---METADATA---
VENDOR: FreeCAD
PRODUCT: FreeCAD
AFFECTED_VERSIONS: >= 0.19, < 1.1.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FreeCAD contains a second eval injection vulnerability that allows attackers to execute arbitrary code via malicious project files.

Executive Summary:
A severe eval injection vulnerability in FreeCAD permits arbitrary code execution when a victim opens a crafted project file.

Vulnerability Details

CVE-ID: CVE-2026-34399

Affected Software: FreeCAD FreeCAD

Affected Versions: >= 0.19, < 1.1.1

Vulnerability: This vulnerability involves the improper neutralization of directives in dynamically evaluated code (CWE-95). It functions similarly to CVE-2026-34398, where the application fails to safely handle input, allowing for command injection during file parsing.

Business Impact

The CVSS score of 7.8 reflects the high risk of this vulnerability. Exploitation allows an attacker to compromise the local workstation's security, potentially resulting in unauthorized access to sensitive CAD files and other proprietary information stored on the host system.

Remediation Plan

Immediate Action: Update all installations of FreeCAD to version 1.1.1 or later to ensure both this and related eval injection vulnerabilities are addressed.

Proactive Monitoring: Review security logs for suspicious execution patterns originating from the FreeCAD application process.

Compensating Controls: Enforce strict controls on the handling of external CAD project files and utilize endpoint detection and response tools to identify anomalous behavior during file import operations.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The presence of multiple similar vulnerabilities highlights a systemic need for improved input validation within the software.

Analyst Recommendation

Given the vulnerability type and the impact, it is critical to update to the latest version of FreeCAD. Users should exercise extreme caution regarding the origin of project files until the software is updated to a non-vulnerable version.

---METADATA---
VENDOR: FreeCAD
PRODUCT: FreeCAD
AFFECTED_VERSIONS: >= 0.19, < 1.1.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FreeCAD contains an eval injection vulnerability that allows attackers to execute arbitrary code via malicious project files.

Executive Summary:
A critical eval injection vulnerability in FreeCAD enables attackers to execute arbitrary code when a user opens a specially crafted project file.

Vulnerability Details

CVE-ID: CVE-2026-34398

Affected Software: FreeCAD FreeCAD

Affected Versions: >= 0.19, < 1.1.1

Vulnerability: This is an improper neutralization of directives in dynamically evaluated code (CWE-95) vulnerability. The attack requires a user to interact with the software by opening a malicious file, making it a client-side execution risk.

Business Impact

With a CVSS score of 7.8, this vulnerability carries high risk. Successful exploitation results in full control over the user's local machine, potentially leading to the theft of intellectual property, sensitive design data, or the installation of persistent backdoors on engineering workstations.

Remediation Plan

Immediate Action: Update to FreeCAD version 1.1.1 or later immediately to resolve the eval injection flaw.

Proactive Monitoring: Monitor file integrity on workstations that process external CAD files and review system process logs for unexpected child processes spawned by FreeCAD.

Compensating Controls: Advise users to only open project files from trusted sources and consider running FreeCAD in a restricted environment or virtual machine to isolate potential threats.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Eval injection flaws are highly dangerous in desktop applications and should be treated as a priority for all users.

Analyst Recommendation

The risk of code execution via malicious files is high for any organization utilizing FreeCAD for design workflows. Organizations must mandate the update to version 1.1.1 across all workstations to neutralize this threat.

---METADATA---
VENDOR: WWBN
PRODUCT: AVideo
AFFECTED_VERSIONS: <= 26.0
---END_METADATA---

Description Summary:
WWBN AVideo contains a critical SQL injection vulnerability in its stream key lookup path, allowing unauthenticated attackers to execute malicious database queries.

Executive Summary:
Unauthenticated attackers can compromise the WWBN AVideo database via SQL injection in the stream key lookup process, potentially leading to full system takeover.

Vulnerability Details

CVE-ID: CVE-2026-34374

Affected Software: WWBN AVideo

Affected Versions: Versions up to and including 26.0

Vulnerability: A SQL injection exists in the Live_schedule::keyExists() method. While the primary lookup is parameterized, a fallback mechanism interpolates the stream key directly into a SQL string. This path is accessible to unauthenticated attackers during RTMP publish authentication.

