

Disable Identity-Based Encryption (IBE) support using the CLI. Consult the vendor advisory for further details.
Alternatively, disable access to the FortiMail management interface from the internet or restrict access to a trusted private network.

Finding exposed Fortinet FortiMail appliances with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Fortinet FortiMail"

Cisco Catalyst SD-WAN CVE-2026-76504: Find impacted systems

2026-02-25T15:57:00-05:00

Critical Cisco Catalyst SD-WAN vulnerability: CVE-2026-76504

Cisco disclosed certain versions of Cisco Catalyst SD-WAN Manager (formerly vManage) contain a vulnerability in the authentication verification mechanism. A remote, unauthenticated adversary could exploit this by sending crafted requests to an affected system to bypass authentication and obtain administrative privileges. The vulnerability has been designated CVE-2026-76504 and has been rated critical with a CVSS score of 9.8.

There is evidence that this vulnerability is being actively exploited in the wild.

The following deployment environments are affected

On-Premise deployments

The following versions are affected

Catalyst SD-WAN releases prior to 20.9
Catalyst SD-WAN release 20.9 versions prior to 20.9.10.1
Catalyst SD-WAN release 20.12 versions prior to 20.12.8.2
Catalyst SD-WAN release 20.15 versions prior to 20.15.6.1
Catalyst SD-WAN release 20.18 versions prior to 20.18.4.1
Catalyst SD-WAN release 26.1 versions prior to 26.1.2.1
Catalyst SD-WAN release 26.2 versions prior to 26.2.1

What is Cisco Catalyst SD-WAN Manager?

The Cisco Catalyst SD-WAN Manager acts as the centralized management system, providing the graphical interface necessary for the configuration, monitoring, and orchestration of all devices within the fabric.

What is the impact?

Successful exploitation of the vulnerability would allow an attacker to bypass authentication checks and gain admin access to the administrative APIs.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Catalyst SD-WAN releases prior to 20.9 migrate to a fixed release.
Catalyst SD-WAN release 20.9 upgrade to version 20.9.10.1 and later.
Catalyst SD-WAN release 20.12 upgrade to version 20.12.8.2 and later.
Catalyst SD-WAN release 20.15 upgrade to version 20.15.6.1 and later.
Catalyst SD-WAN release 20.18 upgrade to version 20.18.4.1 and later.
Catalyst SD-WAN release 26.1 upgrade to version to 26.1.2.1 and later.
Catalyst SD-WAN release 26.2 upgrade to version 26.2.1 and later.

Finding exposed systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Cisco vManage" OR os:="Cisco Viptela OS"

May 2026 Cisco Catalyst SD-WAN vulnerability: CVE-2026-20182

Cisco disclosed certain versions of Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage) contain a vulnerability in the peering authentication mechanism. A remote, unauthenticated adversary could exploit this by sending crafted requests to an affected system to bypass authentication and obtain administrative privileges. By leveraging an internal, high-privileged, non-root user account, the adversary could access NETCONF, enabling them to manipulate the network configuration for the entire SD-WAN fabric. The vulnerability has been designated CVE-2026-20182 and has been rated critical with a CVSS score of 10.0.

There is evidence that this vulnerability is being actively exploited in the wild.

The following deployment environments are affected

On-Premise deployments
Cisco Hosted SD-WAN Cloud (Standard, Cisco Managed, and FedRAMP)

The following versions are affected

Catalyst SD-WAN releases prior to 20.9
Catalyst SD-WAN release 20.9 versions prior to 20.9.9.1
Catalyst SD-WAN release 20.10 versions prior to 20.12.7.1
Catalyst SD-WAN release 20.11 versions prior to 20.12.7.1
Catalyst SD-WAN release 20.12 versions prior to 20.12.5.4
Catalyst SD-WAN release 20.12 versions prior to 20.12.6.2
Catalyst SD-WAN release 20.13 versions prior to 20.12.7.1
Catalyst SD-WAN release 20.13 versions prior to 20.15.5.2
Catalyst SD-WAN release 20.14 versions prior to 20.15.5.2
Catalyst SD-WAN release 20.15 versions prior to 20.15.4.4
Catalyst SD-WAN release 20.15 versions prior to 20.15.5.2
Catalyst SD-WAN release 20.16 versions prior to 20.18.2.2
Catalyst SD-WAN release 20.18 versions prior to 20.18.2.2
Catalyst SD-WAN release 26.1 versions prior to 26.1.1.1

What is the impact?

Successful exploitation of the vulnerability would allow an adversary to obtain administrative privileges manipulate the network configuration for the entire SD-WAN fabric.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Catalys SD-WAN releases prior to 20.9 migrate to a fixed release.
Catalyst SD-WAN release 20.9 upgrade to version 20.9.9.1 and later.
Catalyst SD-WAN release 20.10 upgrade to version 20.12.7.1 and later.
Catalyst SD-WAN release 20.11 upgrade to version 20.12.7.1 and later.
Catalyst SD-WAN release 20.12 upgrade to version 20.12.5.4 and later.
Catalyst SD-WAN release 20.12 upgrade to version 20.12.6.2 and later.
Catalyst SD-WAN release 20.13 upgrade to version 20.12.7.1 and later.
Catalyst SD-WAN release 20.13 upgrade to version 20.15.5.2 and later.
Catalyst SD-WAN release 20.14 upgrade to version 20.15.5.2 and later.
Catalyst SD-WAN release 20.15 upgrade to version 20.15.4.4 and later.
Catalyst SD-WAN release 20.15 upgrade to version 20.15.5.2 and later.
Catalyst SD-WAN release 20.16 upgrade to version 20.18.2.2 and later.
Catalyst SD-WAN release 20.18 upgrade to version 20.18.2.2 and later.
Catalyst SD-WAN release 26.1 upgrade to version 26.1.1.1 and later.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Cisco vManage" OR os:="Cisco Viptela OS"

Note: The query locates Cisco Catalyst SD-WAN Manager installations.

March 2026 Cisco Catalyst SD-WAN vulnerability: CVE-2026-20127

Cisco disclosed certain versions of Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage) contain a vulnerability in the peering authentication mechanism. A remote, unauthenticated adversary could exploit this by sending crafted requests to an affected system to bypass authentication and obtain administrative privileges. By leveraging an internal, high-privileged, non-root user account, the adversary could access NETCONF, enabling them to manipulate the network configuration for the entire SD-WAN fabric. The vulnerability has been designated CVE-2026-20127 and has been rated critical with a CVSS score of 10.0.

There is evidence that this vulnerability is being actively exploited in the wild.

On March 11, 2026, CISA published V1: ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems. This version supersedes the actions outlined in the original February 25 directive, introducing updated remediation steps and new reporting requirements for affected organizations.

The following deployment environments are affected

On-Premise deployments
Cisco Hosted SD-WAN Cloud (Standard, Cisco Managed, and FedRAMP)

The following versions are affected

Catalyst SD-WAN releases prior to 20.9
Catalyst SD-WAN release 20.9 versions prior to 20.9.8.2
Catalyst SD-WAN release 20.11 versions prior to 20.12.6.1
Catalyst SD-WAN release 20.12.5 versions prior to 20.12.5.3
Catalyst SD-WAN release 20.12.6 versions prior to 20.12.6.1
Catalyst SD-WAN release 20.13 versions prior to 20.15.4.2
Catalyst SD-WAN release 20.14 versions prior to 20.15.4.2
Catalyst SD-WAN release 20.15 versions prior to 20.15.4.2
Catalyst SD-WAN release 20.16 versions prior to 20.18.2.1
Catalyst SD-WAN release 20.18 versions prior to 20.18.2.1

What is the impact?

Successful exploitation of the vulnerability would allow an adversary to obtain administrative privileges manipulate the network configuration for the entire SD-WAN fabric.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Catalyst SD-WAN releases prior to 20.9 migrate to a fixed release
Catalyst SD-WAN release 20.9 upgrade to version 20.9.8.2 and later
Catalyst SD-WAN release 20.11 upgrade to version 20.12.6.1 and later
Catalyst SD-WAN release 20.12.5 upgrade to version 20.12.5.3 and later
Catalyst SD-WAN release 20.12.6 upgrade to version 20.12.6.1 and later
Catalyst SD-WAN release 20.13 upgrade to version 20.15.4.2 and later
Catalyst SD-WAN release 20.14 upgrade to version 20.15.4.2 and later
Catalyst SD-WAN release 20.14 upgrade to version 20.15.4.2 and later
Catalyst SD-WAN release 20.16 upgrade to version 20.18.2.1 and later
Catalyst SD-WAN release 20.18 upgrade to version 20.18.2.1 and later

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Cisco vManage" OR os:="Cisco Viptela OS"

Note: The query locates Cisco Catalyst SD-WAN Manager installations.

Check Point critical vulnerabilities: Find impacted systems

2024-05-31T12:36:00-04:00

Critical Check Point advisories: CVE-2026-85102, CVE-2026-85103, and CVE-2026-93616

Update (September 29, 2026): The Rapid Response was updated to include CVE-2026-85103.

Check Point disclosed in three advisories that certain versions their products are affected by multiple vulnerabilities:

CVE-2026-85102: Improper certificate trust validation during VPN negotiation in Security Gateway, Spark Firewall (Centrally Managed and Locally Managed) allows an unauthenticated, remote attacker to execute arbitrary code on the gateway. A fix has been available since September 9, 2026, but exploitation attempts targeting Spark Firewall customers have since been observed. The vulnerability has been designated CVE-2026-85102 and has been rated critical with a CVSS score of 9.8.
CVE-2026-85103: A heap-based buffer overflow in the VPN certificate ASN.1 decoding flow of Security Gateway, Security Management Server, and Spark Firewall (Centrally Managed and Locally Managed) allows an unauthenticated, remote attacker to execute arbitrary code on the affected appliance. The vulnerability has been designated CVE-2026-85103 and has been rated critical with a CVSS score of 9.8.
CVE-2026-93616: A pre-authentication directory traversal and file upload vulnerability in the Check Point Management web service (Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent) allows an unauthenticated attacker to upload a script to an arbitrary path, execute it, and load an arbitrary Java class. The vulnerability has been designated CVE-2026-93616 and has been rated critical with a CVSS score of 9.8.

Evidence indicates that CVE-2026-85102 and CVE-2026-93616 are actively exploited in the wild, leading to their addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 22, 2026.

The following versions are affected

Security Gateway: R81.20, R82, R82.10, and End-of-Support (EOS) versions R80 through R81.10 (affected by CVE-2026-85102 and CVE-2026-85103).
Spark Firewall (Centrally Managed and Locally Managed): R82.00.X prior to R82.00.10 Build 2325, and R81.10.X prior to R81.10.17 Build 4968 (affected by CVE-2026-85102 and CVE-2026-85103).
Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent: R82.20 with no Jumbo Hotfix, R82.10 with Jumbo Hotfix Take 44 or below, R82 with Jumbo Hotfix Take 126 or below, R81.20 with Jumbo Hotfix Take 166 or below, and End-of-Support (EOS) versions R81.10 with Jumbo Hotfix Take 190 or below through R80 (affected by CVE-2026-85103 and CVE-2026-93616).

What are Check Point Security Gateways, Spark Firewalls, Security Management Server, and Multi-Domain Security Management?

Check Point Security Gateways act as physical or virtual enforcement points that inspect network traffic and execute access rules in real time. Spark Firewalls are compact, enterprise-grade appliances designed to extend these security controls to small-to-medium businesses and remote branch offices. The Security Management Server serves as the centralized database and control plane that stores configuration settings, processes logs, compiles security policies, and deploys them to those gateways. Multi-Domain Security Management (MDS) extends this architecture by hosting multiple, isolated virtual management servers on a single platform.

What is the impact?

Successful exploitation of these vulnerabilities would allow an unauthenticated remote attacker to achieve full, arbitrary code execution across affected security gateways and central management infrastructure, resulting in complete system compromise and potential full network takeover.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Security Gateway: Install Check Point LivePatch Take 26 for an immediate fix (applied automatically if automatic LivePatch installation is enabled), or upgrade to R82.10 Jumbo Hotfix Take 44 or later, R82 Take 126 or later, R81.20 Take 166 or later, or End-of-Support (EOS) R81.10 Take 190 or later to resolve CVE-2026-85102 and CVE-2026-85103.
Spark Firewall (Centrally Managed and Locally Managed): Upgrade to R82.00.10 Build 2325 or later, or R81.10.17 Build 4968 or later, to resolve CVE-2026-85102 and CVE-2026-85103.
Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent: Upgrade to R82.20 Security Hotfix Take 1, R82.10 Jumbo Hotfix Take 45 or later, R82 Jumbo Hotfix Take 127 or later, R81.20 Jumbo Hotfix Take 170 or later, or R81.10 Jumbo Hotfix Take 192 or later, to resolve CVE-2026-85103 and CVE-2026-93616.

Notes:

Check Point LivePatch Take 28/29 does not resolve CVE-2026-93616; the Jumbo Hotfix upgrades listed above are required.
Customers who installed the offline LivePatch package while running R82.10 Jumbo Hotfix Take 24 or lower, R82 Take 107 or lower, or R81.20 Take 146 or lower must reinstall Check Point LivePatch Take 26 to ensure full protection against CVE-2026-85102.

Mitigation:

Restrict Trusted Clients (GUI clients) access strictly to trusted IP addresses or subnets.
Protect management interfaces with a firewall and restrict access exclusively to authorized IP addresses.

Finding exposed Check Point systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

os:="Check Point Gaia"

July 2026: CVE-2026-16232, CVE-2026-62144, and CVE-2026-62145

Check Point disclosed in three advisories that certain versions their products are affected by multiple vulnerabilities:

CVE-2026-16232: An authentication bypass vulnerability in the SmartConsole login process that allows a remote, unauthenticated attacker to obtain an application login token and authenticate with full administrative privileges. To exploit this, the attacker must have network access to the management interface, and the system must lack Trusted Clients (GUI clients) restrictions. Successful exploitation permits full modification of security policies and configurations. The vulnerability has been designated CVE-2026-16232 and has been rated critical with a CVSS score of 9.1.
CVE-2026-62144: An authentication bypass vulnerability in the Security Management and Multi-Domain Security Management servers that allows a remote, unauthenticated attacker to execute administrative commands on the server, including run-script and exec-command on managed Security Gateways. The attacker must have access to the management interface, and the system must lack firewall protections or Trusted Clients restrictions. The vulnerability has been designated CVE-2026-62144 and has been rated critical with a CVSS score of 9.1.
CVE-2026-62145: A local privilege escalation vulnerability in the Gaia Portal that allows an authenticated, low-privileged (read-only) attacker to execute arbitrary commands with root privileges. The vulnerability has been designated CVE-2026-62145 and has been rated high with a CVSS score of 7.5.

There is evidence that CVE-2026-16232 is being actively exploited in the wild, prompting its addition to the CISA KEV catalog on July 22, 2026

The following versions are affected

Security Management Server, Multi-Domain Security Management Server (MDS), Security Gateways: R81.20, R82, R82.10, and End-of-Support (EOS) versions R77.30 through R81.10.

Note: Spark Gateways are not affected.

What is the impact?

Successful exploitation of these vulnerabilities would allow an attacker to bypass authentication to gain full administrative control over management servers, execute arbitrary commands on managed firewalls, and escalate local privileges to root.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

R82.10: Upgrade to Jumbo Hotfix Accumulator Take 36 or later.
R82: Upgrade to Jumbo Hotfix Accumulator Take 118 or later.
R81.20: Upgrade to Jumbo Hotfix Accumulator Take 158 or later.
End-of-Support (EOS) Releases (R81.10, R81, R80.40, R80.30, R80.20, R80.10, R80, and R77.30): No hotfix specified. Upgrade to a supported release or apply vendor mitigations.

Mitigation:

Restrict Trusted Clients (GUI clients) access strictly to trusted IP addresses or subnets.
Protect management interfaces with a firewall and restrict access exclusively to authorized IP addresses.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

os:="Check Point Gaia"

June 2026: CVE-2026-50751

Check Point disclosed that certain versions of their VPN products utilize the deprecated IKE protocol version 1 (IKEv1) that are affected by an authentication logic flow vulnerability. Remote unauthenticated attackers can utilize this vulnerability to bypass the authentication validation without credentials in order to gain access to secure networks. This vulnerability has been designated CVE-2026-50751 and has been rated critical with a CVSS score of 9.3.

The following versions are affected:

Security Gateways:
- R82.10 Jumbo Hotfix Take 19 or below
- R82 Jumbo Hotfix Take 103 or below
- R81.20 Jumbo Hotfix Take 141 or below
- R81.10 (End-of-Support (EOS))
- R81 (End-of-Support (EOS))
- R80.40 (End-of-Support (EOS))
Spark Firewalls:
- R80.20.X (End-of-Support (EOS))
- R82.00.X
- R81.10.X

What is Check Point Remote Access and Mobile Access VPN?

Check Point Remote Access and Mobile Access VPN provide users access to corporate networks over IPSec.

What is the impact?

Successful exploitation of the vulnerability would allow an attacker to establish an unauthorized VPN connection and gain access to protected networks.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions:

Security Gateway, Maestro Orchestrator, and Security Group

R82.10 Jumbo Hotfix Accumulator Take 19 (Take #3)
R82.10 Jumbo Hotfix Accumulator Take 6 (Take #2)
R82 Jumbo Hotfix Accumulator Take 103 (Take #2)
R82 Jumbo Hotfix Accumulator Take 91 (Take #2)
R81.20 Jumbo Hotfix Accumulator Take 141 (Take #2)
R81.20 Jumbo Hotfix Accumulator Take 127 (Take #2)
R81.20 Jumbo Hotfix Accumulator Take 120 (Take #2)
R81.20 Jumbo Hotfix Accumulator Take 113 (Take #2)

Spark Firewall Appliances

R82.00.10 Build 998002216

For End-of-Support products Check Point has provided multiple mitigation options.

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially impacted assets:

hw:="Check Point%" AND protocol:ike AND ike.version:="1.0"

May 2024: CVE-2024-24919

On May 28, 2024, Check Point disclosed a serious vulnerability in Check Point Security Gateway Devices with certain remote access software blades (security modules) enabled. Per their guidance, devices are impacted if one of the following conditions are met:

The IPsec VPN Blade is enabled, but ONLY when included in the Remote Access VPN community.
The Mobile Access Software Blade is enabled.

The issue, identified as CVE-2024-24919, allows reading arbitrary files on the targeted appliance by unauthenticated remote attackers. This vulnerability could be leveraged to read sensitive files such as those containing password hashes, certificates, and ssh keys.

This vulnerability has a CVSS score of 8.6 out of 10, indicating that this is a high risk vulnerability. According to their disclosure and information provided by CISA this vulnerability is being actively exploited. A report from mnemonic.io states that they have observed attacks at least as far back as April 30, 2024.

What is the impact?

Upon successful exploitation of the vulnerability, unauthenticated remote attackers could access password hashes for local users. If the hashes are cracked the attacker may be able to log into these user accounts if secondary controls, such as MFA, are not enforced. This includes service accounts that may be used to access Active Directory or other services. Attackers could leverage this information to move across a target's network.

Are updates or workarounds available?

Check Point has released a software updates to address this vulnerability. They also provide guidance for other measures that should be taken after the vulnerability has been addressed. These can be found in their advisory.

How do I find potentially vulnerable Check Point devices with runZero?

From the Asset Inventory, use the following query to locate assets that may be running the vulnerable operating system in your network:

hardware:"Check Point" AND (_service.last.http.body:"Check Point Mobile" OR _service.http.body:"Check Point Mobile" OR udp_port:500)

F5 BIG-IP RCE exploit CVE-2026-94127: Find impacted systems

2022-05-05T03:00:00-04:00

Critical F5 BIG-IP exploit: CVE-2026-94127

F5 disclosed a critical OAuth remote code execution (RCE) vulnerability affecting select versions of BIG-IP APM. When an access policy and an OAuth profile are configured on a virtual server, crafted malicious traffic can trigger a heap-based buffer overflow, allowing an unauthenticated attacker to execute arbitrary code remotely. This vulnerability has been designated CVE-2026-94127 and has been rated critical with a CVSS score of 9.8.

