pwn.watch: Auth bypass incident updates

[critical] Keycloak unauthenticated account takeover gets a public exploit (CVE-2026-18963)

Thu, 22 Oct 2026 22:41:02 GMT

A flaw in Keycloak's reset-credentials flow (keycloak-services) lets an unauthenticated attacker force a password reset for any user without clicking the emailed verification link, then set new credentials and take over the account. Red Hat rates it CVSS 9.1. Fixes shipped in August (26.4.15, 26.6.6, 26.7.2); on Oct 21 a full proof-of-concept with check and takeover modes was published on Exploit-DB, so unpatched Keycloak instances should be upgraded now.

Status: live · Patch: patched · Fixed in: 26.4.15, 26.6.6, 26.7.2, 26.8.0 and later

Latest updates:

2026-10-21: Exploit-DB publishes EDB-52699 "Keycloak 26.7.2 - Unauthenticated Account Takeover" by Abel Maldonado (Orevim): a PoC with a safe --check mode and a --set-password takeover mode, tested on Keycloak 26.6.2. (source)
2026-08-18: CVE-2026-18963 published with GitHub advisory GHSA-4gv3-mc9p-5wqc (critical); fixed in keycloak-services 26.4.15, 26.6.6 and 26.7.2, with Red Hat errata for Red Hat Build of Keycloak. (source)

CVEs: CVE-2026-18963

[high] GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

Fri, 11 Sep 2026 00:00:00 GMT

GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. Added to CISA KEV on 2026-09-11.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-11: CISA added CVE-2026-85706 to the KEV catalog (due 2026-09-14).

CVEs: CVE-2026-85706

[high] Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using

Wed, 09 Sep 2026 00:00:00 GMT

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. Added to CISA KEV on 2026-09-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-09: CISA added CVE-2026-20079 to the KEV catalog (due 2026-09-12).

CVEs: CVE-2026-20079

[high] Citrix NetScaler: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Wed, 09 Sep 2026 00:00:00 GMT

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. Added to CISA KEV on 2026-09-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-09: CISA added CVE-2026-19490 to the KEV catalog (due 2026-09-12).

CVEs: CVE-2026-19490

[high] BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability

Wed, 02 Sep 2026 00:00:00 GMT

BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Added to CISA KEV on 2026-09-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-02: CISA added CVE-2026-59822 to the KEV catalog (due 2026-09-16).

CVEs: CVE-2026-59822

[high] JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability

Wed, 02 Sep 2026 00:00:00 GMT

JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. Added to CISA KEV on 2026-09-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-02: CISA added CVE-2026-82329 to the KEV catalog (due 2026-09-05).

CVEs: CVE-2026-82329

[high] Apple macOS: Apple macOS Improper Authentication Vulnerability

Tue, 18 Aug 2026 00:00:00 GMT

Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. Added to CISA KEV on 2026-08-18.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-18: CISA added CVE-2026-65400 to the KEV catalog (due 2026-08-21).

CVEs: CVE-2026-65400

[high] N-able N-central: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

Tue, 04 Aug 2026 00:00:00 GMT

N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556. CISA added CVE-2026-18577, CVE-2026-18556 to the Known Exploited Vulnerabilities catalog on 2026-08-03 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-03: CISA added CVE-2026-18577, CVE-2026-18556 to the KEV catalog (due 2026-08-06).

CVEs: CVE-2026-18577, CVE-2026-18556

[high] Check Point SmartConsole: Check Point SmartConsole Improper Authentication Vulnerability

Wed, 22 Jul 2026 00:00:00 GMT

Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Added to CISA KEV on 2026-07-22.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-07-22: CISA added CVE-2026-16232 to the KEV catalog (due 2026-07-25).

CVEs: CVE-2026-16232

[high] Microsoft SharePoint Server: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

Tue, 14 Jul 2026 00:00:00 GMT

Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. Added to CISA KEV on 2026-07-14.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-07-14: CISA added CVE-2026-56164 to the KEV catalog (due 2026-07-17).