Business Impact

A successful SQL injection can lead to the exposure of sensitive user data, administrative credentials, and video content. Depending on database permissions, an attacker might also achieve remote code execution on the underlying server. The CVSS score of 9.1 underscores the critical risk to data confidentiality and system integrity.

Remediation Plan

Immediate Action: Since no patched version is available as of publication, administrators should consider disabling RTMP publishing or implementing strict input validation at the reverse proxy level.

Proactive Monitoring: Monitor database logs for unusual query syntax or errors originating from the Live_schedule class.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules specifically targeting the RTMP authentication endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation. However, the lack of a vendor patch at the time of disclosure significantly increases the window of risk.

Analyst Recommendation

Organizations using WWBN AVideo must be on high alert due to the lack of an official patch. It is recommended to monitor the vendor's repository for security updates and apply them the moment they become available. In the interim, implement aggressive WAF filtering to block potential SQL injection payloads in stream key parameters.

---METADATA---
VENDOR: HL7
PRODUCT: HAPI FHIR
AFFECTED_VERSIONS: Prior to version 6.9.4
---END_METADATA---

Description Summary:
HAPI FHIR's Validator service contains an unauthenticated SSRF vulnerability in the "/loadIG" endpoint that allows attackers to steal sensitive authentication tokens from the server.

Executive Summary:
Unauthenticated attackers can exploit HAPI FHIR to steal API keys and authentication tokens for other healthcare servers, potentially compromising highly sensitive patient data across the interoperability network.

Vulnerability Details

CVE-ID: CVE-2026-34361

Affected Software: HAPI FHIR

Affected Versions: Prior to version 6.9.4

Vulnerability: The FHIR Validator HTTP service exposes an unauthenticated /loadIG endpoint vulnerable to SSRF. Due to a URL prefix matching flaw in ManagedWebAccessUtils.getServer(), an attacker can redirect outbound requests to a malicious server and capture Bearer tokens or API keys intended for legitimate FHIR endpoints.

Business Impact

This vulnerability directly threatens the security of healthcare data exchange. By stealing credentials, an attacker can gain unauthorized access to secondary FHIR servers, leading to large-scale data exfiltration of Protected Health Information (PHI). The CVSS score of 9.3 indicates a critical risk to the confidentiality of the healthcare interoperability ecosystem.

Remediation Plan

Immediate Action: Update HAPI FHIR to version 6.9.4 or later to fix the URL prefix matching logic and secure the validator endpoint.

Proactive Monitoring: Audit outbound connection logs from the FHIR Validator service and check for requests to unknown or suspicious external domains.

Compensating Controls: Use a Web Application Firewall (WAF) to block access to the /loadIG endpoint from untrusted sources and enforce strict egress whitelisting for the FHIR server.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation. However, the potential for credential theft in a healthcare context makes this a high-value target for sophisticated threat actors.

Analyst Recommendation

Securing healthcare interoperability is paramount. The ability to steal credentials for other systems through a validator service is a significant architectural risk. Organizations must apply the version 6.9.4 patch immediately to protect patient data and maintain trust in the FHIR infrastructure.

---METADATA---
VENDOR: HAPI FHIR Project
PRODUCT: HAPI FHIR
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
HAPI FHIR, a Java-based HL7 FHIR implementation, contains a high-severity vulnerability that impacts the security of healthcare data interoperability.

Executive Summary:
A high-severity vulnerability in the HAPI FHIR library poses a risk to healthcare data systems, potentially allowing attackers to compromise sensitive medical information or system integrity.

Vulnerability Details

CVE-ID: CVE-2026-34359

Affected Software: HAPI FHIR

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While the specific technical vector is not detailed in the summary, the vulnerability resides within the HAPI FHIR Java framework. Given the nature of FHIR implementations, this likely involves improper handling of data requests or resource processing, which could be exploited by remote actors.