There is evidence that this vulnerability is being actively exploited in the wild, and it was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 22, 2026.

The following versions are affected:

BIG-IP 21.1.x: Versions in the 21.1.0 release branch prior to the vendor-supplied engineering hotfix
BIG-IP 17.5.x: Versions in the 17.5.0 release branch prior to the vendor-supplied engineering hotfix
BIG-IP 17.1.x: Versions in the 17.1.0 release branch prior to the vendor-supplied engineering hotfix

What is F5 BIG-IP Access Policy Manager (APM)?

F5 BIG-IP Access Policy Manager (APM) is a module that provides secure, context-aware access control for applications and networks, including support for OAuth-based authentication and authorization profiles.

What is the impact?

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are any updates or workarounds available?

Upgrade affected versions of F5 BIG-IP Access Policy Manager to the latest patched version.

BIG-IP 21.1.x: Apply Hotfix-BIGIP-21.1.0.2.0.30.22-ENG or later.
BIG-IP 17.5.x: Apply Hotfix-BIGIP-17.5.1.9.0.160.12-ENG or later.
BIG-IP 17.1.x: Apply Hotfix-BIGIP-17.1.3.5.0.41.14-ENG or later.

Note: F5 has confirmed an iRule mitigation is available upon request by opening a ticket with F5 support, for use as a temporary mitigation while the engineering hotfix is applied.

Finding exposed F5 Big-IP systems with runZero

From the Software Inventory, use the following query to locate potentially affected systems:

vendor:=F5 AND product:="BIG-IP Access Policy Manager"

March 2026: CVE-2025-53521

On October 15, 2025, F5 disclosed a denial of service vulnerability, designated CVE-2025-53521, in F5 BIG-IP Access Policy Manager (APM).

On Friday, March 27, 2026, F5 updated the CVE entry to indicate that the vulnerability is now known to be a remote code execution vulnerability (RCE) with a CVSS score of 9.8. This vulnerability is now known to allow a remote, unauthenticated attacker to perform remote code execution.

This vulnerability is known to be exploited in the wild and was added to the CISA.gov Known Exploited Vulnerabilities (KEV) list on March 27, 2026.

The following versions are affected:

F5 BIG-IP Access Policy Manager versions 17.5.0 - 17.5.1 (inclusive)
F5 BIG-IP Access Policy Manager versions 17.1.0 - 17.1.2 (inclusive)
F5 BIG-IP Access Policy Manager versions 16.1.0 - 16.1.6 (inclusive)
F5 BIG-IP Access Policy Manager versions 15.1.0 - 15.1.10 (inclusive)

What is the impact?

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are any updates or workarounds available?

Upgrade affected versions of F5 BIG-IP Access Policy Manager to the latest patched version.

17.5.x upgrade to 17.5.1.3 or later
17.1.x upgrade to 17.1.3 or later
16.1.x upgrade to 16.1.6.1 or later
15.1.x upgrade to 15.1.10.8 or later

How do I find F5 Big-IP assets with runZero?

From the Software Inventory, use the following query to locate potentially affected systems:

vendor:=F5 AND product:="BIG-IP Access Policy Manager"

October 2025: CISA Emergency Directive

On October 15, 2025, CISA issued an emergency directive to mitigate vulnerabilities on F5 Big-IP appliances. According to the directive, the general guidance is to "inventory F5 BIG-IP products, evaluate if the networked management interfaces are accessible from the public internet, and apply newly released updates from F5."

What is the impact?

According to the directive, "a nation-state affiliated actor compromised F5 systems and exfiltrated data, including portions of the Big-IP proprietary source code and vulnerability information". The emergency directive specifically calls out "all instances of F5 BIG-IP hardware devices and F5OS, BIG-IP TMOS, Virtual Edition, BIG-IP Next, BIG-IP IQ software, and BNK / CNF". Organizations should apply the latest vendor updates and disconnect any affected publicly-connected devices that have reached their end-of-support date.

For more information, refer directly to the CISA emergency directive.

How do I find F5 Big-IP assets with runZero?

From the Asset Inventory, use the following query to locate potentially affected systems:

os:="F5%"

May 2022: CVE-2022-1388

In May 2022, technology vendor F5 published information on over 40 vulnerabilities, mostly affecting their BIG-IP line of products. While these vulnerabilities included a mix of types and severities, a particular authentication bypass vulnerability that affected all BIG-IP modules was concerning enough that CISA specifically called it out.

What was the impact?

Known as CVE-2022-1388 (CVSS “critical” score of 9.8), a vulnerable BIG-IP target could allow for takeover by an unauthenticated attacker via network connection or management port. Once connected to a vulnerable target, successful exploitation was achieved via a crafted HTTP request sent by the attacker, bypassing iControl REST authentication and providing the attacker full access and control. F5 did add that there was no data plane exposure via exploitation of this vulnerability, rather "this being a control plane issue only".

Were updates available?

Patches were made available by F5 for CVE-2022-1388, as well for many of the other vulnerabilities included in their security advisory overview. Guidance also included mitigation steps if immediate or near-term patching was not an option.

Cisco ISE vulnerabilities: How to find impacted appliances

2025-06-05T19:00:00-04:00

Latest Cisco ISE and Cisco ISE-PIC vulnerabilities:

On September 16, 2026, Cisco published four advisories covering multiple vulnerabilities in ISE and ISE-PIC. All four advisories affect the same 3.1-3.5 release lines and share an identical set of first-fixed releases, so they are combined here into a single Rapid Response with one remediation path. The vulnerabilities are independent of one another; a release affected by one is not necessarily affected by the others.

CVE-2026-76460 (cisco-sa-ISE-ABP-VNSW7Tn5): An unauthenticated, remote attacker can bypass authentication on an API endpoint due to insufficient authentication control, gaining unauthorized access to the web-based management interface. This vulnerability has been designated CVE-2026-76460 and has been rated critical with a CVSS score of 10.0.
CVE-2026-76423 (cisco-sa-ise-multi-hrP9jQSQ): An unauthenticated, remote attacker can gain administrative access via the REST API due to insufficient authorization checks on the exposed REST API port. This vulnerability has been designated CVE-2026-76423 and has been rated critical with a CVSS score of 10.0.
CVE-2026-76424 (cisco-sa-ise-multi-hrP9jQSQ): An authenticated attacker can upload or copy arbitrary files via the REST API due to insufficient path validation, leading to root command execution. This vulnerability has been designated CVE-2026-76424 and has been rated high with a CVSS score of 7.2.
CVE-2026-76425 (cisco-sa-ise-multi-hrP9jQSQ): An authenticated attacker can conduct SQL injection against the backend database and perform SSRF. This vulnerability has been designated CVE-2026-76425 and has been rated high with a CVSS score of 7.6.
CVE-2026-76426 (cisco-sa-ise-multi-hrP9jQSQ): An authenticated attacker can conduct SQL injection against the monitoring database via the REST API. This vulnerability has been designated CVE-2026-76426 and has been rated medium with a CVSS score of 4.9.
CVE-2026-76427 (cisco-sa-ise-multi-hrP9jQSQ): An authenticated attacker can read arbitrary files via XML external entity injection in the offline profiler feed service. This vulnerability has been designated CVE-2026-76427 and has been rated medium with a CVSS score of 4.9.
CVE-2026-76428 (cisco-sa-ise-multi-hrP9jQSQ): An authenticated attacker can conduct SQL injection against the session database via the REST API. This vulnerability has been designated CVE-2026-76428 and has been rated medium with a CVSS score of 4.9.
CVE-2026-20307 (cisco-sa-ise-rce-se7bYU57): A low-privileged, authenticated attacker can execute arbitrary root-level commands via insecure deserialization of a Java object in the web-based management interface. This vulnerability has been designated CVE-2026-20307 and has been rated critical with a CVSS score of 9.9.
CVE-2026-20176 (cisco-sa-ise-rce-se7bYU57): A high-privileged, authenticated attacker can execute arbitrary root-level commands due to insufficient input validation. This vulnerability has been designated CVE-2026-20176 and has been rated critical with a CVSS score of 9.1.
CVE-2026-20211 (cisco-sa-ise-rce-se7bYU57): A high-privileged, authenticated attacker can execute arbitrary root-level commands via insecure deserialization of Java objects. This vulnerability has been designated CVE-2026-20211 and has been rated critical with a CVSS score of 9.1.

Cisco also disclosed a hardening release (cisco-sa-hardening-ise-XU5EwX5T) covering multiple vulnerabilities found during internal security testing. Cisco grouped these by underlying CWE class and assigned one CVE ID per class, so each CVE below represents several related internal findings rather than a single flaw:

CVE-2026-20130 (cisco-sa-hardening-ise-XU5EwX5T): Improper neutralization of special elements in output (CWE-74), covering command injection, cross-site scripting, XML injection, code injection, and resource injection findings. This vulnerability has been designated CVE-2026-20130 and has been rated critical with a CVSS score of 10.0.
CVE-2026-20192 (cisco-sa-hardening-ise-XU5EwX5T): Improper access control (CWE-284), covering authorization, authentication, privilege, and bypass findings. This vulnerability has been designated CVE-2026-20192 and has been rated critical with a CVSS score of 10.0.
CVE-2026-20194 (cisco-sa-hardening-ise-XU5EwX5T): Incorrect resource transfer between spheres (CWE-669), covering exposure of sensitive information in transit, improper removal of sensitive information before storage, and unrestricted file upload findings. This vulnerability has been designated CVE-2026-20194 and has been rated critical with a CVSS score of 9.1.
CVE-2026-20234 (cisco-sa-hardening-ise-XU5EwX5T): Insufficiently protected credentials (CWE-522), covering information disclosure and passwords stored or encoded in a recoverable format. This vulnerability has been designated CVE-2026-20234 and has been rated critical with a CVSS score of 9.9.
CVE-2026-20237 (cisco-sa-hardening-ise-XU5EwX5T): Improper input validation (CWE-20), covering path traversal and external control of file paths. This vulnerability has been designated CVE-2026-20237 and has been rated critical with a CVSS score of 9.9.
CVE-2026-20287 (cisco-sa-hardening-ise-XU5EwX5T): Improper privilege management (CWE-269), covering incorrect privilege assignment, privilege chaining, and misuse of privilege-checking APIs. This vulnerability has been designated CVE-2026-20287 and has been rated medium with a CVSS score of 6.5.

These vulnerabilities affect Cisco ISE and ISE-PIC regardless of device configuration.

There is evidence that CVE-2026-76460 is being actively exploited in the wild, and it was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026.

The following releases are affected by one or more of these vulnerabilities:

Cisco ISE and ISE-PIC 3.1: Versions through 3.1 Patch 11
Cisco ISE and ISE-PIC 3.2: Versions through 3.2 Patch 10
Cisco ISE and ISE-PIC 3.3: Versions through 3.3 Patch 11
Cisco ISE and ISE-PIC 3.4: Versions through 3.4 Patch 6
Cisco ISE and ISE-PIC 3.5: Versions through 3.5 Patch 3

Cisco ISE Software Release 3.0 has reached End of Software Maintenance; customers are advised to migrate to a supported release that includes the fixes.

What are Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC)?

Cisco Identity Services Engine (ISE) is a network access control and policy enforcement platform, and Cisco ISE Passive Identity Connector (ISE-PIC) provides passive identity mapping for third-party enforcement devices.

What is the impact?

Successful exploitation of these vulnerabilities would allow an unauthenticated, remote attacker to completely compromise the system, gain full administrative and root-level control, execute arbitrary code, and compromise the integrity and confidentiality of sensitive network policy and identity data.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Cisco ISE and ISE-PIC 3.1: Upgrade to 3.1 Patch 12 or later. This release does not have a fixed release for CVE-2026-76424, CVE-2026-76425, CVE-2026-76426, CVE-2026-76427, or CVE-2026-76428; migrate to 3.3 Patch 12 or later to remediate those.
Cisco ISE and ISE-PIC 3.2: Upgrade to 3.2 Patch 11 or later. This release does not have a fixed release for CVE-2026-76424, CVE-2026-76425, CVE-2026-76426, CVE-2026-76427, or CVE-2026-76428; migrate to 3.3 Patch 12 or later to remediate those.
Cisco ISE and ISE-PIC 3.3: Upgrade to 3.3 Patch 12 or later.
Cisco ISE and ISE-PIC 3.4: Upgrade to 3.4 Patch 7 or later.
Cisco ISE and ISE-PIC 3.5: Upgrade to 3.5 Patch 4 or later.

Cisco ISE-PIC has reached the end-of-sale date; release 3.4 is the last supported release.

There are no workarounds. As a temporary mitigation, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic destined to the affected device.

How do I find Cisco ISE installations with runZero?

From the Software Inventory, use the following query to locate potentially impacted installations:

vendor:="Cisco" AND product:="Identity Services Engine"

July 2025: CVE-2025-20281, CVE-2025-20282, and CVE-2025-20337

Three vulnerabilities have been disclosed in certain versions of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) that could allow an unauthenticated, remote adversary to issue execute commands on the underlying operating system as the root user. There is evidence that this vulnerability is being actively exploited in the wild.

Cisco ISE and Cisco ISE-PIC are at risk of an insufficient validation of user-supplied input vulnerability in a specific API. This could allow an unauthenticated, remote adversary to execute arbitrary code on the underlying operating system as the root user via a specially crafted API request. Successful exploitation could allow the adversary to obtain root privileges on an affected device. The adversary does not require any valid credentials to be able to exploit the vulnerability. This vulnerability has been designated CVE-2025-20281 and has been rated critical with a CVSS score of 9.8.
Cisco ISE and Cisco ISE-PIC are at risk of an improper privilege management vulnerability in an internal API due to a lack of file validation checks to prevent uploaded files from being stored in privileged directories on an affected system. This could allow an unauthenticated, remote adversary to upload arbitrary files to an affected device and then execute those files on the underlying operating system as the root user. Successful exploitation could allow the adversary to store malicious files on an affected system and then execute arbitrary code or obtain root privileges on an affected device. This vulnerability has been designated CVE-2025-20282 and has been rated critical with a CVSS score of 10.0
Cisco ISE and Cisco ISE-PIC are at risk of an insufficient validation of user-supplied input vulnerability in a specific API. This could allow an unauthenticated, remote adversary to execute arbitrary code on the underlying operating system as the root user via a specially crafted API request. Successful exploitation could allow the adversary to obtain root privileges on an affected device. The adversary does not require any valid credentials to be able to exploit the vulnerability. This vulnerability has been designated CVE-2025-20337 and has been rated critical with a CVSS score of 10.0.

The following versions are affected

Cisco ISE or ISE-PIC release 3.3 prior to version 3.3 Patch 7
Cisco ISE or ISE-PIC release 3.4 prior to version 3.4 Patch 2

What is the impact?

Successful exploitation of this vulnerability by an attacker would allow credentials extracted from a Cisco ISE instance to be used on others from the same release on the same cloud platform. This could allow the attacker to access sensitive data, execute limited administrative operations, modify system configurations or disrupt services within the impacted systems.

Are any updates or workarounds available?

Cisco has released updates in the form of patches for releases 3.3 and 3.4. Users should update to the latest version of the affected software.

Cisco ISE or ISE-PIC release 3.3 to version 3.3 Patch 7 and later releases
Cisco ISE or ISE-PIC release 3.4 to version 3.4 Patch 2 and later releases

Since the initial (version 1.0) advisory publication, Cisco released an improved fix for release 3.3 and recommends upgrading as follows:

Release 3.3 Patch 6 should be up upgraded to Release 3.3 Patch 7
Hot patch ise-apply-CSCwo99449_3.3.0.430_patch4-SPA.tar.gz or ise-apply-CSCwo99449_3.4.0.608_patch1-SPA.tar.gz should be up upgraded to Release 3.3 Patch 7 or Release 3.4 Patch 2

How do I find Cisco ISE installations with runZero?

From the Software Inventory, use the following query to locate potentially impacted installations:

vendor:="Cisco" AND product:="Identity Services Engine"

June 2024: CVE-2025-20286

A vulnerability has been disclosed in certain cloud-deployed versions of Cisco Identity Services Engine (ISE) in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI). The vulnerability exists due to improper credential generation in cloud platform deployments resulting in shared credentials across deployments based on release and cloud platform.

It is important to note that Cisco ISE is affected by this vulnerability when the Primary Administration node is deployed in the cloud. An on-premises Primary Administration node is not affected.

The following platforms and versions are affected

AWS Cisco ISE 3.1, 3.2, 3.3 and 3.4
Azure Cisco ISE 3.2, 3.3 and 3.4
OCI Cisco ISE 3.2, 3.3 and 3.4

This vulnerability has been designated CVE-2025-20286 and has a CVSS score of 9.9 (critical).

What is the impact?

Are any updates or workarounds available?

Cisco has released updates in the form of a hot fix for releases 3.1 through 3.4. Update to the latest version of the affected software when updates are available.

N-able N-central vulnerabilities: How to find impacted installations

2025-08-15T12:30:00-04:00

Latest N-able N-central vulnerabilities: CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218

N-able has disclosed three vulnerabilities in certain versions of N-central.

CVE-2026-86206: An access control bypass vulnerability in the internal API access control filter allows a remote, unauthenticated attacker to obtain unauthorized access to internal APIs. The vulnerability has been designated CVE-2026-86206 and has been rated medium with a CVSS score of 6.9.
CVE-2026-86207: An authentication bypass vulnerability in the internal API allows a remote, low-privileged attacker to obtain unauthorized privileges. The vulnerability has been designated CVE-2026-86207 and has been rated high with a CVSS score of 7.7.
CVE-2026-86218: A pre-authentication remote code execution (RCE) vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the target server. The vulnerability has been designated CVE-2026-86218 and has been rated critical with a CVSS score of 10.0.

There is evidence that CVE-2026-86218 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 8, 2026.

The following versions are affected

N-Central: Versions prior to 2026.3 Hotfix 4 (Build 2026.3.1.14)

Note: CVE-2026-86218 is resolved in 2026.3 Hotfix 4 (Build 2026.3.1.14), which supersedes 2026.3 Hotfix 3 (Build 2026.3.1.13) (the patch for CVE-2026-86206 and CVE-2026-86207).

What is N-Able N-Central?

N-able N-central is an enterprise remote monitoring and management (RMM) software platform used by managed service providers (MSPs) and internal IT teams to discover, automate, patch, and secure network infrastructure and endpoints across Windows, macOS, Linux, and cloud environments.

What is the impact?

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to execute arbitrary commands on the target server, potentially enabling persistent lateral movement and unauthorized command execution across managed downstream endpoints.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

N-central 2025.4.x through 2026.3.x: Upgrade to version 2026.3 Hotfix 4 (Build 2026.3.1.14) or later.
Legacy and Unsupported Versions: Upgrade to a supported release pathway, then apply version 2026.3 Hotfix 4 (Build 2026.3.1.14).

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="N-able" AND product:="N-central" AND source:runzero

August 2026: CVE-2026-18556 and CVE-2026-18577

N-able has disclosed two vulnerabilities in certain versions of N-central. Certain versions of N-Central are affected by multiple authentication bypass vulnerabilities.

CVE-2026-18556: Initial authentication bypass via an alternate path or channel. The vulnerability has been designated CVE-2026-18556 and has been rated high with a CVSS score of 8.2.
CVE-2026-18577: Secondary authentication bypass resulting from an incomplete patch for CVE-2026-18556. The vulnerability has been designated CVE-2026-18577 and has been rated high with a CVSS score of 8.2.

Successful exploitation allows a remote, unauthenticated attacker to bypass authentication and obtain administrative account access on the server. Administrative access may allow attackers to execute unauthorized commands or establish persistence across managed downstream endpoints.

There is evidence that CVE-2026-18577 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 3, 2026.

Update (August 4, 2026): There is evidence that CVE-2026-18556 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 4, 2026.

The following versions are affected

N-Central: Versions prior to 2026.3.1 Hotfix 1 (Build 2026.3.1.7)

What is N-Able N-Central?

What is the impact?