CVEs: CVE-2026-56164

[high] Oracle PeopleSoft Enterprise PeopleTools: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Fri, 12 Jun 2026 00:00:00 GMT

Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. Added to CISA KEV on 2026-06-12.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-06-12: CISA added CVE-2026-35273 to the KEV catalog (due 2026-06-15).

CVEs: CVE-2026-35273

[high] Check Point Security Gateway: Check Point Security Gateway Improper Authentication Vulnerability

Mon, 08 Jun 2026 00:00:00 GMT

Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. Added to CISA KEV on 2026-06-08.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-06-08: CISA added CVE-2026-50751 to the KEV catalog (due 2026-06-11).

CVEs: CVE-2026-50751

[high] Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Fri, 29 May 2026 00:00:00 GMT

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection. Added to CISA KEV on 2026-05-29.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-05-29: CISA added CVE-2026-0257 to the KEV catalog (due 2026-06-01).

CVEs: CVE-2026-0257

[high] Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Thu, 14 May 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. Added to CISA KEV on 2026-05-14.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-05-14: CISA added CVE-2026-20182 to the KEV catalog (due 2026-05-17).

CVEs: CVE-2026-20182

[high] WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Thu, 30 Apr 2026 00:00:00 GMT

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-04-30: CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03).

CVEs: CVE-2026-41940

[high] Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

Mon, 09 Mar 2026 00:00:00 GMT

Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data. Added to CISA KEV on 2026-03-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-03-09: CISA added CVE-2026-1603 to the KEV catalog (due 2026-03-23).

CVEs: CVE-2026-1603

[high] Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

Wed, 25 Feb 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration f

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-02-25: CISA added CVE-2026-20127 to the KEV catalog (due 2026-02-27).

CVEs: CVE-2026-20127

[high] SmarterTools SmarterMail: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

Thu, 05 Feb 2026 00:00:00 GMT

SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution. Added to CISA KEV on 2026-02-05.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-02-05: CISA added CVE-2026-24423 to the KEV catalog (due 2026-02-26).

CVEs: CVE-2026-24423

[high] Fortinet Multiple Products: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

Tue, 27 Jan 2026 00:00:00 GMT

Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices. Added to CISA KEV on 2026-01-27.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-01-27: CISA added CVE-2026-24858 to the KEV catalog (due 2026-01-30).

CVEs: CVE-2026-24858

[critical] Oracle Fusion Middleware: Fusion Middleware Missing Authentication for Critical Function Vulnerability

Fri, 21 Nov 2025 00:00:00 GMT

Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager. Added to CISA KEV on 2025-11-21.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-11-21: CISA added CVE-2025-61757 to the KEV catalog (due 2025-12-12).

CVEs: CVE-2025-61757

[critical] Kentico Xperience CMS: 2 exploited vulnerabilities (CVE-2025-2746, CVE-2025-2747)

Mon, 20 Oct 2025 00:00:00 GMT

CVE-2025-2746: Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects. CVE-2025-2747: Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects. Added to CISA KEV on 2025-10-20.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-10-20: CISA added CVE-2025-2746 to the KEV catalog (due 2025-11-10).
2025-10-20: CISA added CVE-2025-2747 to the KEV catalog (due 2025-11-10).

CVEs: CVE-2025-2746, CVE-2025-2747

[critical] SKYSEA Client View: Client View Improper Authentication Vulnerability

Tue, 14 Oct 2025 00:00:00 GMT

SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program. Added to CISA KEV on 2025-10-14.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-10-14: CISA added CVE-2016-7836 to the KEV catalog (due 2025-11-04).

CVEs: CVE-2016-7836

[critical] Juniper ScreenOS: ScreenOS Improper Authentication Vulnerability

Thu, 02 Oct 2025 00:00:00 GMT

Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device. Added to CISA KEV on 2025-10-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-10-02: CISA added CVE-2015-7755 to the KEV catalog (due 2025-10-23).