Business Impact

HAPI FHIR is a foundational component for healthcare interoperability. A successful exploit could lead to the exposure of Protected Health Information (PHI), violating regulatory requirements such as HIPAA. With a CVSS score of 7.4, the vulnerability could result in significant legal, financial, and reputational consequences for healthcare providers and software vendors relying on this library.

Remediation Plan

Immediate Action: Developers and system administrators should identify all instances of HAPI FHIR in their environment and apply the latest security updates from the HAPI FHIR Project.

Proactive Monitoring: Increase logging verbosity for FHIR API endpoints and monitor for anomalous data extraction patterns or malformed FHIR resource submissions.

Compensating Controls: Utilize an API gateway or WAF to validate FHIR resources against expected schemas and restrict access to FHIR endpoints to authorized internal systems only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 1, 2026, there is no public information indicating active exploitation of this vulnerability. The lack of detailed public disclosure often precedes a broader exploitation window as researchers reverse-engineer the patch.

Analyst Recommendation

Organizations in the healthcare sector must treat this vulnerability with high urgency. Given the sensitivity of the data handled by HAPI FHIR, applying the vendor-provided updates is essential to maintain data confidentiality and system availability. Immediate patching of all Java-based FHIR services is recommended.

---METADATA---
VENDOR: Ctrlpanel
PRODUCT: panel
AFFECTED_VERSIONS: < 1.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Ctrlpanel versions prior to 1.2.0 are vulnerable to missing authorization, allowing authenticated users to perform unauthorized actions.

Executive Summary:
An authorization bypass vulnerability in Ctrlpanel allows authenticated attackers to perform unauthorized operations, potentially leading to significant service disruption.

Vulnerability Details

CVE-ID: CVE-2026-34358

Affected Software: Ctrlpanel panel

Affected Versions: < 1.2.0

Vulnerability: This is an access control vulnerability stemming from missing authorization checks, which allows an authenticated user to perform actions outside of their intended privilege scope.

Business Impact

Exploitation of this flaw could allow unauthorized users to access or modify sensitive billing and hosting configuration data, leading to service disruption or unauthorized service provisioning. With a CVSS score of 8.1, the risk to business operations is high, particularly for hosting providers relying on this software for customer management and billing integrity.

Remediation Plan

Immediate Action: Update the Ctrlpanel installation to version 1.2.0 or later, which includes the necessary authorization fixes to remediate this vulnerability.

Proactive Monitoring: Review application audit logs to identify any unauthorized or anomalous administrative actions performed by low-privileged user accounts.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) policies and limit access to the administration panel to only necessary personnel to minimize the potential impact of unauthorized access.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 20, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is fundamentally a failure to enforce authorization logic on sensitive API endpoints.

Analyst Recommendation

The availability of a fix in version 1.2.0 makes remediation straightforward. Organizations using Ctrlpanel must prioritize this update to prevent potential unauthorized billing or administrative activity within their hosting environment.

---METADATA---
VENDOR: TigerVNC
PRODUCT: x0vncserver
AFFECTED_VERSIONS: TigerVNC versions prior to 1.16.2
---END_METADATA---

Description Summary:
A local information disclosure vulnerability exists in TigerVNC's x0vncserver due to insecure file permissions on shared memory segments.

Executive Summary:
TigerVNC's x0vncserver component is susceptible to a high-severity local privilege risk due to overly permissive file settings.

Vulnerability Details

CVE-ID: CVE-2026-34352

Affected Software: TigerVNC x0vncserver

Affected Versions: TigerVNC versions prior to 1.16.2

Vulnerability: This vulnerability (CWE-732) arises from the use of 0777 permissions on shared memory segments. This allows any local user to access, observe, or manipulate the contents of the remote desktop session.

Business Impact

With a CVSS score of 8.5, this flaw allows for unauthorized information disclosure and potential control of the VNC session by local attackers. This could lead to the theft of sensitive data displayed on the screen or unauthorized interaction with the user's desktop environment.

Remediation Plan

Immediate Action: Update TigerVNC to version 1.16.2 or later to ensure correct file permissions are enforced.