Successful exploitation of these vulnerabilities would allow a remote, unauthenticated attacker to bypass authentication and obtain administrative access on the server, potentially enabling unauthorized command execution and persistent lateral movement across managed downstream endpoints.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

N-central 2026.3.x, 2026.2.x, 2026.1.x, and 2025.4.x: Upgrade to version 2026.3.1 Hotfix 1 (Build 2026.3.1.7) or later.
Legacy & Unsupported Versions: Upgrade to a supported release pathway, then apply version 2026.3.1 Hotfix 1 (Build 2026.3.1.7).

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="N-able" AND product:="N-central"

September 2025: CVE-2025-8875 and CVE-2025-8876

N-able has disclosed two vulnerabilities in certain versions of N-central. There is evidence that these vulnerabilities are being actively exploited in the wild.

A deserialization of untrusted data vulnerability allows a remote, low-privileged adversary to execute arbitrary code on the system. This vulnerability has been designated CVE-2025-8875 and has been rated critical with a CVSS score of 9.4.
An improper input validation vulnerability allows a remote, low-privileged adversary to execute arbitrary OS commands on the system. This vulnerability has been designated CVE-2025-8876 and has been rated critical with a CVSS score of 9.4.

The following versions are affected

N-central versions prior to 2025.3.1

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

N-central upgrade to version 2025.3.1 or later

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="N-able" product:="N-central"

MikroTik RouterOS vulnerabilities: How to find impacted assets

2026-09-07T20:37:00-04:00

MikroTik RouterOS unauthenticated remote access vulnerabilities

MikroTik disclosed certain versions of RouterOS are affected by multiple vulnerabilities:

CVE-2026-67276: An improper signature verification of a cryptographic signature vulnerability found within the RouterOS SSH service. Successful exploitation allows a remote, unauthenticated attacker the ability to bypass authentication if an authorized username and RSA modulus is known. The vulnerability has been designated CVE-2026-67276 and has been rated critical with a CVSS score of 9.2.

CVE-2026-86060: An improper neutralization of argument delimiters in a command vulnerability also found within the RouterOS SSH service. Successful exploitation allows a remote, unauthenticated attacker the ability to achieve full administrative control via a crafted username. The vulnerability has been designated CVE-2026-86060 and has been rated critical with a CVSS score of 9.2.

CVE-2026-67277: A memory disclosure and DoS vulnerability within the RouterOS bandwidth-test service. Successful exploitation allows a remote, unauthenticated attacker the ability to read kernel memory or trigger a DoS. The vulnerability has been designated CVE-2026-67277 and has been rated high with a CVSS score of 8.8.

MikroTik has confirmed that these vulnerabilities are being actively exploited in the wild.

The following versions are affected:

RouterOS: Versions 7.24 through 7.24.1
RouterOS: Versions 7.0.0 through 7.23.3
RouterOS: Versions 6.0.0 through 6.49.20

What is MikroTik RouterOS?

MikroTik RouterOS is a Linux-based operating system that provides routing, firewall, and bandwidth management capabilities for MikroTik RouterBOARD hardware. It is frequently utilized by internet service providers and small-to-medium businesses to manage core network infrastructure.

What is the impact?

Successful exploitation of these vulnerabilities could allow a remote, unauthenticated attacker administrative privileges to achieve full system takeover.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

RouterOS: Upgrade to version 7.24.2 or later.
RouterOS: Upgrade to version 7.23.4 or later.
RouterOS: Upgrade to version 6.49.21 or later.

Finding exposed MikroTik systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

os:="MikroTik RouterOS" AND ((os_version:>="6.0.0" AND os_version:<"6.49.21") OR (os_version:>"7.0.0" AND os_version:<"7.23.4") OR (os_version:>"7.24" AND os_version:<"7.24.2"))

Plex Media Server vulnerabilities: find impacted systems

2025-08-15T16:59:00-04:00

Plex Media Server and Desktop security update

Plex has issued a security update addressing multiple undisclosed vulnerabilities across Plex Media Server and Plex Desktop. While formal CVE identifiers have been requested, specific technical details and CVSS ratings remain undisclosed (note, this is a bad idea). Unpatched installations may expose systems to unauthorized access or remote security risks depending on the specific attack vector.

The following versions are affected

Plex Media Server: Versions prior to 1.43.3
Plex Desktop: Versions prior to 1.115.0

What are Plex Media Server and Plex Desktop?

Plex Media Server and Plex Desktop form a client-server media system where the server organizes and streams personal media files from a central storage device, and the desktop application serves as a frontend interface for browsing and playing that content on a computer.

What is the impact?

Successful exploitation of these vulnerabilities would allow an attacker to compromise the security posture of the host system, potentially resulting in unauthorized access or system disruption depending on the specific unreleased flaws and exposure.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Plex Media Server: Upgrade to version 1.43.3 or later.
Plex Desktop: Upgrade to version 1.115.0 or later.

Note for Network-Attached Storage (NAS) deployments: Automated package managers on NAS platforms may experience distribution delays. If the patched build is not available via the vendor repository, manually download and apply the package from the official Plex Downloads page.

Finding exposed Plex Media Server and Desktop with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Plex AND product:"Media Server"

August 2025: CVE-2025-34158

Plex released a security update for a previously undisclosed vulnerability that stemmed from an incorrect resource transfer between spheres in certain versions of Plex Media Server. The flaw had been reported to Plex through its bug bounty program, and further details were not yet public at the time. This vulnerability was designated CVE-2025-34158 and was rated high with a CVSS score of 8.5.

The following versions were affected:

Plex Media Server versions 1.41.7.x through 1.42.0.x

The impact of the vulnerability was initially unknown. However, Plex "strongly recommended" that users update to the latest version as quickly as possible.

Users were encouraged to update to the latest version as quickly as possible:

Plex Media Server upgraded to version 1.42.1 or later

From the Software Inventory, users could use the following query to locate potentially impacted assets:

vendor:=Plex AND product:"Media Server" AND (version:>0 AND version:<"1.42.1")

PaperCut Software vulns: CVE-2026-81578, CVE-2026-82078

2026-08-27T18:26:00-04:00

PaperCut Software vulnerabilities (CVE-2026-81578, CVE-2026-82078):

PaperCut Software published a security bulletin on August 27, 2026, revealing that certain versions of PaperCut NG and PaperCut MF are affected by two vulnerabilities:

CVE-2026-81578: An improper access control vulnerability in the web management interface allows requests targeting administrative functions to trigger backend actions before access validation completes. Successful exploitation allows a remote, unauthenticated attacker to modify certain system configurations. The vulnerability has been designated CVE-2026-81578 and has been rated high with a CVSS score of 8.8.
CVE-2026-82078: An unsafe dynamic class loading vulnerability exists in the database connection utilities. The application instantiates database driver classes based on configurable driver names without validating them against an allowlist. Successful exploitation allows a remote, high-privileged attacker to modify system configurations. The vulnerability has been designated CVE-2026-82078 and has been rated critical with a CVSS score of 9.4.

PaperCut Software has confirmed that these vulnerabilities are being actively exploited in the wild.

Revision History:

Update (August 31, 2026): There is evidence that both CVE-2026-81578 and CVE-2026-82078 are being actively exploited in the wild, prompting their addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026.
Update (August 28, 2026): PaperCut Software updated its security advisory to clarify that site servers and secondary/print servers must be patched alongside primary application servers. The vendor also issued Emergency Patch Release 2, which provides additional hardening and expands fix coverage to version 24.x.
Initial Advisory (August 27, 2026): Initial disclosure of undisclosed vulnerabilities with active exploitation in the wild reported.

The following versions are affected

PaperCut NG & MF: All versions prior to Emergency Patch Release 2

What are PaperCut NG and PaperCut MF?

PaperCut Software PaperCut NG and PaperCut MF are server-based software applications that track, manage, and secure network printing, with PaperCut MF additionally integrating directly into multifunction printer hardware to control copying, scanning, and faxing.

What is the impact?

Successful exploitation of these vulnerabilities would allow a remote attacker to modify critical application configurations and potentially achieve full compromise of the underlying PaperCut server.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

PaperCut NG & MF 26.x: Upgrade to version 26.x Emergency Patch Release 2 or later.
PaperCut NG & MF 25.x: Upgrade to version 25.x Emergency Patch Release 2 or later.
PaperCut NG & MF 24.x: Upgrade to version 24.x Emergency Patch Release 2 or later.
Older / Unsupported Versions: Upgrade to a supported major version (26.x or 25.x) and apply the corresponding Emergency Patch Release 2.

If any PaperCut server is exposed to the public Internet, immediately restrict access to trusted IP addresses using firewalls or network access controls.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="PaperCut Software" AND (product:="PaperCut MF" OR product:="PaperCut NG") AND source:runzero

April 2023 advisory:

PaperCut revealed that two products in its popular line of print server software contained severe vulnerabilities that were being exploited in the wild. Reported via the Trend Micro Zero Day Initiative, these vulnerabilities could be exploited by unauthenticated attackers to achieve remote code execution as the SYSTEM user (CVE-2023-27350/ZDI-CAN-18987) or information disclosure, including user information and password hashes (CVE-2023-27351/ZDI-CAN-19226).

With a CVSS score of 9.8 (“critical”), CVE-2023-27350/ZDI-CAN-18987 existed in the SetupCompleted class and could be leveraged for unauthenticated remote code execution due to improper access control. The Application Server and Site Server components of PaperCut MF and NG product versions 8.0 and later contained this flaw.

CVE-2023-27351/ZDI-CAN-19226 was assigned a CVSS score of 8.2 (“high”) and existed in the SecurityRequestFilter class as a flaw in the authentication algorithm, allowing for unauthenticated information disclosure. The Application Server component of PaperCut MF and NG product versions 15.0 and later contained this flaw.

PaperCut’s website claimed over 130 million users of their products across almost 90,000 organizations in almost 200 countries, including government, commercial, and educational users. Coupled with the substantial list of affected product versions and exploitation of these vulnerabilities already observed happening in the wild, the impact could have been quite broad. Trend Micro deferred disclosing more details on these vulnerabilities until the following month in order to give PaperCut customers time to patch.

While a definitive indicator of compromise didn’t exist in detecting exploitation of these vulnerabilities on a target, PaperCut did offer some clues one could look for.

The previous month, PaperCut had released patched versions 20.1.7, 21.2.11, and 22.0.9 which fixed these vulnerabilities. Older unsupported/end-of-life versions were not going to receive a patched update.

For admins who could not patch immediately, PaperCut provided a mitigation for CVE-2023-27351/ZDI-CAN-19226, but none was available at the time for CVE-2023-27350/ZDI-CAN-18987.

From the Services inventory, you can use the following prebuilt query to locate all PaperCut MF and NG servers in your network:

_asset.protocol:http and protocol:http and (http.body:"PaperCut MF is a print management system" OR last.http.body:"PaperCut MF is a print management system" OR http.body:"PaperCut NG is a print management system" OR last.http.body:"PaperCut NG is a print management system")

As always, any prebuilt queries are available from your runZero console. Check out the documentation for other useful inventory queries.

Ubiquiti UniFi OS vulnerabilities: How to find impacted assets

2026-07-08T18:26:00-04:00

Latest Ubiquiti UniFi OS vulnerabilities

Ubiquiti disclosed certain versions of UniFi OS are affected by multiple vulnerabilities:

CVE-2026-77534: An improper access control vulnerability that allows a remote, low-privileged attacker to escalate privileges. The vulnerability has been designated CVE-2026-77534 and has been rated critical with a CVSS score of 9.9.
CVE-2026-77536: An improper access control vulnerability that allows a remote, low-privileged attacker to escalate privileges. The vulnerability has been designated CVE-2026-77536 and has been rated critical with a CVSS score of 9.9.
CVE-2026-77539: An improper input validation vulnerability that allows a remote, high-privileged attacker to execute arbitrary commands on the host device. The vulnerability has been designated CVE-2026-77539 and has been rated critical with a CVSS score of 9.1.
CVE-2026-77540: An improper input validation vulnerability that allows a remote, high-privileged attacker to execute arbitrary commands on the host device. The vulnerability has been designated CVE-2026-77540 and has been rated critical with a CVSS score of 9.1.
CVE-2026-77545: An active debug code vulnerability that allows a remote, low-privileged attacker under specific conditions to escalate privileges. The vulnerability has been designated CVE-2026-77545 and has been rated critical with a CVSS score of 9.0.
CVE-2026-77549: An improper neutralization of CRLF sequences vulnerability that allows a remote, unauthenticated attacker under specific conditions to bypass authentication. The vulnerability has been designated CVE-2026-77549 and has been rated critical with a CVSS score of 9.0.
CVE-2026-77550: An improper neutralization of CRLF sequences vulnerability that allows a remote, unauthenticated attacker under specific conditions to bypass authentication. The vulnerability has been designated CVE-2026-77550 and has been rated critical with a CVSS score of 10.0.

The following versions are affected

UniFi OS Server: Versions 5.1.21 and prior
Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall, and Express 7: Versions 5.1.26 and prior

What is Ubiquiti UniFi OS?

Ubiquiti UniFi OS is a Linux-based operating system and application server platform deployed across dedicated Cloud Gateways, hardware consoles, and self-hosted servers to manage and run individual network and security applications.

What is the impact?

Successful exploitation of these vulnerabilities would allow a remote, unauthenticated or authenticated attacker with varying privilege levels to bypass authentication, escalate privileges, or execute arbitrary commands on the host system.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

UniFi OS Server: Upgrade to version 5.1.37 or later.
Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall, and Express 7: Upgrade to version 5.1.31 or later.
Network Attached Storage: Upgrade to version 5.1.32 or later.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

os:="Ubiquiti UniFi OS"

July 2026: Multiple CVE's

Ubiquiti disclosed multiple vulnerabilities affecting certain versions of the UniFi OS:

CVE-2026-54401: A Server-Side Request Forgery (SSRF) vulnerability that allows a remote, low-privileged attacker to escalate privileges within UniFi OS devices or instances. The vulnerability has been designated CVE-2026-54401 and has been rated high with a CVSS score of 7.7.
CVE-2026-54402: An improper input validation vulnerability that allows a remote, low-privileged attacker to perform command injection on the host device. The vulnerability has been designated CVE-2026-54402 and has been rated critical with a CVSS score of 9.9.
CVE-2026-54403: A path traversal vulnerability that allows a remote, low-privileged attacker to bypass authentication on UniFi OS devices or instances. The vulnerability has been designated CVE-2026-54403 and has been rated high with a CVSS score of 8.6.
CVE-2026-54404: A series of authenticated SQL Injection (SQLi) vulnerabilities that allow a remote, low-privileged attacker to escalate privileges within UniFi OS devices or instances. The vulnerability has been designated CVE-2026-54404 and has been rated high with a CVSS score of 8.8.
CVE-2026-55110: A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability that allows a remote, unauthenticated attacker, who convinces an authenticated user to visit a malicious webpage, to trigger operations in UniFi OS using that user's session. The vulnerability has been designated CVE-2026-55110 and has been rated high with a CVSS score of 7.5.
CVE-2026-55112: An improper access control vulnerability that allows a remote, low-privileged attacker to escalate privileges on the host device under certain conditions when UniFi OS is configured with the UniFi Protect Application. The vulnerability has been designated CVE-2026-55112 and has been rated high with a CVSS score of 7.5.
CVE-2026-55116: An improper access control vulnerability that, under certain network configurations, allows a remote, unauthenticated attacker to make unauthorized changes to UniFi OS devices. The vulnerability has been designated CVE-2026-55116 and has been rated critical with a CVSS score of 9.0.

The following software versions are affected across their respective hardware platforms (including all standalone servers, UDM, UNAS, UCG, UCK, UNVR, ENVR, and EF consoles):

UniFi OS / Server (Standard Consoles): Version 5.1.15 and prior.
- Applies to all reported CVEs (CVE-2026-54401 through CVE-2026-55116).
- Note on CVE-2026-55112: This risk only presents if the platform is running the UniFi Protect Application.
UniFi Network Attached Storage (UNAS): Version 5.1.16 and prior.
- Applies to CVE-2026-54401, CVE-2026-54402, CVE-2026-54403, CVE-2026-54404, and CVE-2026-55110.
Enterprise Firewall (EF-Core): Version 5.1.18 and prior.
- Applies to all reported CVEs.

Note on CVE-2026-54403: While the narrative text within the manufacturer's advisory suggests that chaining this path traversal flaw could allow an attacker to bypass the low-privilege threshold, the formal CVSS tracking metrics officially list the Privileges Required (PR) value as "None."

What is the impact?

Successful exploitation of these vulnerabilities allows an adversary to bypass authentication, escalate privileges on the host device, and make unauthorized system or configuration changes.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

All Platforms: Upgrade to UniFi OS version 5.1.19 or later.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

os:="Ubiquiti UniFi OS"

Ubiquiti UniFi Protect vulnerabilities: How to find impacted assets

2026-01-06T13:06:00-05:00

Latest Ubiquiti UniFi Protect vulnerabilities

Ubiquiti disclosed multiple improper input validation vulnerabilities in certain versions of the UniFi Protect Application may allow remote attackers to execute arbitrary commands on the underlying host device:

CVE-2026-77533: Exploitable by a low-privileged attacker. The vulnerability has been designated CVE-2026-77533 and has been rated critical with a CVSS score of 9.9.
CVE-2026-77537: Exploitable by an unauthenticated attacker. The vulnerability has been designated CVE-2026-77537 and has been rated critical with a CVSS score of 10.0.
CVE-2026-77548: Exploitable by a low-privileged attacker. The vulnerability has been designated CVE-2026-77548 and has been rated critical with a CVSS score of 9.9.

The following versions are affected

UniFi Protect Application: Versions 7.1.87 and prior

What is Ubiquiti UniFi Protect?

Ubiquiti UniFi Protect is a network video management application that operates on specialized local hardware to manage camera configurations, video recordings, and event-based analytics for an integrated surveillance system.

What is the impact?

Successful exploitation of these vulnerabilities allows an adversary to escalate privileges on the host device while gaining unauthorized access to the UniFi Protect API endpoints, data streaming, and connected cameras.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

UniFi Protect Application: Upgrade to version 7.2.105 or later.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Ubiquiti _NVR%"

July 2026: Multiple CVE's

Ubiquiti disclosed multiple vulnerabilities affecting certain versions of the UniFi Protect Application:

CVE-2026-54407: An improper access control vulnerability that allows a remote, unauthenticated attacker to bypass authentication on specific UniFi Protect Application API endpoints. The vulnerability has been designated CVE-2026-54407 and has been rated high with a CVSS score of 8.6.
CVE-2026-54408: An improper access control vulnerability that allows a remote, unauthenticated attacker to bypass data streaming authentication. The vulnerability has been designated CVE-2026-54408 and has been rated high with a CVSS score of 8.6.
CVE-2026-54409: An improper initialization vulnerability that allows a remote, unauthenticated attacker to bypass authentication on UniFi Protect cameras under certain conditions. The vulnerability has been designated CVE-2026-54409 and has been rated high with a CVSS score of 7.5.
CVE-2026-55115: A Server-Side Request Forgery (SSRF) vulnerability that allows a remote, low-privileged attacker to escalate privileges on the host device. The vulnerability has been designated CVE-2026-55115 and has been rated critical with a CVSS score of 9.9.
CVE-2026-56841: An authenticated SQL Injection (SQLi) vulnerability that allows a remote, low-privileged attacker to escalate privileges on the host device. The vulnerability has been designated CVE-2026-56841 and has been rated high with a CVSS score of 8.8.

The following versions are affected

UniFi Protect Application: Versions 7.1.77 and prior.

What is the impact?

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

UniFi Protect Application: Version 7.1.83 or later.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Ubiquiti _NVR%"

January 2026: CVE-2026-21633 and CVE-2026-21634

Ubiquiti disclosed multiple vulnerabilities affecting certain versions of the UniFi Protect Application:

An improper authentication vulnerability via the discovery protocol. Successful exploitation allows a network-adjacent, unauthenticated adversary to obtain unauthorized access to UniFi Protect cameras. The vulnerability has been designated CVE-2026-21633 and has been rated high with a CVSS score of 8.8.
A buffer overflow vulnerability via the discovery protocol. Successful exploitation allows a network-adjacent, unauthenticated adversary to restart the application, causing a denial-of-service (DoS) condition. The vulnerability has been designated CVE-2026-21634 and has been rated medium with a CVSS score of 6.5.