CVEs: CVE-2015-7755

[medium] TP-Link TL-WR841N: TL-WR841N Authentication Bypass by Spoofing Vulnerability

Wed, 03 Sep 2025 00:00:00 GMT

TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-09-03.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-09-03: CISA added CVE-2023-50224 to the KEV catalog (due 2025-09-24).

CVEs: CVE-2023-50224

[high] TP-Link TL-WA855RE: TL-WA855RE Missing Authentication for Critical Function Vulnerability

Tue, 02 Sep 2025 00:00:00 GMT

TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-09-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-09-02: CISA added CVE-2020-24363 to the KEV catalog (due 2025-09-23).

CVEs: CVE-2020-24363

[critical] Sangoma FreePBX: FreePBX Authentication Bypass Vulnerability

Fri, 29 Aug 2025 00:00:00 GMT

Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. Added to CISA KEV on 2025-08-29.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-08-29: CISA added CVE-2025-57819 to the KEV catalog (due 2025-09-19).

CVEs: CVE-2025-57819

[critical] AMI MegaRAC SPx: MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

Wed, 25 Jun 2025 00:00:00 GMT

AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability. Added to CISA KEV on 2025-06-25.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-06-25: CISA added CVE-2024-54085 to the KEV catalog (due 2025-07-16).

CVEs: CVE-2024-54085

[critical] Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)

Mon, 09 Jun 2025 00:00:00 GMT

The Erlang/OTP SSH server processed connection-protocol messages before authentication, so anyone who could reach the port could run commands. It affects any product embedding the OTP SSH daemon. Fixed in OTP-27.3.3, 26.2.5.11 and 25.3.2.20; CISA confirmed exploitation in June.

Status: closed · Patch: patched · Fixed in: OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20

Latest updates:

2025-06-09: CISA adds CVE-2025-32433 to KEV
2025-04-18: Discussion and PoC references on oss-security (source)
2025-04-16: Erlang/OTP publishes advisory GHSA-37cp-fgq5-7wc2 and patched releases (source)

CVEs: CVE-2025-32433

[critical] ASUS Routers: Routers Improper Authentication Vulnerability

Mon, 02 Jun 2025 00:00:00 GMT

ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-06-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-06-02: CISA added CVE-2021-32030 to the KEV catalog (due 2025-06-23).

CVEs: CVE-2021-32030

[high] ConnectWise ScreenConnect: ScreenConnect Improper Authentication Vulnerability

Mon, 02 Jun 2025 00:00:00 GMT

ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised. Added to CISA KEV on 2025-06-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-06-02: CISA added CVE-2025-3935 to the KEV catalog (due 2025-06-23).

CVEs: CVE-2025-3935

[high] Ivanti Endpoint Manager Mobile (EPMM): 2 exploited vulnerabilities (CVE-2025-4427, CVE-2025-4428)

Mon, 19 May 2025 00:00:00 GMT

CVE-2025-4427: Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library. CVE-2025-4428: Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036. Added to CISA KEV on 2025-05-19.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-05-19: CISA added CVE-2025-4427 to the KEV catalog (due 2025-06-09).
2025-05-19: CISA added CVE-2025-4428 to the KEV catalog (due 2025-06-09).

CVEs: CVE-2025-4427, CVE-2025-4428

[critical] Langflow: Missing Authentication Vulnerability

Mon, 05 May 2025 00:00:00 GMT

Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests. Added to CISA KEV on 2025-05-05.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-05-05: CISA added CVE-2025-3248 to the KEV catalog (due 2025-05-26).

CVEs: CVE-2025-3248

[critical] CrushFTP: Authentication Bypass Vulnerability

Mon, 07 Apr 2025 00:00:00 GMT

CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. Added to CISA KEV on 2025-04-07.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-04-07: CISA added CVE-2025-31161 to the KEV catalog (due 2025-04-28).