The following versions are affected

UniFi Protect Application versions 6.1.79 and prior

What is the impact?

Successful exploitation of the vulnerabilities would allow an adversary to gain unauthorized access to UniFi Protect cameras or cause denial-of-service (DoS) conditions limiting proper function.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

UniFi Protect Application upgrade to version 6.2.72 or later

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Ubiquiti _NVR%"

May 2025: UniFi Protect IP cameras (CVE-2025-23123)

In May 2025, Ubiquiti disclosed a vulnerability in its UniFi Protect IP cameras. This vulnerability allowed an unauthenticated attacker with access to the camera's management network to execute arbitrary code on the device.

This vulnerability was designated CVE-2025-23123 and had a CVSS score of 10.0 (critical).

What was the impact?

An attacker with access to the camera's management interface would be able to execute arbitrary code on the device. This would allow the attacker to take complete control of the device.

Were updates or workarounds available?

Ubiquiti released an update to the firmware, version 4.75.62, to address this issue. Users were recommended to update to this or a later version as quickly as possible.

How to find UniFi Protect cameras with runZero

From the Asset inventory, use the following query to locate Ubiquiti IP cameras on your network:

hw:Ubiquiti type:Camera

Gitea vulnerability CVE-2026-60004: find impacted assets

2026-07-30T15:05:00-04:00

Latest Gitea vulnerability: CVE-2026-60004

Gitea disclosed that certain versions of Gitea are affected by a remote code execution (RCE) vulnerability within the diffpatch feature. By exploiting this through malicious repository content, an attacker can write custom Git hooks into the underlying repository directory. When these hook scripts are subsequently triggered during Git operations, they execute arbitrary shell commands with the privileges of the Gitea process user. The vulnerability has been designated CVE-2026-60004 and has been rated critical with a CVSS score of 9.8.

On default installations where open self-registration is enabled, successful exploitation allows a remote, unauthenticated attacker, or any user with repository write access, to execute arbitrary commands with the privileges of the Gitea process. Depending on the service account's permission level, successful compromise enables an attacker to extract sensitive credentials and configurations, and may allow for altering build outputs, potentially threatening the integrity of downstream artifacts.

Update (August 25, 2026): There is evidence that CVE-2026-60004 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 25, 2026.

The following versions are affected

Gitea: Versions 1.17 through 1.27.0 (inclusive)

What is Gitea?

Gitea is an open-source, self-hosted Git service written in Go that provides web-based repository hosting, issue tracking, and code review capabilities using minimal system resources.

What is the impact?

Successful exploitation of this vulnerability would allow a remote attacker to achieve full remote code execution on the host server with the privileges of the Gitea process, exposing system secrets and credentials while creating potential risk to downstream build pipelines.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Gitea: Upgrade to version 1.27.1 or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Gitea AND product:=Gitea

Zimbra vulnerability CVE-2026-73570: find impacted assets

2026-08-24T18:40:00-04:00

Latest Zimbra vulnerability: CVE-2026-73570

Zimbra disclosed that certain versions of Zimbra Collaboration are affected by an unauthenticated remote code execution (RCE) vulnerability if the server is configured with the snmp_notify parameter. A crafted SMTP message sent to the Zimbra server can reach the vulnerable logic of the SNMP notification handler and an attacker can achieve RCE unauthenticated. The vulnerability has been designated CVE-2026-73570 and has been rated high with a CVSS score of 8.9.

There is evidence that CVE-2026-73570 is being actively exploited in the wild and the vulnerability has been added to the CISA KEV list August 21th, 2026.

The following versions are affected

Zimbra Collaboration: Versions prior to 10.1.20

What is Zimbra?

Zimbra Collaboration is a collaboration software suite, which provides users with a quickly deployable E-mail and webmail server.

What is the impact?

Successful exploitation of this vulnerability would allow a remote attacker without authentication to achieve full remote code execution on the host server with the privileges of the Zimbra system.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Zimbra Collaboration: Upgrade to version 10.1.20 or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Zimbra AND product:=Collaboration AND _asset.protocol:snmp

Red Hat Keycloak vulnerability CVE-2026-18963: find impacted assets

2026-08-24T18:18:00-04:00

Latest Red Hat Keycloak vulnerability: CVE-2026-18963

Red Hat disclosed that certain versions of Keycloak are affected by a vulnerability in the reset-credentials authentication flow within the keycloak-services component caused by improper state validation. Successful exploitation allows a remote, unauthenticated attacker to gain full access to any user account by bypassing the email verification step during the password recovery process. The vulnerability has been designated CVE-2026-18963 and has been rated critical with a CVSS score of 9.1.

The following versions are affected

Red Hat build of Keycloak 26.4: Versions prior to 26.4.15-1 (rhbk/keycloak-operator-bundle) and 26.4-23 (rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator)
Red Hat build of Keycloak 26.6: Versions prior to 26.6.6-1 (rhbk/keycloak-operator-bundle) and 26.6-12 (rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator)

What is Red Hat Keycloak?

Red Hat Keycloak is an open-source enterprise software platform that provides centralized authentication, single sign-on (SSO), and access management for web applications and microservices.

What is the impact?

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to achieve full account takeover, granting unauthorized access to sensitive organization systems and user data.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Red Hat build of Keycloak 26.4: Upgrade to version 26.4.15-1 (rhbk/keycloak-operator-bundle), 26.4-23 (rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator), or later.
Red Hat build of Keycloak 26.6: Upgrade to version 26.6.6-1 (rhbk/keycloak-operator-bundle), 26.6-12 (rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator), or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate systems running potentially vulnerable software:

vendor:="Red Hat" AND product:="Keycloak"

VMware vCenter vulnerabilities: How to find impacted devices

2024-09-17T16:33:00-04:00

Latest Broadcom VMware vCenter vulnerabilities: CVE-2026-59309 and CVE-2026-59310

Broadcom disclosed multiple vulnerabilities affecting certain versions of VMware vCenter:

CVE-2026-59309: An authentication bypass vulnerability in the VMware Directory Service. Successful exploitation allows a remote, unauthenticated attacker with network access to vCenter to gain unauthorized access to the system. The vulnerability has been designated CVE-2026-59309 and has been rated critical with a CVSS score of 9.8.
CVE-2026-59310: A directory traversal vulnerability in the syslog server. Successful exploitation allows a remote, unauthenticated attacker with network access to vCenter to execute arbitrary code. The vulnerability has been designated CVE-2026-59310 and has been rated critical with a CVSS score of 9.8.

Update (August 18, 2026): There is evidence that CVE-2026-59310 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 18, 2026.

The following versions are affected

VMware Cloud Foundation & VMware vSphere Foundation 9.1.x.x: Versions prior to 9.1.0.0300
VMware Cloud Foundation & VMware vSphere Foundation 9.0.x.x: Versions prior to 9.0.2.0100
VMware vCenter 8.0: Versions prior to 8.0 Update 3k (U3k)
VMware Cloud Foundation 5.x: Versions prior to 8.0 Update 3k (U3k)
VMware Telco Cloud Platform (TCP): Versions 3.0, 4.x, 5.0.x, and 5.1.x
VMware Telco Cloud Infrastructure (TCI): Version 3.0

What is Broadcom VMware vCenter?

Broadcom VMware vCenter is a centralized management software platform that allows IT administrators to control, monitor, and automate virtualized server infrastructure across multiple ESXi hypervisors from a single interface.

What is the impact?

Successful exploitation of these vulnerabilities would allow an attacker to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

VMware Cloud Foundation & VMware vSphere Foundation 9.1.x.x: Upgrade to version 9.1.0.0300 or later.
VMware Cloud Foundation & VMware vSphere Foundation 9.0.x.x: Upgrade to version 9.0.2.0100 or later.
VMware vCenter 8.0: Upgrade to version 8.0 Update 3k (U3k) or later.
VMware Cloud Foundation 5.x: Async patch to vCenter 8.0 Update 3k (U3k). Refer to KB88287.
VMware Telco Cloud Platform (TCP) 3.0, 4.x, 5.0.x, 5.1.x: Refer to KB449886.
VMware Telco Cloud Infrastructure (TCI) 3.0: Refer to KB449886.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

(vendor:=VMware OR vendor:=Broadcom) AND (product:="vCenter Server" OR product:="vCenter" OR product:="VMware Cloud Foundation")

November 2024: CVE-2024-38812

Broadcom has issued a security advisory for VMware vCenter that indicates that one of the two vulnerabilities disclosed on the 17th of September, 2024, CVE-2024-38812, which was fully patched by October 21, is under active exploitation in the wild.

This vulnerability has a CVSS score of 9.8, which is considered highly critical.

What is the impact?

An attacker with remote access to a vulnerable system could send specially crafted requests that could trigger a heap-overflow and result in remote code execution or privilege escalation into root.

Are updates or workarounds available?

Broadcom has issued patches to resolve both vulnerabilities. Reference the Response Matrix section of the advisory for the appropriate fixed version to apply in your environment.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

product:vCenter

CVE-2024-38812 and CVE-2024-33813 (September 2024)

Broadcom has issued a security advisory for two vulnerabilities that affect VMware vCenter, which exists in both VMware vSphere and VMware Cloud Foundation products.

CVE-2024-38812 is rated critical with CVSS score of 9.8, and potentially allows for remote code execution.
CVE-2024-38813 is rated high with CVSS score of 7.5, which can result in privilege escalation into root.

What is the impact?

An attacker with remote access to a vulnerable system could send specially crafted requests that could trigger a heap-overflow and result in remote code execution or privilege escalation into root.

Are updates or workarounds available?

Broadcom has issued patches to resolve both vulnerabilities. Reference the Response Matrix section of the advisory for the appropriate fixed version to apply in your environment.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

product:vCenter

Apple macOS vulnerability: how to find impacted assets

2026-08-18T16:58:00-04:00

Latest Apple macOS vulnerability: CVE-2026-65400

Apple disclosed in three separate advisories that certain versions of macOS Screen Sharing are affected by an authentication bypass vulnerability, due to underlying state management issues. Successful exploitation allows a remote, unauthenticated attacker to bypass credential checks and gain unauthorized access to the system. The vulnerability has been designated CVE-2026-65400 and has been rated critical with a CVSS score of 9.8.

There is evidence that CVE-2026-65400 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 18, 2026.

The following versions are affected

macOS Tahoe 26.x: Versions prior to 26.6.1
macOS Sequoia 15.x: Versions prior to 15.7.9
macOS Sonoma 14.x: Versions prior to 14.8.9

What is Apple macOS Screen Sharing?

Apple macOS Screen Sharing is a built-in utility that allows users to remotely view and control another Mac over a local network or the Internet using the VNC protocol.

What is the impact?

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to bypass authentication mechanisms and gain full remote desktop control over the affected system without valid credentials.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

macOS Tahoe 26.x: Upgrade to version 26.6.1 or later.
macOS Sequoia 15.x: Upgrade to version 15.7.9 or later.
macOS Sonoma 14.x: Upgrade to version 14.8.9 or later.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

os:="Apple macOS%" AND port:5900 AND protocol:vnc

Metabase vulnerability CVE-2026-72898: Find impacted assets

2026-08-11T10:48:00-04:00

Latest Metabase vulnerability: CVE-2026-72898

Metabase disclosed that certain versions of Metabase On-Premises are affected by a SQL injection vulnerability exploitable via a password reset API endpoint. Successful exploitation allows a remote, unauthenticated attacker with HTTP(S) access to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. The vulnerability has been designated CVE-2026-72898 and has been rated critical with a CVSS score of 10.0.

There is evidence that this vulnerability is being actively exploited in the wild and the vulnerability has been added to the CISA KEV list August 11th, 2026.

The following versions are affected

Metabase: Versions x.63.0 through x.63.4.
Metabase: Versions x.62.0 through x.62.8.
Metabase: Versions x.61.0 through x.61.10.
Metabase: Versions x.60.0 through x.60.16.
Metabase: Versions x.59.0 through x.59.20.
Metabase: Versions x.58.0 through x.58.23.

What is Metabase?

Metabase is an open-source business intelligence tool used by organizations to visualize data and share insights through interactive dashboards. It is typically deployed in corporate environments to provide a graphical interface for querying databases such as PostgreSQL or MySQL.

What is the impact?

Successful exploitation of this vulnerability would allow an unauthenticated, remote attacker to change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.

Are any updates or workarounds available?

Users are strongly encouraged to update to the latest version as quickly as possible:

Metabase x.63.x: Upgrade to version x.63.5 or later.
Metabase x.62.x: Upgrade to version x.62.9 or later.
Metabase x.61.x: Upgrade to version x.61.11 or later.
Metabase x.60.x: Upgrade to version x.60.17 or later.
Metabase x.59.x: Upgrade to version x.59.21 or later.
Metabase x.58.x: Upgrade to version x.58.24 or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Metabase AND product:=Metabase

BMC vulnerabilities (Lights Out) - runZero Research

2026-08-05T18:35:00-04:00

runZero Lights Out BMC Research

runZero has identified multiple vulnerabilities across major Baseboard Management Controller (BMC) implementations that expose BMC management subsystems to unauthorized control or disruption, which may enable network segmentation bypasses. Technical details for individual CVEs will be published as coordinated disclosure processes conclude.

BMCs are specialized microcontrollers embedded in enterprise servers that operate independently of the host operating system. These devices run dedicated firmware, maintain distinct network interfaces, and remain network-reachable even when the primary host server is powered off. Many BMC implementations rely on the Intelligent Platform Management Interface (IPMI) protocol, which was shown to contain severe architectural flaws in Dan Farmer's 2013 research concerning Cipher Zero authentication bypasses and RAKP password hash disclosure. While subsequent research has identified numerous vendor-specific BMC vulnerabilities, previous efforts have rarely re-examined core IPMI protocol implementations.

High-level details of our findings will be presented at Black Hat 2026 (Lights Out: BMCs Are Still Broken and Now We Have the Receipts) and DEF CON 34 (Lights Out: Out-of-Band, Out of Mind, Out of Control).

The following implementations are affected:

OpenBMC
Supermicro IPMI
HPE iLO
Dell iDRAC
AMI MegaRAC
Raritan
H3C HDM
Fujitsu

What is the impact?

Successful exploitation of these vulnerabilities would allow an attacker to bypass security controls to access, control, or disrupt affected Baseboard Management Controllers (BMCs), which may enable lateral movement or persistence across managed enterprise infrastructure.

Are any updates or workarounds available?

Monitor BMC vendor advisories closely and establish a formal patching process across all deployed BMC vendors. runZero will detect and flag individual vulnerabilities as disclosure deadlines expire and corresponding CVEs are published.

To protect unpatched assets, restrict management access to trusted IP addresses or internal subnets, and isolate the interface from the public Internet entirely wherever possible. If complete isolation is not feasible, ensure access is strictly limited to a secure VPN or dedicated management network. Additionally, implement enhanced monitoring on all remaining management pathways.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

(protocol:ipmi OR type:=BMC) AND (
  hw:=OpenBMC OR 
  hw:="Super Micro IPMI" OR 
  hw:="HP% iLO%" OR 
  hw:="Dell iDRAC%" OR 
  hw:="AMI MegaRAC" OR 
  (hw:="Raritan%" AND type:="Power Device") OR 
  hw:="H3C HDM" OR 
  hw:="Fujitsu%")

JetBrains TeamCity vulnerability: how to find impacted assets

2026-07-30T09:34:00-04:00

Latest JetBrains TeamCity vulnerability: CVE-2026-63077

JetBrains disclosed that certain versions of TeamCity On-Premises are affected by a remote code execution (RCE) vulnerability exploitable via the server's agent polling protocol. Successful exploitation allows a remote, unauthenticated attacker with HTTP(S) access to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. Depending on the service account's permission level, successful compromise enables the attacker to steal sensitive credentials and configurations or alter build outputs, threatening the integrity of build artifacts and downstream CI/CD workflows. The vulnerability has been designated CVE-2026-63077 and has been rated critical with a CVSS score of 9.8.

The following versions are affected

TeamCity: All On-Premises versions prior to 2026.1.3 and 2025.11.7.

What is JetBrains TeamCity?

JetBrains TeamCity is a continuous integration and continuous delivery (CI/CD) server that automates the building, testing, and deployment of software applications across distributed build environments.

What is the impact?

Successful exploitation of this vulnerability would allow an unauthenticated, remote attacker to gain full control over the TeamCity server, enabling them to steal sensitive organizational credentials and compromise the security and integrity of downstream software build pipelines.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

TeamCity 2026.x: Upgrade to version 2026.1.3 or later.
TeamCity 2025.x: Upgrade to version 2025.11.7 or later.
TeamCity 2024.12.x through 2017.1.x: Apply the official security patch plugin, or upgrade to a supported, fixed release (2026.1.3 or 2025.11.7).
All older, unsupported product versions: Upgrade to a supported, fixed release (2026.1.3 or 2025.11.7).

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=JetBrains AND product:=TeamCity

CVE-2024-27198, CVE-2024-27199 (March 2024)

On March 3rd, 2024, JetBrains disclosed two serious vulnerabilities in the TeamCity On-Premises product.

The first issue, CVE-2024-27198, allows attackers to bypass authentication controls and access the TeamCity installation with administrative privileges. This issue has been given a CVSS score of 9.8, indicating a highly critical vulnerability.

The second issue, CVE-2024-27199, is a path-traversal vulnerability allowing attackers to perform limited administative actions without proper authentication. This issue has been given a CVSS score of 7.3, indicating a high severity.

What is the impact?

Upon successful exploitation of these vulnerabilities, attackers can execute arbitrary commands on the vulnerable system. This includes the creation of new users, installation of additional modules or code, and, in general, system compromise.

Are updates/workarounds available?

JetBrains has released an update to mitigate this issue. Users are urged to update as quickly as possible.

How to find TeamCity installations with runZero

TeamCity On-Premises assets can be found by navigating to the Asset Inventory and using the following pre-built query to locate TeamCity services on your network:

product:"TeamCity"

Results from the above query should be triaged to determine if they require patching or vendor intervention. Additional fingerprinting research is ongoing, and additional queries will be published as soon as possible.

CVE-2024-23917 (February 2024)

On February 6th, 2024, JetBrains disclosed a serious vulnerability, CVE-2024-23917, allowing attackers who can access the TeamCity installation via HTTPS to bypass authentication mechanisms and gain administrative privileges on the affected systems.

JetBrains released an update to mitigate this issue. Users were urged to update as quickly as possible.

CVE-2023-42793 (September 2023)

On September 20th, 2023, JetBrains announced a critical authentication bypass vulnerability that impacted users running the TeamCity On-Premises product. The vulnerability was tracked using CVE-2023-42793, and presented the weakness of CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Successfully exploiting this vulnerability would allow an unauthenticated remote attacker to perform a Remote Code Execution (RCE) attack and gain administrative access to the underlying system.

JetBrains issued a patch for this vulnerability in revision 2023.05.4, encouraging all users to upgrade. For users that could not immediately apply the update, a security patch plugin was also made available. More information can be found on JetBrain’s website.

Cisco Secure FMC vulnerability CVE-2026-20316: Find impacted assets

2026-03-05T15:01:00-05:00

Latest Cisco Secure FMC vulnerability: CVE-2026-20316

Cisco disclosed that certain versions of Cisco Secure Firewall Management Center (FMC) are affected by a static credential vulnerability in the web interface. The flaw stems from hardcoded credentials for a low-privileged user account. Successful exploitation allows a remote, unauthenticated attacker with access to the management interface to authenticate with these low-privileged credentials and access sensitive data within the system. The vulnerability has been designated CVE-2026-20316 and has been rated medium with a CVSS score of 5.3.

Cisco assigned a high Security Impact Rating (SIR) to the vulnerability, noting that it could be chained with other FMC flaws to elevate privileges. A Rapid Response was issued in March 2026 for CVE-2026-20079, and Cisco appears to have updated its advisory for that CVE alongside this one. However, the exact relationship between the two issues remains unclear, given that CVE-2026-20079 is an authentication bypass vulnerability requiring no privileges.

There is evidence that CVE-2026-20316 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on July 29, 2026.

The following versions are affected

FMC 10.0: Versions prior to hotfix Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar
FMC 7.7: Versions prior to hotfix Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
FMC 7.6: Versions prior to hotfix Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
FMC 7.4: Versions prior to hotfix Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
FMC 7.2: Versions prior to hotfix Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
FMC 7.0: Versions prior to hotfix Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar

What is Cisco Secure Firewall Management Center?

Cisco Secure Firewall Management Center (FMC) is a centralized administrative platform used to configure security policies, manage firmware updates, and aggregate threat telemetry across physical and virtual Cisco security appliances from a single interface.

What is the impact?

Successful exploitation of this vulnerability would allow an unauthenticated, remote attacker to gain initial access using static low-privileged credentials and potentially chain this access with other flaws to elevate privileges and compromise sensitive system data.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

FMC 10.0: Install hotfix Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar or upgrade to a later fixed release.
FMC 7.7: Install hotfix Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar or upgrade to a later fixed release.
FMC 7.6: Install hotfix Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar or upgrade to a later fixed release.
FMC 7.4: Install hotfix Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar or upgrade to a later fixed release.
FMC 7.2: Install hotfix Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar or upgrade to a later fixed release.
FMC 7.0: Install hotfix Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar or upgrade to a later fixed release.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Cisco AND product:=FMC

March 2026: CVE-2026-20079 and CVE-2026-20131

Cisco disclosed in two advisories that certain versions of Cisco Secure Firewall Management Center (FMC) are affected by the following vulnerabilities:

The Cisco FMC web interface contains an authentication bypass vulnerability stemming from an improper system process created at boot time. A remote, unauthenticated adversary could exploit this by sending crafted HTTP requests, allowing them to bypass authentication and execute script files or commands to obtain root access to the underlying operating system. The vulnerability has been designated CVE-2026-20079 and has been rated critical with a CVSS score of 10.0.
The Cisco FMC web-based management interface contains a remote code execution (RCE) vulnerability due to insecure deserialization of a user-supplied Java byte stream. A remote, unauthenticated adversary could exploit this by sending a crafted serialized Java object to the interface, allowing them to execute arbitrary code and elevate privileges to root. Note: Deployments where the management interface lacks public Internet access significantly reduce the associated attack surface. The vulnerability has been designated CVE-2026-20131 and has been rated critical with a CVSS score of 10.0.

There is evidence that CVE-2026-20131 is being actively exploited in the wild.

The following versions of Cisco FMC are affected by one or both vulnerabilities

Cisco FMC versions prior to 7.0.9
Cisco FMC versions prior to 7.2.11
Cisco FMC versions prior to 7.4.4 (CVE-2026-20079) and prior to 7.4.6 (CVE-2026-20131)
Cisco FMC versions prior to 7.6.4 (CVE-2026-20079) and prior to 7.6.5 (CVE-2026-20131)
Cisco FMC versions prior to 7.7.12
Cisco FMC versions prior to 10.0.1 (CVE-2026-20131 only)

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Cisco FMC 6.4.0.13 through 6.4.0.18 upgrade to version 7.0.9 and later
Cisco FMC 7.0.x upgrade to version 7.0.9 and later
Cisco FMC 7.1.x through 7.2.x upgrade to version 7.2.11 and later
Cisco FMC 7.3.x through 7.4.x upgrade to version 7.4.6 and later
Cisco FMC 7.6.x upgrade to version 7.6.5 and later
Cisco FMC 7.7.x upgrade to version 7.7.12 and later
Cisco FMC 10.0.0 upgrade to version 10.0.1 and later

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

os:="Cisco FMC%" AND os_version:>0 AND
  ((os_version:>="6.4.0.13" AND os_version:<="6.4.0.18") OR
  (os_version:>="7.0.0" AND os_version:<"7.0.9") OR
  (os_version:>="7.1.0" AND os_version:<"7.2.11") OR
  (os_version:>="7.3.0" AND os_version:<"7.4.6") OR
  (os_version:>="7.6.0" AND os_version:<"7.6.5") OR
  (os_version:>="7.7.0" AND os_version:<"7.7.12") OR
  (os_version:="10.0.0"))

WordPress vulnerabilities (wp2shell): Find impacted instances

2026-07-18T17:57:00-04:00

Latest WordPress vulnerabilities: CVE-2026-60137 & CVE-2026-63030

WordPress disclosed multiple vulnerabilities affecting the core WordPress framework. The vulnerabilities have been designated CVE-2026-60137 and CVE-2026-63030, and are rated critical with a CVSS score of 9.8. These vulnerabilities have been dubbed wp2shell.

What is WordPress?

Wordpress is a content management system that is designed for blog publishing and management of web content. It is widely deployed with a large set of plugins and is used for a wide variety of applications.

What is the impact?

Successful exploitation of these issues may allow an unauthenticated remote attacker to conduct an SQL injection and gain remote administrative access and remote code execution on the vulnerable WordPress instances.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

6.9.5 and later
7.0.2 and later
7.1 Beta 2 and later

How to find potentially vulnerable systems with runZero

From the Services Inventory, use the following query to locate potentially impacted assets:

product:"wordpress" AND _service.product:wordpress

SharePoint Server vulnerabilities: How to find impacted assets

2025-07-20T20:12:00-04:00

Latest SharePoint Server vulnerability: CVE-2026-55040 and CVE-2026-56164

Security researchers and Microsoft have disclosed multiple vulnerabilities affecting certain versions of SharePoint Server:

CVE-2026-55040: An authentication bypass vulnerability stemming from weaknesses in how it validates JSON Web Tokens (JWTs). A remote, unauthenticated attacker who knows or enumerates a target user's Active Directory Security ID (SID) or User Principal Name (UPN) can leverage this flaw to bypass authentication checks. Successful exploitation grants the attacker unauthorized access, allowing them to perform actions, disclose files, and modify data under the identity of the impersonated user, including administrators. The vulnerability has been designated CVE-2026-55040 and has been rated critical with a CVSS score of 9.1.
CVE-2026-56164: A privilege escalation vulnerability stemming from missing authentication for a critical function. Successful exploitation allows a remote, unauthenticated attacker to elevate privileges. The vulnerability has been designated CVE-2026-56164 and has been rated medium with a CVSS score of 5.3.

Vulnerability researchers disclosed that CVE-2026-55040 is the first link in a high-impact, two-vulnerability exploit chain originally developed for the Pwn2Own Berlin hacking competition. The second vulnerability, yet to be publicly disclosed, is a remote code execution (RCE) flaw. Microsoft plans to patch the RCE vulnerability during its August 2026 security update cycle. Applying the July 2026 patch for CVE-2026-55040 is critical, as it successfully disrupts this exploit chain and prevents unauthenticated RCE.

Update (July 15, 2026): There is evidence that CVE-2026-56164 is being actively exploited in the wild, prompting its addition to the CISA KEV catalog on July 14, 2026.

The following versions are affected

SharePoint Enterprise Server 2016: Versions prior to 16.0.5561.1001
SharePoint Server 2019: Versions prior to 16.0.10417.20175
SharePoint Server Subscription Edition: Versions prior to 16.0.19725.20434

What is Microsoft SharePoint?

Microsoft SharePoint is a web-based collaboration and document management platform, available both within Microsoft 365 and as on-premises software, that serves as a secure, centralized hub for storing, organizing, and sharing information across devices.

What is the impact?

Successful exploitation of this vulnerability allows an unauthenticated attacker to bypass security checks, impersonate valid users, and gain unauthorized access to disclose or modify sensitive data on the SharePoint server.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

SharePoint Enterprise Server 2016: Upgrade to version 16.0.5561.1001 or later.
SharePoint Server 2019: Upgrade to version 16.0.10417.20175 or later.
SharePoint Server Subscription Edition: Upgrade to version 16.0.19725.20434 or later.

How do I find Microsoft SharePoint Server installations with runZero?

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Microsoft AND version:>0 AND (
  (product:="SharePoint Server 2016" AND (version:>=16.0.4107.1002 AND version:<16.0.5561.1001)) OR
  (product:="SharePoint Server 2019" AND (version:>=16.0.10337.12109 AND version:<16.0.10417.20175)) OR
  (product:="SharePoint Server Subscription Edition" AND (version:>=16.0.0.1 AND version:<16.0.19725.20434))
  )

March 2026: CVE-2026-20963

On January 13, 2026, Microsoft disclosed a remote code execution vulnerability, designated CVE-2026-20963, in Microsoft SharePoint. The vulnerability is due to deserialization of untrusted data in Microsoft SharePoint which allows a remote, unauthenticated attacker attacker to execute code over a network.

While initially released with a CVSS score of 8.8, the score was updated to 9.8 on March 17, 2026.

This vulnerability is known to be exploited in the wild and was added to the CISA.gov Known Exploited Vulnerabilities (KEV) list on March 18, 2026.

The following versions are affected:

SharePoint Enterprise Server 2016 before version 16.0.5535.1001
SharePoint Server 2019 before version 16.0.10417.20083
SharePoint Server Subscription Edition before version 16.0.19127.20442

What is the impact?

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are any updates or workarounds available?

Upgrade affected versions of SharePoint Server to the latest patched version.

SharePoint Enterprise Server 2016 version 16.0.5535.1001 or later
SharePoint Server 2019 version 16.0.10417.20083 or later
SharePoint Server Subscription Edition version 16.0.19127.20442 or later

How do I find Microsoft SharePoint Server installations with runZero?

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Microsoft AND (
  (product:="SharePoint Server 2016" AND (version:>=16.0 AND version:<16.0.5535.1001)) OR
  (product:="SharePoint Server 2019" AND (version:>=16.0 AND version:<16.0.10417.20083)) OR
  (product:="SharePoint Server Subscription Edition" AND (version:>=16.0 AND version:<16.0.19127.20442))
  ) AND NOT version:=""

July 2025 (Multiple CVEs)

Microsoft has disclosed two vulnerabilities in certain versions of on-premises Microsoft SharePoint Server:

SharePoint Server deserializes untrusted data without sufficiently ensuring that the resulting data will be valid resulting in a remote code execution (RCE) vulnerability. The vulnerability allows an unauthenticated adversary to remotely execute code on the vulnerable server. This vulnerability has been designated CVE-2025-53770 and has been rated critical with a CVSS score of 9.8. This vulnerability is a variant of a remote code execution vulnerability designated CVE-2025-49704 that was patched earlier this month. There is evidence that this vulnerability is being actively exploited in the wild.
SharePoint Server improperly limits a pathname to a restricted directory allowing path traversal in Microsoft Office SharePoint resulting in a spoofing vulnerability. The vulnerability allows an authorized adversary to perform spoofing over a network. This vulnerability has been designated CVE-2025-53771 and has been rated medium with a CVSS score of 6.3. This vulnerability is a variant of a spoofing vulnerability designated CVE-2025-49706 that was patched earlier this month.

The following versions are affected

Microsoft SharePoint Enterprise Server 2016 versions currently unknown
Microsoft SharePoint Server 2019 versions currently unknown
Microsoft SharePoint Server Subscription Edition versions 16.0.0 prior to 16.0.18526.20508

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are any updates or workarounds available?

As of 7/20/2025 security updates are available for Microsoft SharePoint Server Subscription Edition. A patch is currently unavailable for other affected versions, but Microsoft is actively working on a security update.

Mitigate attacks against on-premises SharePoint Server environments by configuring the Windows Antimalware Scan Interface (AMSI) integration in SharePoint and deploying Defender AV on all SharePoint servers. This should stop an unauthenticated adversary from successfully exploiting the vulnerability.
Rotate SharePoint Server ASP.NET machine keys.
Upgrade affected systems to the new versions when a patch is available.

How do I find Microsoft SharePoint Server installations with runZero?

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="Microsoft" AND product:="SharePoint Server%"

Adobe ColdFusion vulnerabilities: How to find impacted assets

2025-04-08T17:43:00-04:00

Latest Adobe ColdFusion vulnerabilities: Multiple CVEs

Adobe disclosed (via bulletin ID APSB26-68) multiple vulnerabilities in their ColdFusion rapid application development product that could allow an attacker to execute arbitrary code on vulnerable systems, or disclose the contents of arbitrary files.

CVE-2026-48276: Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. This vulnerability is considered critical with a CVSS score of 10.0.
CVE-2026-48277: Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. This vulnerability is considered critical with a CVSS score of 10.0.
CVE-2026-48281: Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. This vulnerability is considered critical with a CVSS score of 10.0.
CVE-2026-48282: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. This vulnerability is considered critical with a CVSS score of 10.0.
CVE-2026-48283: Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. This vulnerability is considered critical with a CVSS score of 10.0.
CVE-2026-48313: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. This vulnerability is considered critical with a CVSS score of 9.3.
CVE-2026-48315: Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. This vulnerability is considered critical with a CVSS score of 9.3.
CVE-2026-48307: Reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially resulting in arbitrary code execution in the context of the current user. This vulnerability is considered high with a CVSS score of 8.8.
CVE-2026-48285: Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. This vulnerability is considered high with a CVSS score of 8.6.

Update (July 7, 2026): There is evidence that CVE-2026-48282 is being actively exploited in the wild.

What is Adobe ColdFusion?

Adobe ColdFusion is a commercial rapid web-application development platform that runs on top of Java and uses its own simplified scripting language, ColdFusion Markup Language (CFML). It is primarily designed to easily connect dynamic web pages to databases and streamline complex enterprise tasks with minimal code.

What is the impact?

Successfully exploiting one of these vulnerabilities could allow an attacker to execute arbitrary code on the vulnerable system, or disclose the contents of arbitrary files.

ColdFusion 2025.9, 2023.20, and earlier versions are vulnerable.

Are updates or workarounds available?

Adobe has released updates that address these vulnerabilities and users are advised to upgrade as quickly as possible.

How do I find potentially vulnerable systems with runZero?

From the Software Inventory, use the following query to locate systems running potentially vulnerable software:

vendor:=Adobe AND product:ColdFusion

April 2025: Adobe ColdFusion vulnerabilities

On April 8, 2025, Adobe disclosed (via bulletin ID APSB25-15) multiple vulnerabilities in their ColdFusion rapid application development product that could allow an attacker to execute arbitrary code on vulnerable systems, or disclose the contents of arbitrary files.

What was the impact?

Successfully exploiting one of these vulnerabilities could allow an attacker to execute arbitrary code on the vulnerable system, or disclose the contents of arbitrary files.

ColdFusion 2021, 2023, and 2025 were vulnerable.

Were updates or workarounds available?

Adobe released updates that addressed these vulnerabilities and users were advised to upgrade as quickly as possible.

How do I find potentially vulnerable systems with runZero?

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

product:ColdFusion

Microsoft SQL Server vulnerabilities: Find impacted assets

2025-07-09T17:59:00-04:00

Latest Microsoft SQL Server vulnerabilities

Microsoft has disclosed three vulnerabilities in certain versions of Microsoft SQL Server:

SQL Server is affected by a heap-based buffer overflow vulnerability that may allow an authorized adversary to escape the SQL server context and remotely execute code on the target host. Successful exploitation of the vulnerability requires the adversary to prepare the target environment prior to executing a specially crafted query. This vulnerability has been designated CVE-2025-49717 and has been rated high with a CVSS score of 8.5.
SQL Server is affected by an information disclosure vulnerability due its use of an uninitialized resource. Successful exploitation may allow an unauthorized adversary to remotely inspect heap memory from a privileged process running on the target host. This vulnerability has been designated CVE-2025-49718 and has been rated high with a CVSS score of 7.5.
SQL Server is affected by an information disclosure vulnerability due to improper input validation. Successful exploitation may allow an unauthorized adversary to remotely inspect uninitialized memory on the target host. This vulnerability has been designated CVE-2025-49719 and has been rated high with a CVSS score of 7.5.

It may be possible that the information returned via CVE-2025-49718 and CVE-2025-49719 could aid in the successful exploitation of CVE-2025-49717, as these vulnerabilities may be useful for disclosing sensitive authentication information or for manipulating heap memory to be more amenable to exploitation.

The following versions are affected by CVE-2025-49717 and CVE-2025-49718

Microsoft SQL Server 2019 (GDR) versions 15.x prior to 15.0.2135.5
Microsoft SQL Server 2019 (CU 32) versions 15.x prior to 15.0.4435.7
Microsoft SQL Server 2022 (GDR) versions 16.x prior to 16.0.4200.1
Microsoft SQL Server 2022 (CU 19) versions 16.x prior to 16.0.1140.6

The following versions are affected by CVE-2025-49719

Microsoft SQL Server 2016 for Service Pack 2 (GDR) versions 13.x prior to 13.0.6460.7
Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack versions 13.x prior to 13.0.7055.9
Microsoft SQL Server 2017 (GDR) versions 14.x prior to 14.0.2075.8
Microsoft SQL Server 2017 (CU 31) versions 14.x prior to 14.0.3495.9
Microsoft SQL Server 2019 (GDR) versions 15.x prior to 15.0.2135.5
Microsoft SQL Server 2019 (CU 32) versions 15.x prior to 15.0.4435.7
Microsoft SQL Server 2022 (GDR) versions 16.x prior to 16.0.4200.1
Microsoft SQL Server 2022 (CU 19) versions 16.x prior to 16.0.1140.6

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise, or leak sensitive information.

Are any updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible.

Microsoft SQL Server 2016 for Service Pack 2 (GDR) upgrade to version 13.0.6460.7 or later
Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack upgrade to version 13.0.7055.9 or later
Microsoft SQL Server 2017 (GDR) upgrade to version 14.0.2075.8 or later
Microsoft SQL Server 2017 (CU 31) upgrade to version 14.0.3495.9 or later
Microsoft SQL Server 2019 (GDR) upgrade to version 15.0.2135.5 or later
Microsoft SQL Server 2019 (CU 32) upgrade to version 15.0.4435.7 or later
Microsoft SQL Server 2022 (GDR) upgrade to version 16.0.4200.1 or later
Microsoft SQL Server 2022 (CU 19) upgrade to version 16.0.1140.6 or later

If the SQL Server version is not represented above then it is no longer supported. It is advised users upgrade their software to the latest Service Pack or SQL Server product in order to apply current and future security updates.

How do I find Microsoft SQL Server installations with runZero?

From the Services Inventory, use the following query to locate potentially impacted assets:

protocol:mssql AND has:mssql.version AND (mssql.product:="Microsoft SQL Server%" OR mssql.versionName:="SQL Server 20%")
AND ((mssql.versionMajor:=13 AND mssql.versionMinor:=0) AND ((mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=6460 AND mssql.versionSubBuild:<7) OR (NOT mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=7055 AND mssql.versionSubBuild:<9))
OR (mssql.versionMajor:=14 AND mssql.versionMinor:=0) AND ((mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=2075 AND mssql.versionSubBuild:<8) OR (NOT mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=3495 AND mssql.versionSubBuild:<9))
OR (mssql.versionMajor:=15 AND mssql.versionMinor:=0) AND ((mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=2135 AND mssql.versionSubBuild:<5) OR (NOT mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=4435 AND mssql.versionSubBuild:<7))
OR (mssql.versionMajor:=16 AND mssql.versionMinor:=0) AND ((mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=4200 AND mssql.versionSubBuild:<1) OR (NOT mssql.releaseInfo:" GDR: " AND mssql.versionBuild:<=1140 AND mssql.versionSubBuild:<6)))

Splunk Enterprise vulnerability: Find impacted assets

2026-06-15T16:24:00-04:00

Latest Splunk Enterprise vulnerability: CVE-2026-20253

Splunk disclosed that certain versions of the Splunk Enterprise solution utilize the PostgreSQL Sidecar Service that contains an unauthenticated file upload vulnerability. Remote unauthenticated attackers can utilize this vulnerability to forge remote database connections and trigger database administrative actions to achieve remote code execution and gain access to the underlying operating system. This vulnerability has been designated CVE-2026-20253, and has been rated critical with a CVSS score of 9.8.