CVEs: CVE-2025-31161

[critical] Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927)

Sat, 22 Mar 2025 00:00:00 GMT

Sending a crafted x-middleware-subrequest header made self-hosted Next.js skip middleware entirely, bypassing auth checks done there. Apps hosted on Vercel were protected. Fixed in 12.3.5, 13.5.9, 14.2.25 and 15.2.3; otherwise strip the header at the edge.

Status: closed · Patch: patched · Fixed in: 12.3.5, 13.5.9, 14.2.25, 15.2.3

Latest updates:

2025-03-22: Vercel publishes a postmortem on the bypass and its disclosure handling (source)
2025-03-21: Next.js publishes advisory GHSA-f82v-jwr5-mffw (source)

CVEs: CVE-2025-29927

[critical] Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability

Tue, 18 Mar 2025 00:00:00 GMT

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests. Added to CISA KEV on 2025-03-18.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-18: CISA added CVE-2025-24472 to the KEV catalog (due 2025-04-08).

CVEs: CVE-2025-24472

[high] Palo Alto Networks PAN-OS: PAN-OS Authentication Bypass Vulnerability

Tue, 18 Feb 2025 00:00:00 GMT

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts. Added to CISA KEV on 2025-02-18.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-02-18: CISA added CVE-2025-0108 to the KEV catalog (due 2025-03-11).

CVEs: CVE-2025-0108

[critical] SonicWall SonicOS: SonicOS SSLVPN Improper Authentication Vulnerability

Tue, 18 Feb 2025 00:00:00 GMT

SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication. Added to CISA KEV on 2025-02-18.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-02-18: CISA added CVE-2024-53704 to the KEV catalog (due 2025-03-11).

CVEs: CVE-2024-53704

[critical] Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability

Tue, 14 Jan 2025 00:00:00 GMT

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. Added to CISA KEV on 2025-01-14.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-01-14: CISA added CVE-2024-55591 to the KEV catalog (due 2025-01-21).

CVEs: CVE-2024-55591

[critical] NUUO NVRmini2 Devices Missing Authentication

Wed, 18 Dec 2024 00:00:00 GMT

NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users. Added to the CISA KEV catalog on 2024-12-18. CVE-2022-23227 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: unpatched · Fixed in: No fix: CISA says the product is end-of-life and should be retired

Latest updates:

2024-12-18: CISA added CVE-2022-23227 to the KEV catalog (federal deadline 2025-01-08) (source)

CVEs: CVE-2022-23227

[critical] CyberPersons CyberPanel: 2 actively exploited vulnerabilities

Wed, 04 Dec 2024 00:00:00 GMT

CVE-2024-51567: CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root. CVE-2024-51378: CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property. Added to the CISA KEV catalog on 2024-11-07, 2024-12-04. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-12-04: CISA added CVE-2024-51378 to the KEV catalog (federal deadline 2024-12-25) (source)
2024-11-07: CISA added CVE-2024-51567 to the KEV catalog (federal deadline 2024-11-28) (source)
2024-10-29: CVE-2024-51567 published (source)

CVEs: CVE-2024-51567, CVE-2024-51378

[critical] ProjectSend Improper Authentication

Tue, 03 Dec 2024 00:00:00 GMT

ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. Added to the CISA KEV catalog on 2024-12-03.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-12-03: CISA added CVE-2024-11680 to the KEV catalog (federal deadline 2024-12-24) (source)
2024-11-26: CVE-2024-11680 published (source)

CVEs: CVE-2024-11680

[critical] Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function

Mon, 25 Nov 2024 00:00:00 GMT

Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway. Added to the CISA KEV catalog on 2024-11-25. CISA lists known use in ransomware campaigns. CVE-2023-28461 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-11-25: CISA added CVE-2023-28461 to the KEV catalog (federal deadline 2024-12-16) (source)

CVEs: CVE-2023-28461

[critical] Palo Alto PAN-OS management interface auth bypass + privilege escalation