Update (June 18, 2026): This vulnerability is known to be exploited in the wild and was added to the CISA.gov Known Exploited Vulnerabilities (KEV) list.

The following versions are affected:

Splunk Enterprise:
- Versions 10.0.0 through 10.0.6
- Versions 10.2.0 through 10.2.3

What is Splunk Enterprise?

Splunk provides ingestion and indexing of machine-generated data, and is commonly used for logging, tracing, SIEM, and other business processes. The PostgreSQL Sidecar Service is a Splunk provided storage integration that provides a PostgreSQL database and API provider for Splunk Enterprise deployments.

What is the impact?

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to bypass authentication, trigger database backups, trigger database restores containing attacker controlled connection information, and users of the complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Splunk Enterprise 10.0.x: Version 10.0.7 or later.
Splunk Enterprise 10.2.x: Version 10.2.4 or later.

Splunk has provided a set of workarounds and mitigations in their advisory.

How to find potentially vulnerable systems with runZero

From the Software inventory, use the following query to locate potentially impacted assets:

vendor:="Splunk" AND (product:="Splunk" OR product:="splunkd") AND
  version:>0 AND
  ((version:>=10.0.0 AND version:<=10.0.6) OR
  (version:>=10.2.0 AND version:<=10.2.3))

Ivanti Sentry vulnerabilities: How to find affected assets

2026-06-10T16:44:00-04:00

Latest Ivanti Sentry vulnerabilities: CVE-2026-10520 and CVE-2026-10523

Ivanti disclosed that certain versions of Sentry are susceptible to two vulnerabilities.

CVE-2026-10520: An OS command injection vulnerability allows a remote, unauthenticated attacker to achieve root-level remote code execution (RCE). This vulnerability has been designated CVE-2026-10520 and has been rated critical with a CVSS score of 10.0.
CVE-2026-10523: An authentication bypass vulnerability allows a remote, unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access. This vulnerability has been designated CVE-2026-10523 and has been rated critical with a CVSS score of 9.9.

Update (June 12, 2026): There is evidence that CVE-2026-10520 is being actively exploited in the wild.

The following versions are affected:

Ivanti Sentry: Versions 10.5.1, 10.6.1, 10.7.0, and prior.

Note: Older, unsupported product versions have not been tested but are likely also affected.

What is Ivanti Sentry?

Ivanti Sentry, formerly MobileIron Sentry, is an inline security gateway appliance that controls, encrypts, and isolates data traffic between remote mobile devices and a company's internal corporate servers based on device compliance rules set by a central management platform.

What is the impact?

Successful exploitation of these vulnerabilities would allow a remote, unauthenticated attacker to bypass authentication, create administrative accounts, and execute arbitrary commands with root privileges, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Ivanti Sentry 10.5.x: Version 10.5.2 or later.
Ivanti Sentry 10.6.x: Version 10.6.2 or later.
Ivanti Sentry 10.7.x: Version 10.7.1 or later.
All older, unsupported versions: Migrate to a supported, patched release.

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially impacted assets:

_asset.protocol:http AND protocol:http AND
  (last.http.body:"background-image:url(images/sentry-ivanti-logo-178x32.png)" OR
  last.http.body:"background-image:url(images/sentry-mi-logo-300x40.png)")

Oracle PeopleSoft vulnerability: How to find impacted assets

2026-06-12T14:54:00-04:00

Latest Oracle PeopleSoft vulnerability: CVE-2026-35273

Oracle disclosed that certain versions of the PeopleSoft Enterprise PeopleTools solution utilize the Environment Management Hub (EMHub) service that contains a server-side request forgery (SSRF) vulnerability. Remote unauthenticated attackers can utilize this vulnerability to chain outbound requests to achieve remote code execution and gain access to the underlying operating system.

Note: There is evidence that this vulnerability is being actively exploited in the wild.

The following versions are affected:

Oracle PeopleSoft: Versions 8.61 and 8.62.

What is Oracle PeopleSoft?

PeopleSoft is an enterprise resource planning (ERP) platform used for managing large organizations' business functions.

What is the impact?

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to bypass authentication, create administrative accounts, and execute arbitrary commands with root privileges, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Oracle PeopleSoft: Versions 8.61 and 8.62 should apply the supplied vendor patch immediately.

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially impacted assets:

_asset.protocol:http AND protocol:http AND (http.head.setCookie:"PS_TOKEN=" OR last.html.title:="Oracle PeopleSoft Sign-in" OR html.title:="Oracle PeopleSoft Sign-in")

Veeam RCE vulnerabilities: How to find impacted assets

2022-03-15T03:00:00-04:00

Latest Veeam Software vulnerability: CVE-2026-44963

Veeam Software disclosed that certain versions of Veeam Backup & Replication contain a vulnerability that allows an authenticated domain user to achieve remote code execution (RCE) on the Backup Server. Additional technical details have not been released at this time. This vulnerability has been designated CVE-2026-44963 and has been rated critical with a CVSS score of 9.4.

The following versions are affected:

Veeam Backup & Replication 12.x: Versions prior to 12.3.2.4854.

Note: Older, unsupported product versions have not been tested, but are likely also affected.

What is Veeam Backup & Replication?

Veeam Backup & Replication is data protection software that supports image-level backup, recovery, and replication for virtual, physical, and cloud machines.

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Veeam Backup & Replication 12.x: Version 12.3.2.4854 or later.
All older, unsupported product versions: A supported, fixed version.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Veeam AND (product:="Backup & Replication" OR product:="Veeam Backup & Replication")

March 2026: CVE-2026-21666, CVE-2026-21667, CVE-2026-21668, CVE-2026-21669, CVE-2026-21670, CVE-2026-21671, CVE-2026-21672, and CVE-2026-21708

Veeam Software disclosed in two advisories that multiple vulnerabilities have been identified in Veeam Backup & Replication which could allow for remote code execution (RCE), privilege escalation, and credential theft.

Version 12.3.x Vulnerabilities

CVE-2026-21666 & CVE-2026-21667: Allows a remote, low-privileged authenticated domain user to perform RCE on the Backup Server. The vulnerabilities designated CVE-2026-21666 and CVE-2026-21667 have been rated critical with a CVSS score of 9.9.
CVE-2026-21668: Allows a remote, low-privileged authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository. This vulnerability has been designated CVE-2026-21668 and has been rated high with a CVSS score of 8.8.

Version 13.0.x Vulnerabilities

CVE-2026-21669: Allows a remote, low-privileged authenticated domain user to perform RCE on Windows-based Backup Servers. This vulnerability has been designated CVE-2026-21669 and has been rated critical with a CVSS score of 9.9.
CVE-2026-21670: Allows a remote, low-privileged user to extract saved SSH credentials from Windows-based servers or the Veeam Software Appliance. This vulnerability has been designated CVE-2026-21670 and has been rated high with a CVSS score of 7.7.
CVE-2026-21671: Allows a remote, high-privileged user with the "Backup Administrator" role to perform RCE in high availability (HA) deployments. This vulnerability has been designated CVE-2026-21671 and has been rated critical with a CVSS score of 9.1.

Vulnerabilities Affecting Both 12.3.x and 13.0.x

CVE-2026-21672: A vulnerability allowing local privilege escalation on Windows-based Backup Servers. This vulnerability has been designated CVE-2026-21672 and has been rated high with a CVSS score of 8.8.
CVE-2026-21708: Allows a remote, low-privileged user with the "Backup Viewer" role to perform RCE as the postgres user. This vulnerability has been designated CVE-2026-21708 and has been rated critical with a CVSS score of 9.9.

The following versions are affected:

Veeam Backup & Replication versions 12.3.x prior to 12.3.2.4465
Veeam Backup & Replication versions 13.0.x prior to 13.0.1.2067

What is Veeam Backup & Replication?

Veeam Backup & Replication is data protection software that supports image-level backup, recovery, and replication for virtual, physical, and cloud machines.

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Veeam Backup & Replication versions 12.3.x upgrade to version 12.3.2.4465 or later
Veeam Backup & Replication versions 13.0.x upgrade to version 13.0.1.2067 or later

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Veeam AND (product:="Backup & Replication" OR product:="Veeam Backup & Replication")

November 2025: CVE-2025-48983, and CVE-2025-48984

Veeam Software has disclosed two remote code execution (RCE) vulnerabilities affecting certain versions of Veeam Backup & Replication. These flaws in different software components allow a remote, low-privileged adversary (authenticated domain user) to execute arbitrary code.

The first method is via a vulnerability in the Mount service on domain-joined backup infrastructure servers. This vulnerability has been designated CVE-2025-48983 and has been rated critical with a CVSS score of 9.9.
The second method is via a vulnerability in domain-joined backup servers. This vulnerability has been designated CVE-2025-48984 and has been rated critical with a CVSS score of 9.9.

The following versions are affected:

Veeam Backup & Replication versions 12.x prior to 12.3.2.4165

What is Veeam Backup & Replication?

Veeam Backup & Replication is data protection software that supports image-level backup, recovery, and replication for virtual, physical, and cloud machines.

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Veeam Backup & Replication versions 12.x upgrade to version 12.3.2.4165 or later

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Veeam AND product:="Veeam Backup & Replication" AND (version:>0 AND version:>=12 AND version:<12.3.2.4165)

Currently, runZero prebuilt integrations can identify these findings.

December 2024:

Veeam has disclosed two vulnerabilities found internally within their Veeam Service Provider Console (VSPC).

CVE-2024-42448 is rated Critical with a CVSS score of 9.9, which potentially allows remote code execution.
CVE-2024-42449 is rated High with a CVSS score of 7.1, which potentially leaks the NTLM hash of a service account and allows for the deletion of files on the server.

What is the impact?

Although there an no known exploitations of the vulnerabilities in the wild, CVE-2024-42448 could allow remote code execution by an attacker on the server. An attacker would need to launch their attack from an authorized VSPC management agent server in order to exploit either of the disclosed vulnerabilities.

Are updates or workarounds available?

No mitigations are available for the disclosed vulnerabilities. Instead, the vendor is strongly encouraging customers to "update to the latest cumulative patch".

How to find potentially vulnerable systems with runZero

From the Service Inventory, use the following query to locate systems running potentially vulnerable software:

has:"html.title" html.title:"Veeam Service Provider Console"

December 2022

Veeam published information on two vulnerabilities in the Veeam Backup & Replication product, originally reported by Nikita Petrov of Positive Technologies.

As of December 16th, CISA had announced the addition of two critical vulnerabilities (tracked as CVE-2022-26500 and CVE-2022-26501) to the KEV catalog. These CVEs were actively being exploited, putting systems at risk. It was critical that these systems were updated to patch these vulnerabilities as soon as possible.

Which versions were affected?

These vulnerabilities affected Backup & Replication versions 9.5, 10, and 11, allowing for exploitation by attackers to achieve unauthenticated remote code execution via the Veeam Distribution Service API. Details on the vulnerabilities (identified as CVE-2022-26500 and CVE-2022-26501) were not published at the time of writing, though Veeam had assigned a "critical" CVSS score of 9.8.

Were updates made available?

Patched releases of Veeam Backup & Replication were made available (see the "Solution" section). Guidance from Veeam was for administrators to update to these newer versions as soon as possible. If near-term updating was not possible, Veeam offered a temporary mitigation strategy via stopping-and-disabling the Veeam Distribution Service (see the "Solution->Notes" section).

How runZero users found potentially vulnerable Veeam instances

We added the default port (9380) for the Veeam Distribution Service API to our runZero Explorer and Scanner. If you were using Explorer or Scanner v2.11.5 or later, you just needed to ensure you had performed a recent scan of your assets prior to running the query below. If you were using an older Explorer or Scanner, users simply added port 9380 to the "Included TCP ports" (under the Advanced tab) and then ran a scan to gather the necessary data.

From the Asset Inventory, users ran the following pre-built query to locate Veeam Distribution Service instances within their network that could have potentially ran vulnerable versions of Veeam Backup & Replication:

tcp_port:9380

As always, any prebuilt queries we create are available from our Queries Library. Check out the library for other useful inventory queries.

LiteLLM Proxy vulnerabilities: How to find impacted assets

2026-04-23T18:38:00-04:00

Latest LiteLLM vulnerabilities: CVE-2026-42208, CVE-2026-42203, and CVE-2026-42271

LiteLLM disclosed in three advisories that certain versions of LiteLLM Proxy are susceptible to multiple vulnerabilities that can be chained together to achieve remote code execution (RCE). While official container images run the process as root, other deployments execute with the privileges of the user account running the proxy process. Research regarding the exploit chain involving GHSA-r75f-5x8p-qvmc and GHSA-xqmj-j6mv-4862 indicates that the vulnerable code path only triggers after the server has processed "a minimum amount of legitimate interaction."

CVE-2026-42208: A SQL injection vulnerability exists in the API key verification process due to improper error handling. A remote, unauthenticated attacker can exploit this by sending a specially crafted Authorization header to any LLM API endpoint (e.g., /chat/completions). Successful exploitation allows an attacker to read or potentially modify database data, leading to unauthorized access to the proxy and the credentials it manages. This vulnerability has been designated CVE-2026-42208 and has been rated critical with a CVSS score of 9.3.
CVE-2026-42203: A server-side template injection (SSTI) vulnerability in the /prompts/test API endpoint arises from the improper neutralization of user-supplied prompt templates, which are rendered without sandboxing. A crafted template can execute arbitrary code within the LiteLLM Proxy process. Successful exploitation allows a remote, authenticated user to access secrets in the process environment (e.g., provider API keys or database credentials) or execute arbitrary code on the host. This vulnerability has been designated CVE-2026-42203 and has been rated high with a CVSS score of 8.6.
CVE-2026-42271: An authenticated command execution vulnerability exists in the MCP stdio test endpoints (/mcp-rest/test/connection and /mcp-rest/test/tools/list), which are used to preview an MCP server before saving. A remote, low-privileged attacker can exploit this by providing a crafted server configuration in the request body. The command is spawned as a subprocess on the proxy host with the privileges of the proxy process. This vulnerability has been designated CVE-2026-42271 and has been rated high with a CVSS score of 8.7.

These vulnerabilities do not currently have CVE IDs assigned, however, the vulnerability currently designated GHSA-r75f-5x8p-qvmc has been rated critical with a CVSS score of 9.3.

Update (April 27, 2026): The advisories now reflect assigned CVE IDs; however, these remain in a "reserved" state, and further details have not yet been provided by the CNA.

Update (May 8, 2026): There is evidence that CVE-2026-42208 is being actively exploited in the wild. The CVE IDs listed above have been updated with the latest CVSS score information.

Update (June 8, 2026): There is evidence that CVE-2026-42271 is being actively exploited in the wild.

The following versions are affected:

LiteLLM: Versions 1.81.16 through 1.83.6

What is LiteLLM Proxy?

LiteLLM Proxy is an open-source gateway that enables applications to interact with multiple large language model (LLM) providers through a single, standardized API by translating requests into the specific formats required by each service.

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

LiteLLM: Upgrade to v1.83.7-stable or later.

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially impacted assets:

_asset.protocol:http AND protocol:http AND (html.title:="LiteLLM%" OR last.html.title:="LiteLLM%")

PAN-OS vulnerability CVE-2026-0257: Find affected systems

2024-04-12T12:54:00-04:00

Latest Palo Alto Networks vulnerability: CVE-2026-0257

Palo Alto Networks (PAN) has disclosed that certain versions of PAN-OS are affected by an authentication bypass vulnerability in the GlobalProtect portal and gateway. Successful exploitation allows a remote, unauthenticated attacker to bypass security restrictions, establish an unauthorized VPN connection, and gain access to restricted networks. The vulnerability has been designated CVE-2026-0257 and has been rated high with a CVSS score of 7.8.

There is evidence that this vulnerability is being actively exploited in the wild. Note that the Rapid Response released on May 13, 2026 covered many of the affected versions of PAN-OS, but CVE-2026-0257 is somewhat more expansive in scope than CVE-2026-0263, and more versions are affected.

The following versions are affected

PAN-OS 12.1: Versions 12.1.5 through 12.1.6, and 12.1.2 through 12.1.4-h*.
PAN-OS 11.2: Versions 11.2.11 or later, 11.2.8 through 11.2.10-h*, 11.2.5 through 11.2.7-h*, and 11.2.0 through 11.2.4-h*.
PAN-OS 11.1: Versions 11.1.14 or later, 11.1.11 through 11.1.13-h*, 11.1.8 through 11.1.10-h*, 11.1.7 through 11.1.7-h*, 11.1.5 through 11.1.6-h*, and 11.1.0 through 11.1.4-h*.
PAN-OS 10.2: Versions 10.2.17 through 10.2.18-h*, 10.2.14 through 10.2.16-h*, 10.2.11 through 10.2.13-h*, 10.2.8 through 10.2.10-h*, and 10.2.0 through 10.2.7-h*.

Note: It is possible that older, unsupported PAN-OS versions are also vulnerable, but this has not been confirmed.

What is Palo Alto Networks PAN-OS?

PAN-OS is the proprietary operating system that powers all Palo Alto Networks Next-Generation Firewalls (NGFW) across physical, virtual, and cloud environments. It uses a Single-Pass Parallel Processing (SP3) architecture to provide deep visibility and control over network traffic by identifying applications, users, and content simultaneously.

What is the impact?

Successful exploitation of the vulnerability would allow an attacker to establish an unauthorized VPN connection and gain access to protected networks.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

PAN-OS 12.1: Upgrade to version 12.1.4-h6, 12.1.7, or later.
PAN-OS 11.2: Upgrade to version 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12, or later.
PAN-OS 11.1: Upgrade to version 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15, or later.
PAN-OS 10.2: Upgrade to version 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6, or later.
All older, unsupported PAN-OS versions: Upgrade to a supported, fixed version.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

hw:="Palo Alto Networks" AND os:="Palo Alto Networks PAN-OS%" AND os_version:>0 AND
  ((os_version:>="12.1.5" AND os_version:<"12.1.7") OR
  (os_version:>="12.1.2" AND os_version:<"12.1.4-h6") OR
  (os_version:>="11.2.11" AND os_version:<"11.2.12") OR
  (os_version:>="11.2.8" AND os_version:<"11.2.10-h7") OR
  (os_version:>="11.2.5" AND os_version:<"11.2.7-h14") OR
  (os_version:>="11.2.0" AND os_version:<"11.2.4-h17") OR
  (os_version:>="11.1.14" AND os_version:<"11.1.15") OR
  (os_version:>="11.1.11" AND os_version:<"11.1.13-h5") OR
  (os_version:>="11.1.8" AND os_version:<"11.1.10-h25") OR
  (os_version:>="11.1.7" AND os_version:<"11.1.7-h6") OR
  (os_version:>="11.1.5" AND os_version:<"11.1.6-h32") OR
  (os_version:>="11.1.0" AND os_version:<"11.1.4-h33") OR
  (os_version:>="10.2.17" AND os_version:<"10.2.18-h6") OR
  (os_version:>="10.2.14" AND os_version:<"10.2.16-h7") OR
  (os_version:>="10.2.11" AND os_version:<"10.2.13-h21") OR
  (os_version:>="10.2.8" AND os_version:<"10.2.10-h36") OR
  (os_version:>="10.2.0" AND os_version:<"10.2.7-h34"))

May 13, 2026: CVE-2026-0263

Palo Alto Networks (PAN) released a security advisory for a high buffer overflow vulnerability in the IKEv2 processing that allows an unauthenticated remote attacker to execute arbitrary code with elevated privileges or cause a denial of service.

CVE-2026-0263 is rated high with CVSS score of 7.2, is a buffer overflow vulnerability and potentially allows for remote code execution with elevated privileges.

What is the impact?

CVE-2026-0263 allows for an unauthenticated remote attacker to execute arbitrary code with elevated privileges or lead to a denial of service (DoS).

The vulnerability only affects PA-Series firewalls if IKEv2 VPN tunnels are configured with Post Quantum Cryptography (PQC).

Are updates or workarounds available?

Within the advisory, Palo Alto recommends "configuring IKEv2 VPN tunnels only with NIST approved Post Quantum Cryptography (PQC) ciphers".

PAN-OS 12.1: Upgrade to 12.1.7 or later,
12.1.4-h5 or 12.1.7 or later.
PAN-OS 11.2: Upgrade to 11.2.12 or later,
11.2.10-h6 or 11.2.12 or later,
11.2.7-h13 or 11.2.12 or later,
11.2.4-h17 or 11.2.12 or later.
PAN-OS 11.1: Upgrade to 11.1.15 or later,
  11.1.13-h5 or 11.1.15 or later,
  11.1.10-h25 or 11.1.15 or later,
  11.1.7-h6 or 11.1.15 or later,
  11.1.6-h32 or 11.1.15 or later,
  11.1.4-h33 or 11.1.15 or later.

How to find PAN-OS systems on your network

From the Asset Inventory you can use the following query to locate potentially vulnerable PAN-OS systems:

hw:="Palo Alto Networks" AND os:="Palo Alto Networks PAN-OS%" AND os_version:>0 AND
  ((os_version:>="12.1.5" AND os_version:<"12.1.7") OR
  (os_version:>="12.1.2" AND os_version:<"12.1.4-h5") OR
  (os_version:>="11.2.11" AND os_version:<"11.2.12") OR
  (os_version:>="11.2.8" AND os_version:<"11.2.10-h6") OR
  (os_version:>="11.2.5" AND os_version:<"11.2.7-h13") OR
  (os_version:>="11.2.0" AND os_version:<"11.2.4-h17") OR
  (os_version:>="11.1.14" AND os_version:<"11.1.15") OR
  (os_version:>="11.1.11" AND os_version:<"11.1.13-h5") OR
  (os_version:>="11.1.8" AND os_version:<"11.1.10-h25") OR
  (os_version:>="11.1.7" AND os_version:<"11.1.7-h6") OR
  (os_version:>="11.1.5" AND os_version:<"11.1.6-h32") OR
  (os_version:>="11.1.0" AND os_version:<"11.1.4-h33"))

May 5, 2026: CVE-2026-0300

On May 5, 2026, Palo Alto Networks (PAN) released a security advisory for a critical buffer overflow vulnerability in the User-ID Authentication Portal (Captive Portal) that allows an unauthenticated remote attacker to execute arbitrary code with root privileges.

CVE-2026-0300 is rated critical with CVSS score of 9.3, is a buffer overflow vulnerability and potentially allows for remote code execution with root privileges.

On May 6, 2026, CISA announced that the vulnerability is actively being exploited and it was added to the Known Exploited Vulnerabilities (KEV) Catalog.

What is the impact?

CVE-2026-0300 allows for an unauthenticated remote attacker to execute arbitrary code with root privileges, which can lead to complete system takeover.

The vulnerability only affects PA-Series and VM-Series firewalls if they're set up with the Captive Portal.

Are updates or workarounds available?

Within the advisory, Palo Alto recommends restricting access to the Captive Portal to trusted internal IP addresses. Additionally, they advise following a set of best practices to secure device access.

Palo Alto Networks has a patch release scheduled for CVE-2026-0300 ranging between 5/15 through 5/28.

How to find PAN-OS systems on your network

From the Asset Inventory you can use the following query to locate potentially vulnerable PAN-OS systems:

hw:="Palo Alto Networks%" AND os:="Palo Alto Networks PAN-OS%" AND 
os_version:>0 AND ((os_version:<"10.2.7-h34") OR  
(os_version:>"10.2.7-h34" AND os_version:<"10.2.10-h36") OR  
(os_version:>"10.2.10-h36" AND os_version:<"10.2.13-h21") OR  
(os_version:>"10.2.13-h21" AND os_version:<"10.2.16-h7") OR  
(os_version:>"10.2.16-h7" AND os_version:<"10.2.18-h6") OR  
(os_version:>="11.1" AND os_version:<"11.1.4-h33") OR  
(os_version:>"11.1.4-h33" AND os_version:<"11.1.6-h32") OR  
(os_version:>"11.1.6-h32" AND os_version:<"11.1.7-h6") OR  
(os_version:>"11.1.7-h6" AND os_version:<"11.1.10-h25") OR  
(os_version:>"11.1.10-h25" AND os_version:<"11.1.13-h5") OR  
(os_version:>"11.1.13-h5" AND os_version:<"11.1.15") OR  
(os_version:>="11.2" AND os_version:<"11.2.4-h17") OR  
(os_version:>"11.2.4-h17" AND os_version:<"11.2.7-h13") OR  
(os_version:>"11.2.7-h13" AND os_version:<"11.2.10-h6") OR  
(os_version:>"11.2.10-h6" AND os_version:<"11.2.12") OR  
(os_version:>="12.1" AND os_version:<"12.1.4-h5") OR  
(os_version:>"12.1.4-h5" AND os_version:<"12.1.7"))

From the Service Inventory you can use the following query to locate potentially vulnerable PAN-OS Captive Portals:

_service.favicon.ico.image.md5:c8c08bbe0b78b27d61002db456c741cc AND _service.http.code:="403" and (port:6080 OR port:6081 OR port:6082)

February 2025 (Multiple CVEs)

On February 20, 2025, Palo Alto Networks updated another security advisory notifying customers of other active exploitation of vulnerabilities being chained together with CVE-2025-0108. In the advisory, CVE-2025-0111, with a CVSS score of 7.1, the vendor warns that an "authenticated attacker with network access to the management web interface" could gain read access to files accessible by the nobody user on the local filesystem.

On February 18, 2025 Palo Alto Networks confirmed that CVE-2025-0108 was being actively exploited in the wild. They also updated their advisory noting that the vulnerability could be chained together with other patched vulnerabilities including CVE-2024-9474.

On February 12, 2025 Palo Alto Networks (PAN) has issued multiple security advisories for vulnerabilities in PAN-OS.

CVE-2025-0108 is rated high with a CVSS score of 7.8. Successful exploitation of this vulnerability would allow a remote unauthenticated attacker to bypass authentication and run certain scripts.
CVE-2025-0109 is rated medium with a CVSS score of 5.5. Successful exploitation of this vulnerability would allow a remote unauthenticated attacker to delete certain files as the "nobody" user. This includes certain logs and configuration files but not system files.

What is the impact?

An attacker that can access the web administration interface of a device running PAN-OS can execute certain scripts or delete certain files.

Are updates or workarounds available?

Palo Alto has released updates to address these vulnerability, and strongly recommends that users update as quickly as possible. They also recommend that users restrict access to vulnerable systems' web interfaces as quickly as possible, and prior to applying any updates.

How to find PAN-OS systems on your network

From the Asset Inventory you can use the following query to locate potentially vulnerable systems:

os:"PAN-OS"

November 2024 (Multiple CVEs)

On November 18, 2024 Palo Alto Networks (PAN) issued a security advisory for a vulnerability that allows an unauthenticated attacker with access to the system's management PAN-OS web interface to gain administrator privileges on the device. There is limited evidence that CVE-2024-0012 is being exploited in the wild. This vulnerability is rated as critical with a 9.3 CVSS score.

What is the impact?

An attacker that can access the web administration interface of a device running PAN-OS can gain administrative privileges on the system. This would allow the attacker control over the system, and additionally may allow the attacker paths to further exploits (for example, CVE-2024-9474).

Palo Alto has indicated that there is limited evidence of exploitation of this vulnerability in the wild. Palo Alto's Unit 42 research organization has authored a writeup on the vulnerability that includes some Indicators of Compromise (IoCs).

Note that CISA (the Cybersecurity and Infrastructure Security Agency) has added CVE-2024-0012 and CVE-2024-9474 to their Known Exploited Vulnerabilities catalog.

Are updates or workarounds available?

Palo Alto has released updates to address this vulnerability, and strongly recommends that users update as quickly as possible. They also recommend that users restrict access to vulnerable systems' web interfaces as quickly as possible, and prior to applying any updates.

How to find PAN-OS systems on your network

From the Asset Inventory you can use the following query to locate potentially vulnerable systems:

os:"PAN-OS"

CVE-2024-5910, CVE-2024-9463, and CVE-2024-9465

Palo Alto Networks (PAN) updated a security advisory advising customers to restrict access to the management interface of Next-Generation Firewalls (NGFW) due to an actively exploited zero-day vulnerability.

CISA announced that CVE-2024-5910, which was patched in July, is actively being exploited and was added to the Known Exploited Vulnerabilities (KEV) Catalog. Although not directly affecting PAN-OS, this vulnerability affects the Expedition migration tool, which could contain API keys, administrator credentials, and/or PAN-OS device configuration information.

Additionally, CISA announced that both CVE-2024-9463 (CVSS 9.9) and CVE-2024-9465 (CVSS 9.3) are actively being exploited and were also added to the Known Exploited Vulnerabilities (KEV) Catalog. Both vulnerabilities also affect the Expedition migration tool.

What is the impact?

Although no specific details of a remote code execution vulnerability were disclosed within the advisory, Palo Alto is actively investigating an active exploitation of a zero-day vulnerability against the management interfaces of NGFWs exposed to the public Internet.

CVE-2024-5910 allows for a remote attacker to reset application admin credentials on Expedition servers. Additionally, successful exploitation of the other two vulnerabilities above could allow for a remote attacker to execute arbitrary OS commands or reveal the contents of the underlying database.

Are updates or workarounds available?

Within the advisory, Palo Alto recommends restricting access to the management interface. Additionally, they advise following a set of best practices to secure the management interface.

Palo Alto Networks released a patch for CVE-2024-5910 in July.

How to find PAN-OS systems on your network

From the Asset Inventory you can use the following query to locate potentially vulnerable systems:

os:"PAN-OS" type:"Firewall"

How to find Expedition servers on your network

From the Service Inventory you can use the following query to locate potentially vulnerable systems:

html.title:="Expedition Project"

October 10, 2024 vulnerabilities

Palo Alto Networks (PAN) released a security advisory with multiple vulnerabilities on PAN-OS firewalls that could lead to admin account takeover.

CVE-2024-9463 is rated critical with CVSS score of 9.9, is an OS command injection vulnerability and potentially allows for and execution of OS commands as root.
CVE-2024-9464 is rated critical with CVSS score of 9.3, is an OS command injection vulnerability and potentially allows for the execution of OS commands as root.
CVE-2024-9465 is rated critical with CVSS score of 9.2, is a SQL injection vulnerability and potentially allows a remote unauthenticated attacker to read the contents of the Expedition database.
CVE-2024-9466 is rated high with CVSS score of 8.2, and potentially allows for an authenticated user to read sensitive information including passwords and API keys.
CVE-2024-9467 is rated high with CVSS score of 7.0, is an XSS vulnerability and potentially allows for execution of malicious JavaScript code that could result in session hijacking.

If chained together through an exploit, a firewall running the vulnerable software could be completely taken over by an unauthenticated remote attacker. For more information, the team that disclosed the vulnerabilities to Palo Alto Networks, published a detailed analysis. According to the vendor, there was no known malicious exploitation of vulnerable systems at the time.

According to Palo Alto Networks, "The fixes for all listed issues are available in Expedition 1.2.96, and all later Expedition versions." They also recommended rotating all passwords and API keys after applying the latest patch to prevent future unauthorized access. Refer to the Workarounds and Mitigations section of the security advisory for information about potential workarounds and additional advice.

CVE-2024-3400

Palo Alto Networks (PAN) disclosed that certain versions of their PAN-OS software had a vulnerability that allowed for remote command injection.

CVE-2024-3400 was rated critical with CVSS score of 9.8 and indicated an unauthenticated attacker could execute arbitrary code with root privileges on the firewall. The vendor indicated that there was evidence of limited exploitation in the wild.

watchTowr posted a detailed analysis including the details needed for exploitation. This analysis covered two separate vulnerabilities; an arbitrary file creation vulnerability in the session handler, and a shell metacharacter injection issue that lead to remote execution through the telemetry script. PAN updated their guidance to state that "Disabling device telemetry is no longer an effective mitigation".

The following PAN-OS versions were affected by this vulnerability.

Version	Affected	Unaffected
PAN-OS 11.1	< 11.1.2-h3	>= 11.1.2-h3 (hotfix ETA: By 4/14)
PAN-OS 11.0	< 11.0.4-h1	>= 11.0.4-h1 (hotfix ETA: By 4/14)
PAN-OS 10.2	< 10.2.9-h1	>= 10.2.9-h1 (hotfix ETA: By 4/14)

Palo Alto Networks indicated that PAN-OS 11.1, 11.0, and 10.2 versions with the configurations for both GlobalProtect gateway and device telemetry enabled.

Customers could verify this by checking for entries in the firewall web interface (Network > GlobalProtect > Gateways) and verify whether device telemetry was enabled by checking the firewall web interface (Device > Setup > Telemetry).

Palo Alto Networks recommended that customers with a Threat Prevention subscription block attacks for this vulnerability by enabling Threat ID 95187 (introduced in Applications and Threats content version 8833-8682) and applying vulnerability protection to GlobalProtect interfaces.

It was also recommended that telemetry be disabled until devices could be upgraded to an unaffected version of PAN-OS.

Gogs RCE vulnerability: How to find impacted assets

2025-12-10T12:49:00-05:00

Latest Gogs vulnerability:

Rapid7 has disclosed that certain versions of Gogs are affected by an argument injection vulnerability within the pull request "Rebase before merging" style merge handling. The flaw is caused by a malicious pull request branch name being passed directly to the git rebase command without a -- delimiter to indicate the end of options. As a result, the branch name is interpreted as the --exec flag. Successful exploitation allows a remote, authenticated attacker to achieve remote code execution (RCE) as the Gogs server process user via a crafted pull request. Because Gogs ships with open registration enabled by default (DISABLE_REGISTRATION = false), the authentication requirement poses less of a barrier in default configurations. This vulnerability does not currently have a CVE ID assigned, and the vendor has not released a patch.

The following versions are affected

Gogs: Versions 0.14.2 and 0.15.0+dev (commit b53d3162)
Note: Prior versions supporting the "Rebase before merging" merge style are likely to be vulnerable as well.

What is Gogs?

Gogs is an open-source, self-hosted Git repository management system written in Go that provides a web-based interface for version control with minimal hardware resource requirements.

What is the impact?

Successful exploitation of the vulnerability would allow an attacker to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

There is currently no patched version of Gogs available. To mitigate risk, immediately disable open registration (DISABLE_REGISTRATION = true) and limit the Internet exposure of any Gogs instances. If applicable, restrict user repository creation (MAX_CREATION_LIMIT = 0) to reduce the immediate attack surface.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Gogs AND product:=Gogs

March 2026: CVE-2026-25921

Gogs has disclosed that certain versions are affected by a cross-repository Large File Storage (LFS) object overwrite vulnerability due to missing content hash verification. Git LFS is an open-source extension designed to manage large files, such as audio samples, videos, and datasets, more efficiently within Git repositories. Because Gogs stores all LFS objects in a single location without repository isolation, this flaw could allow a remote, unauthenticated adversary to overwrite existing objects. The vulnerability has been designated CVE-2026-25921 and has been rated critical with a CVSS score of 9.3.

The following versions are affected

Gogs versions prior to 0.14.2

What is the impact?

Successful exploitation of the vulnerability enables an adversary to overwrite legitimate LFS objects with malicious content. This introduces a significant risk of a supply-chain attack; because the Gogs web interface does not present integrity warnings, users may unknowingly download and utilize compromised assets.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Gogs upgrade to version 0.14.2 or later

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Gogs AND product:=Gogs

December 2025: CVE-2025-8110

Security researchers at Wiz have reported a 0-day vulnerability in Gogs. This flaw allows remote, authenticated attackers to overwrite arbitrary files on the vulnerable system. Successful exploitation of this vulnerability would allow an attacker to execute arbitrary code on the vulnerable system with the privileges of the Gogs server process.

This vulnerability has been assigned CVE-2025-8110 and has a CVSS score of 7.8.

Note that there is evidence that this vulnerability is being actively exploited in the wild.

The following versions are affected

Gogs versions 0.13.3 and prior

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

There is currently no patched fixed version of Gogs available. Users are encouraged to disable auto-registration of users and avoid Internet exposure for any Gogs installations.

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially vulnerable assets:

_asset.protocol:=http AND protocol:=http AND favicon.ico.image.md5:=5f5b7539f014b9996959f5dcd063d383

Drupal core vulnerability CVE-2026-9082: Find impacted assets

2026-05-22T18:40:00-04:00

Latest Drupal core vulnerability: CVE-2026-9082

Drupal disclosed that certain versions of Drupal core are affected by a SQL injection vulnerability in the database abstraction API due to the improper neutralization of special elements. This flaw allows a remote, unauthenticated attacker to send specially crafted requests that result in arbitrary SQL execution on sites configured to use a PostgreSQL database. Successful exploitation allows an attacker to achieve information disclosure and, in select cases, privilege escalation, remote code execution (RCE), or other attacks. This vulnerability has been designated CVE-2026-9082 and has been rated critical with a CVSS score of 9.8.

There is evidence that this vulnerability is being actively exploited in the wild.

The following versions are affected:

Drupal: Versions 8.9.0 to before 10.4.10
Drupal: Versions 10.5.0 to before 10.5.10
Drupal: Versions 10.6.0 to before 10.6.9
Drupal: Versions 11.0.0 to before 11.1.10
Drupal: Versions 11.2.0 to before 11.2.12
Drupal: Versions 11.3.0 to before 11.3.10

Note: this vulnerability only affects sites configured to use a PostgreSQL database.

What is Drupal core?

Drupal core is the blank-slate version of the PHP-based content management system (CMS) and web application framework that includes only the essential tools needed to build, log into, and run a basic website.

What is the impact?

Successful exploitation of this vulnerability could result in information disclosure, privilege escalation, remote code execution (RCE), or other arbitrary attacks.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

Drupal 8.9: Manually apply the patch SA-CORE-2026-004-8.9.patch.
Drupal 9.x: Manually apply the Drupal 9.5 patch SA-CORE-2026-004-9.5.patch.
Drupal 10.4.x or earlier: Upgrade to version 10.4.10 or later.
Drupal 10.5.x: Upgrade to version 10.5.10 or later.
Drupal 10.6.x: Upgrade to version 10.6.9 or later.
Drupal 11.0.x or 11.1.x: Upgrade to version 11.1.10 or later.
Drupal 11.2.x: Upgrade to version 11.2.12 or later.
Drupal 11.3.x: Upgrade to version 11.3.10 or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Drupal AND product:=Drupal

Vercel Next.js vulnerability: How to find impacted assets

2025-12-04T09:00:00-05:00

Latest Vercel Next.js vulnerability: CVE-2026-44578

Vercel disclosed that self-hosted Next.js applications using the built-in Node.js server are vulnerable to server-side request forgery (SSRF) within the WebSocket upgrade handling mechanism. A remote, unauthenticated attacker can exploit this flaw by sending crafted WebSocket upgrade requests. Successful exploitation allows the server to proxy requests to arbitrary internal or external destinations. This can expose sensitive internal services or cloud infrastructure endpoints, such as the Instance Metadata Service (IMDS), a local HTTP endpoint used by virtual machines to retrieve configurations, IP addresses, and IAM roles via a link-local address. This vulnerability has been designated CVE-2026-44578 and has been rated high with a CVSS score of 8.6.

The following versions are affected:

Next.js 13, 14, and 15: Versions 13.4.13 through 15.5.15
Next.js 16: Versions 16.0.0 through 16.2.4

What is Vercel Next.js?

Next.js, an open-source React framework developed by Vercel, provides structure, routing, and rendering solutions for building full-stack web applications.

What is the impact?

Successful exploitation of this vulnerability would allow an attacker to proxy requests to arbitrary internal or external destinations, potentially exposing sensitive internal services or cloud infrastructure endpoints.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions:

Next.js 13.x, 14.x, and 15.x: Upgrade to version 15.5.16 or later.
Next.js 16.x: Upgrade to version 16.2.5 or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Vercel AND product:="Next.js"

December 2025: CVE-2025-55182

React disclosed a remote code execution (RCE) vulnerability in React Server Components that affects the React packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack in versions 19.0.0 through 19.2.0, as well as frameworks that use them, such as Next.js. The upstream vulnerability has been designated CVE-2025-55182 and has been rated critical with a CVSS score of 10.0. Next.js also disclosed the downstream RCE vulnerability impacting applications using the App Router.