Mon, 18 Nov 2024 00:00:00 GMT

CVE-2024-0012: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. CVE-2024-9474: Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators. Added to the CISA KEV catalog on 2024-11-18. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-11-18: CVE-2024-0012 published (source)
2024-11-18: CVE-2024-9474 published (source)
2024-11-18: CISA added CVE-2024-0012 to the KEV catalog (federal deadline 2024-12-09) (source)

CVEs: CVE-2024-0012, CVE-2024-9474

[critical] Palo Alto Networks Expedition: 3 actively exploited vulnerabilities

Thu, 14 Nov 2024 00:00:00 GMT

CVE-2024-5910: Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data. CVE-2024-9463: Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. CVE-2024-9465: Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system. Added to the CISA KEV catalog on 2024-11-07, 2024-11-14.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-11-14: CISA added CVE-2024-9463 to the KEV catalog (federal deadline 2024-12-05) (source)
2024-11-14: CISA added CVE-2024-9465 to the KEV catalog (federal deadline 2024-12-05) (source)
2024-11-07: CISA added CVE-2024-5910 to the KEV catalog (federal deadline 2024-11-28) (source)

CVEs: CVE-2024-5910, CVE-2024-9463, CVE-2024-9465

[critical] FortiManager 'FortiJump' missing authentication zero-day (CVE-2024-47575)

Wed, 23 Oct 2024 00:00:00 GMT

Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. Added to the CISA KEV catalog on 2024-10-23.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-10-23: CVE-2024-47575 published (source)
2024-10-23: CISA added CVE-2024-47575 to the KEV catalog (federal deadline 2024-11-13) (source)

CVEs: CVE-2024-47575

[critical] Ivanti Virtual Traffic Manager Authentication Bypass

Tue, 24 Sep 2024 00:00:00 GMT

Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account. Added to the CISA KEV catalog on 2024-09-24.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-09-24: CISA added CVE-2024-7593 to the KEV catalog (federal deadline 2024-10-15) (source)
2024-08-13: CVE-2024-7593 published (source)

CVEs: CVE-2024-7593

[critical] Dahua IP Camera Firmware: 2 actively exploited vulnerabilities

Wed, 21 Aug 2024 00:00:00 GMT

CVE-2021-33044: Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication. CVE-2021-33045: Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication. Added to the CISA KEV catalog on 2024-08-21. CVE-2021-33044, CVE-2021-33045 were assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-08-21: CISA added CVE-2021-33044 to the KEV catalog (federal deadline 2024-09-11) (source)
2024-08-21: CISA added CVE-2021-33045 to the KEV catalog (federal deadline 2024-09-11) (source)

CVEs: CVE-2021-33044, CVE-2021-33045

[medium] VMware ESXi Authentication Bypass

Tue, 30 Jul 2024 00:00:00 GMT

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD. Added to the CISA KEV catalog on 2024-07-30. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-07-30: CISA added CVE-2024-37085 to the KEV catalog (federal deadline 2024-08-20) (source)
2024-06-25: CVE-2024-37085 published (source)

CVEs: CVE-2024-37085

[critical] Progress Telerik Report Server Authentication Bypass by Spoofing

Thu, 13 Jun 2024 00:00:00 GMT

Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access. Added to the CISA KEV catalog on 2024-06-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-06-13: CISA added CVE-2024-4358 to the KEV catalog (federal deadline 2024-07-04) (source)
2024-05-29: CVE-2024-4358 published (source)

CVEs: CVE-2024-4358

[critical] JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited

Thu, 07 Mar 2024 00:00:00 GMT

JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. Added to the CISA KEV catalog on 2024-03-07. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: 2023.11.4 (JetBrains)

Latest updates:

2024-03-07: CISA added CVE-2024-27198 to the KEV catalog (federal deadline 2024-03-28) (source)
2024-03-04: CVE-2024-27198 published (source)
2024-03-04: CVE-2024-27199 published (source)

CVEs: CVE-2024-27198, CVE-2024-27199