This flaw stems from an issue in how React decodes payloads sent to React Server Function endpoints (used by client components to call async functions on the server). Successful exploitation allows a remote, unauthenticated adversary to send a specially crafted request and subsequently execute arbitrary code on the server.

There is evidence that this vulnerability is being actively exploited in the wild.

The following versions are affected

Next.js 14.3.x versions 14.3.0-canary.77 and greater
Next.js 15.0.x versions prior to 15.0.5
Next.js 15.1.x versions prior to 15.1.9
Next.js 15.2.x versions prior to 15.2.6
Next.js 15.3.x versions prior to 15.3.6
Next.js 15.4.x versions prior to 15.4.8
Next.js 15.5.x versions prior to 15.5.7
Next.js 16.0.x versions prior to 16.0.7

What is the impact?

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available?

Users are encouraged to update to the latest version as quickly as possible:

Next.js 15.0.x upgrade to version 15.0.5 or later
Next.js 15.1.x upgrade to version 15.1.9 or later
Next.js 15.2.x upgrade to version 15.2.6 or later
Next.js 15.3.x upgrade to version 15.3.6 or later
Next.js 15.4.x upgrade to version 15.4.8 or later
Next.js 15.5.x upgrade to version 15.5.7 or later
Next.js 16.0.x upgrade to version 16.0.7 or later

Note: Users of Next.js 14.3.x experimental canary releases should downgrade specifically to version 14.3.0-canary.76 or a 14.x stable release.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

(vendor:=Zeit OR vendor:=Vercel) AND (product:=Next.Js OR product:=Next.js)

Exim Mail vulnerability CVE-2026-45185: Find impacted assets

2023-10-10T09:00:00-04:00

Latest Exim Mail vulnerability: CVE-2026-45185

Researchers disclosed that certain versions of Exim are susceptible to a critical remote code execution (RCE) vulnerability caused by a use-after-free (UAF) condition in the BDAT body parsing path. The flaw is specifically triggered when Exim is configured to use GnuTLS, the default TLS library for many Debian-based distributions. The vulnerability occurs when a client sends a TLS close_notify alert mid-body during an SMTP CHUNKING (RFC 3030) transfer, followed by a final cleartext byte on the same TCP connection. This specific sequence leads to heap corruption, which a remote, unauthenticated attacker can leverage to execute arbitrary code on the system. The vulnerability, designated CVE-2026-45185, also known as Dead.Letter, is rated critical with a base CVSS score of 9.8.

The following versions are affected

Exim: Versions prior to 4.99.3 (when configured with GnuTLS).

What is Exim?

Exim is an open-source Mail Transfer Agent (MTA) for Unix-like operating systems that manages the routing and delivery of email messages via SMTP using a highly flexible and programmable configuration system.

What is the impact?

Successful exploitation of the vulnerability could allow a remote, unauthenticated attacker to execute arbitrary code on the affected system.

Are updates or workarounds available?

Upgrade affected systems to the new versions

Exim: Upgrade to 4.99.3 or later.

How to find potentially vulnerable systems with runZero

From the Service inventory, use the following query to locate potentially impacted assets:

product:=exim AND banner:"STARTTLS"

October 2023: CVE-2023-42116, CVE-2023-42117, CVE-2023-42118, CVE-2023-42119, and CVE-2023-42114

On September 27th 2023, Trend Micro's Zero Day Initiative (ZDI) published details of a critical zero-day vulnerability that allows an unauthenticated attacker the ability to remotely execute arbitrary code within the context of an Exim SMTP service account. In addition, ZDI disclosed five additional zero-day vulnerabilities with lower severity rankings:

CVE-2023-42116: Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS v3.0 8.1)
CVE-2023-42117: Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability (CVSS v3.0 8.1)
CVE-2023-42118: Exim libspf2 Integer Underflow Remote Code Execution Vulnerability (CVSS v3.0 7.5)
CVE-2023-42119: Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS v3.0 3.1)
CVE-2023-42114: Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS v3.0 3.7)

What is Exim Mail?

Exim mail is an open source, message transfer agent (MTA) that runs on Unix/Linux operating systems. Exim is also the default MTA configured on Debian Linux distributions.

Are updates available?

Recently, maintainers of the Exim mail server issued a 4.96.1 patch that appears to resolve four of the six vulnerabilities listed above. Although the maintainers are still working to resolve the remaining vulnerabilities, if you are running Exim mail servers on your network, you should apply the security patch immediately.

How do I find potentially vulnerable Exim mail servers with runZero?

A Shodan search showed nearly 3.5 million Exim servers exposed to the internet. Their accessibility makes these mail transfer agents targets for attackers.

With runZero, you can find Exim mail servers in your inventory with this pre-built query. This query searches for any live asset that has the exim product exposed over SMTP.

product:exim

As always, any prebuilt queries are available from your runZero console. Check out the documentation for other useful inventory queries.

F5 nginx vulnerability: Find impacted systems

2026-05-13T16:57:00-04:00

Latest NGINX vulnerability: CVE-2026-42945

F5 published a security advisory that a high vulnerability was identified in multiple versions of NGINX products.

CVE-2026-42945: A heap-based buffer overflow vulnerability exists in the ngx_http_rewrite_module component of NGINX products. This vulnerability has been designated CVE-2026-42945 and has been rated High with a CVSS score of 8.1.

The following versions are affected:

NGINX Plus: Versions R32 through R36
NGINX Open Source: Versions 1.0.0 through 1.30.0
NGINX Open Source: Versions 0.6.27 through 0.9.7
NGINX Instance Manager: Versions 2.16.0 through 2.21.1
F5 WAF for NGINX: Versions 5.9.0 through 5.12.1
NGINX App Protect WAF: Versions 5.1.0 through 5.8.0
NGINX App Protect WAF: Versions 4.9.0 through 4.16.0
F5 DoS for NGINX: Version 4.8.0
NGINX App Protect DoS: Versions 4.3.0 through 4.7.0
NGINX Gateway Fabric: Versions 2.0.0 through 2.5.1
NGINX Gateway Fabric: Versions 1.3.0 through 1.6.2
NGINX Ingress Controller: Versions 5.0.0 through 5.4.1
NGINX Ingress Controller: Versions 4.0.0 through 4.0.1
NGINX Ingress Controller: Versions 3.5.0 through 3.7.2

What is NGINX?

Nginx is a high-performance, open-source software used primarily as a web server and reverse proxy to efficiently handle large volumes of simultaneous connections. It is widely favored for its speed and stability, often serving as a load balancer or HTTP cache to optimize the delivery of web content.

What is the impact?

A remote, unauthenticated attacker could exploit this vulnerability by sending crafted HTTP requests that trigger the vulnerable rewrite processing path, potentially allowing NGINX worker process restart (DoS). In environments where Address Space Layout Randomization (ASLR) is disabled, exploitation may also allow arbitrary code execution.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions:

NGINX Plus Rx: Upgrade to R36 P4, R32 P6 or later
NGINX Open Source: Upgrade to 1.31.0, 1.30.1 or later

To mitigate the vulnerability, users are encouraged to use named captures instead of unnamed captures within rewrite rules:

For example, the following rewrite directive uses unnamed capture groups: $1 and $2:

rewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1&tab=$2 last;

For this example, replacing $1 and $2 with $user_id and $section:

rewrite ^/users/(?[0-9]+)/profile/(?.*)$ /profile.php?id=$user_id&tab=$section last;

How to find potentially vulnerable systems with runZero

From the Software Inventory , use the following query to locate potentially impacted assets:

((vendor:="F5" OR vendor:="NGINX") AND 
  (product:="nginx plus" OR product:="nginx" OR product:="nginx ingress controller"))

Fortinet FortiAuthenticator vulnerability: Find affected assets

2026-05-12T16:57:00-04:00

Latest Fortinet FortiAuthenticator vulnerability: CVE-2026-44277

Fortinet disclosed in an advisory that a critical vulnerability was identified in multiple versions of FortiAuthenticator.

CVE-2026-44277: An improper access control vulnerability exists in Fortinet FortiAuthenticator due to insufficient authorization checks. A remote attacker with no privileges could exploit this vulnerability via a network-based attack vector, potentially allowing the execution of unauthorized code or commands. This vulnerability has been designated CVE-2026-44277 and has been rated critical with a CVSS score of 9.1.

The following versions are affected:

FortiAuthenticator 8.0: 8.0.0, 8.0.2
FortiAuthenticator 6.6: Versions 6.6.0 through 6.6.8
FortiAuthenticator 6.5: Versions 6.5.0 through 6.5.6

What is Fortinet FortiAuthenticator?

FortiAuthenticator is a centralized Identity and Access Management (IAM) solution that provides secure, identity-based access across a network by managing user authentication, multi-factor authentication (MFA), and single sign-on (SSO). It acts as a gatekeeper that integrates with existing directories to ensure only authorized users and devices can access critical resources across the Fortinet Security Fabric and third-party systems.

What is the impact?

Successful exploitation of these vulnerabilities would allow an attacker to gain unauthorized API access, enabling them to escalate privileges and execute code or commands on the vulnerable host.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions:

FortiAuthenticator 8.0: Upgrade to 8.0.3 or later
FortiAuthenticator 6.6: Upgrade to 6.6.9 or later
FortiAuthenticator 6.5: Upgrade to 6.5.7 or later

How to find potentially vulnerable systems with runZero

From the Asset Inventory , use the following query to locate potentially impacted assets:

hw:FortiAuthenticator

Fortinet FortiSandbox vulnerabilities: Find impacted assets

2026-04-15T15:24:00-04:00

Latest Fortinet FortiSandbox vulnerability: CVE-2026-26083

Fortinet disclosed in an advisory that a critical vulnerability was identified in versions of FortiSandbox.

CVE-2026-26083: A missing authorization vulnerability exists in multiple Fortinet FortiSandbox products due to improper access control enforcement. A remote, unauthenticated attacker could exploit this vulnerability by sending crafted HTTP requests, potentially allowing the execution of unauthorized code or commands. This vulnerability has been designated CVE-2026-26083 and has been rated critical with a CVSS score of 9.1.

The following versions are affected:

FortiSandbox 5.0: Versions 5.0.0 through 5.0.1
FortiSandbox 4.4: Versions 4.4.0 through 4.4.8
FortiSandbox Cloud 24: All versions
FortiSandbox Cloud 23: All versions
FortiSandbox Cloud 5.0: 5.0.2 through 5.0.5
FortiSandbox PaaS 23.4: 23.4 all versions
FortiSandbox PaaS 23.3: 23.3 all versions
FortiSandbox PaaS 23.1: 23.1 all versions
FortiSandbox PaaS 22.2: 22.2 all versions
FortiSandbox PaaS 22.1: 22.1 all versions
FortiSandbox PaaS 21.4: 21.4 all versions
FortiSandbox PaaS 21.3: 21.3 all versions
FortiSandbox PaaS 5.0: 5.0.0 through 5.0.1
FortiSandbox PaaS 4.4: 4.4.5 through 4.4.8

What is Fortinet FortiSandbox?

Fortinet FortiSandbox is a security appliance that identifies unknown threats by executing suspicious files in isolated virtual environments to monitor their behavior and then automates a response by sharing that intelligence across the network to block the detected threat.

What is the impact?

Successful exploitation of these vulnerabilities would allow an attacker to gain unauthorized API access, enabling them to escalate privileges and execute code or commands on the vulnerable host.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions:

FortiSandbox 5.0: Upgrade to 5.0.2 or later
FortiSandbox 4.4: Upgrade to 4.4.9 or later
FortiSandbox PaaS 5.0: Upgrade to 5.0.2 or later
FortiSandbox PaaS 4.4: Upgrade to 4.4.9 or later
FortiSandbox PaaS: Migrate to a fixed release
FortiSandbox Cloud: Migrate to a fixed release

How to find potentially vulnerable systems with runZero

From the Asset Inventory , use the following query to locate potentially impacted assets:

os:="Fortinet FortiSandbox%"

April 2026 Fortinet FortiSandbox vulnerabilities: CVE-2026-39808, and CVE-2026-39813

Fortinet disclosed in two advisories that multiple vulnerabilities have been identified in versions of FortiSandbox.

CVE-2026-39808: An OS command injection vulnerability exists within an API endpoint due to the improper neutralization of special elements. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted HTTP requests, potentially allowing for the execution of unauthorized code or commands. This vulnerability has been designated CVE-2026-39808 and has been rated critical with a CVSS score of 9.1.
CVE-2026-39813: An API privilege escalation vulnerability exists due to a path traversal flaw. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted HTTP requests to the JRPC API. Successful exploitation may allow an attacker to bypass authentication and escalate privileges on the system. This vulnerability has been designated CVE-2026-39813 and has been rated critical with a CVSS score of 9.1.

The following versions are affected:

FortiSandbox 4.4: Versions 4.4.0 through 4.4.8 (affected by both CVEs)
FortiSandbox 5.0: Versions 5.0.0 through 5.0.5 (affected by CVE-2026-39813 only)

What is Fortinet FortiSandbox?

What is the impact?

Successful exploitation of these vulnerabilities would allow an attacker to gain unauthorized API access, enabling them to escalate privileges and execute code or commands on the vulnerable host.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions:

FortiSandbox 4.4: Upgrade to 4.4.9 or later
FortiSandbox 5.0: Upgrade to 5.0.6 or later

How to find potentially vulnerable systems with runZero

From the Asset Inventory , use the following query to locate potentially impacted assets:

os:="Fortinet FortiSandbox%"

Ollama vulnerability CVE-2026-7482: Find impacted assets

2026-05-06T14:44:00-04:00

Latest Ollama vulnerability: CVE-2026-7482

Researchers disclosed that certain versions of Ollama are susceptible to a heap out-of-bounds read vulnerability within the GGUF model loader. A remote, unauthenticated attacker could exploit this by sending a specially crafted GGUF file to the /api/create endpoint. When the server processes a GGUF file where the declared tensor offset and size exceed the file's actual length, the functions in fs/ggml/gguf.go and server/quantization.go (WriteTo()) read past the allocated heap buffer during the quantization process.

The resulting memory leak may expose sensitive information, including environment variables, API keys, system prompts, and concurrent user conversation data. This data can then be exfiltrated by uploading the resulting model artifact to an attacker-controlled registry via the /api/push endpoint. In the upstream distribution, the /api/create and /api/push endpoints lack authentication. While default deployments bind to 127.0.0.1, the documented OLLAMA_HOST=0.0.0.0 configuration is common in practice, leading to significant public Internet exposure. This vulnerability has been designated CVE-2026-7482, also known as Bleeding Llama, and has been rated critical with a CVSS score of 9.1.

The following versions are affected:

Ollama: Versions prior to 0.17.1

What is Ollama?

Ollama is an open-source framework designed for the local deployment, management, and execution of large language models (LLMs) on personal computing hardware.

What is the impact?

Successful exploitation of this vulnerability could expose sensitive information, including environment variables, API keys, system prompts, and concurrent user conversation data.

Are updates or workarounds available?

Users are encouraged upgrade affected systems to the following versions immediately:

Ollama: Upgrade to 0.17.1 or later.

How to find potentially vulnerable systems with runZero

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Ollama AND product:=Ollama AND source:runzero

Android ADB vulnerability CVE-2026-0073: Find impacted assets

2026-05-05T12:40:00-04:00

Latest Android ADB vulnerability: CVE-2026-0073

Google disclosed that certain Android versions are susceptible to an authentication bypass vulnerability within the wireless ADB mutual authentication process. This is due to a logic error in the adbd_tls_verify_cert function of the auth.cpp subcomponent in the ADB daemon (adbd). An unauthenticated attacker with adjacent network access can exploit this flaw to achieve remote code execution (RCE) as the shell user. This exploit requires no additional privileges and no user interaction. This vulnerability has been designated CVE-2026-0073 and has been rated high with a CVSS score of 8.8.

The following versions are affected:

Android 14: Prior to the 2026-05-01 security patch level.
Android 15: Prior to the 2026-05-01 security patch level.
Android 16: Prior to the 2026-05-01 security patch level.
Android 16-qpr2: Prior to the 2026-05-01 security patch level.

What is Android Wireless Android Debug Bridge (ADB)?

Android Wireless Android Debug Bridge (ADB) is a communication feature that enables remote shell command execution, application installation, and system debugging over a local Wi-Fi network using the TCP/IP protocol, removing the need for a physical USB connection.

What is the impact?

Successful exploitation of the vulnerabilities allows an unauthenticated attacker with adjacent network access to achieve remote code execution (RCE) as the shell user.

Are updates or workarounds available?

Upgrade affected systems to the 2026-05-01 security patch level or later.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate potentially impacted assets:

protocol:=adb AND os:Android

runZero Rapid Responses

Critical RCE vulnerability in PHP: Find impacted assets

Critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619

What is PHP?

What is the impact?

Are updates or workarounds available?

Finding exposed PHP installations with runZero

BIND high-severity vulnerabilities: Find impacted systems

Latest BIND vulnerabilities:

What is BIND?

What is the impact?

Are updates or workarounds available?

Finding exposed BIND systems with runZero

October 2025: CVE-2025-40778, CVE-2025-40780, and CVE-2025-8677

What is the impact?

Are updates or workarounds available?

How to find potentially vulnerable systems with runZero

December 2024: BIND 9.20 defect in QPzone implementation

What was the impact?

Were updates or workarounds available?

How runZero users found potentially vulnerable systems

Arista VeloCloud Orchestrator ﻿﻿CVE-2026-114625 (Critical)

Critical Arista VeloCloud Orchestrator flaw: CVE-2026-114625

What is Arista VeloCloud Orchestrator (VCO)?

What is the impact?

Are any updates or workarounds available?

Finding exposed Arista VeloCloud Orchestrator appliances with runZero

September: CVE-2026-93952

What is the impact?

Are any updates or workarounds available?

Finding exposed Arista VeloCloud Orchestrator appliances with runZero

Critical GitLab CVE-2026-110264: Find impacted systems

Critical GitLab vulnerability: CVE-2026-110264

What are GitLab Community Edition (CE) and Enterprise Edition (EE)?

What is the impact?

Are updates or workarounds available?

How to find potentially vulnerable systems with runZero

October 2026: CVE-2026-97229

What are GitLab Community Edition (CE) and Enterprise Edition (EE)?

What is the impact?

Are updates or workarounds available?

How to find potentially vulnerable systems with runZero

September 2026: CVE-2026-85706

What are GitLab Community Edition (CE) and Enterprise Edition (EE)?

What is the impact?

Are updates or workarounds available?

How to find potentially vulnerable systems with runZero

August 2026: CVE-2026-19478 and CVE-2026-19650

What is the impact?

Are updates or workarounds available?

How to find potentially vulnerable systems with runZero

March 2025: CVE-2025-25291 and CVE-2025-25292

What is the impact?

Are updates or workarounds available?

How to find potentially vulnerable systems with runZero

September 17, 2024 (CVE-2024-45409)

What is the impact?

Are updates or workarounds available?

How to find potentially vulnerable systems with runZero

September 11, 2024 (CVE-2024-6678)

What is the impact?

Are updates or workarounds available?

How to find potentially vulnerable systems with runZero

February 2022 (CVE-2022-0735)

Is an update available?

How do I find potentially vulnerable GitLab instances with runZero?

Cisco Secure Email Gateway CVE-2026-76519

Cisco Secure Email Gateway vulnerability: CVE-2026-76519

What is Cisco Secure Email Gateway?

What is the impact?

Are updates or workarounds available?

Find exposed Cisco Secure Email Gateway's with runZero

September 2026: CVE-2026-76461

What is the impact?

Are updates or workarounds available?

Find exposed Cisco Secure Email Gateway's with runZero

December 2025 advisory:

What was the impact?

Were updates or workarounds available?

How runZero users found potentially vulnerable systems

Arista VeloCloud Orchestrator CVE-2026-114625 (Critical)