Proactive Monitoring: Monitor local system logs for unauthorized access to shared memory files or unusual local user activity on systems running x0vncserver.

Compensating Controls: If patching is delayed, restrict the ability of unauthorized users to log into the host system, or disable x0vncserver if it is not required for business operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights the risk of insecure local configuration. Users of TigerVNC should prioritize the update to version 1.16.2 to mitigate the risk of local information disclosure and session manipulation.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows Server 2025
AFFECTED_VERSIONS: 10.0.26100.0 up to (excluding) 10.0.26100.32860
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Windows Kernel-Mode Drivers could allow an authenticated attacker to achieve remote code execution.

Executive Summary:
A use-after-free flaw in Microsoft Windows Server 2025 kernel-mode drivers could allow an authenticated attacker to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-34332

Affected Software: Microsoft Windows Server 2025

Affected Versions: 10.0.26100.0 up to (excluding) 10.0.26100.32860

Vulnerability: The vulnerability is a use-after-free (CWE-416) condition within kernel-mode drivers. Exploitation requires an authenticated user with low-level privileges (PR:L) and typically involves user interaction (UI:R).

Business Impact

The ability to execute code within the kernel-mode context poses a critical risk to organizational infrastructure. An attacker could potentially escalate privileges, steal sensitive data, or disrupt server operations. The CVSS score of 8.0 highlights the severe impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the latest Windows security patches provided by Microsoft to update the kernel-mode drivers to version 10.0.26100.32860 or later.

Proactive Monitoring: Review system event logs for unusual kernel crashes or unauthorized attempts to perform administrative tasks.

Compensating Controls: Restrict user access levels and implement endpoint detection and response (EDR) solutions to identify suspicious process behaviors originating from low-privilege accounts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Use-after-free vulnerabilities in the kernel are complex to weaponize but represent a significant threat to system stability.

Analyst Recommendation

Given the potential for privilege escalation, security teams should prioritize the deployment of the May 2026 patch cycle for all Windows Server 2025 instances. Immediate patching is the most effective way to eliminate this kernel-level risk.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows
AFFECTED_VERSIONS: Microsoft Windows 10 Version 1607, 1809, 21H2, 22H2; Windows 11 Version 23H2 (see enrichment data for build ranges)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow in Windows Message Queuing allows an unauthenticated attacker to execute arbitrary code over an adjacent network.

Executive Summary:
A critical heap-based buffer overflow vulnerability in Windows Message Queuing enables unauthenticated remote code execution on affected Windows systems via an adjacent network.

Vulnerability Details

CVE-ID: CVE-2026-34329

Affected Software: Microsoft Windows

Affected Versions: See enrichment data for specific build ranges including Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2).

Vulnerability: This vulnerability is a heap-based buffer overflow (CWE-122) within the Windows Message Queuing service. The flaw allows an unauthenticated attacker to execute arbitrary code by sending a specially crafted message over an adjacent network.

Business Impact

Successful exploitation of this vulnerability allows for full system compromise, including the potential for data exfiltration, unauthorized access, and complete control over the affected host. Given the CVSS score of 8.8 and the ability for unauthenticated code execution, this represents a significant risk to organizational confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the relevant security updates provided by Microsoft in the official advisory immediately to remediate the vulnerable code.

Proactive Monitoring: Monitor network traffic for anomalous behavior targeting Message Queuing ports and review system logs for signs of service crashes or unauthorized process execution.

Compensating Controls: Restrict network access to the Message Queuing service to trusted hosts only and ensure internal network segmentation is enforced.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for adjacent network access slightly limits the attack surface compared to a fully internet-facing exploit.

Analyst Recommendation

The severity of this vulnerability necessitates immediate prioritization of patch deployment. Organizations should identify all affected Windows instances and apply the vendor-supplied updates as soon as they are available to prevent potential remote code execution.

---METADATA---
VENDOR: Oracle
PRODUCT: Hospitality OPERA 5
AFFECTED_VERSIONS: 5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6 and 5.6.28
---END_METADATA---

Description Summary:
An unauthenticated, easily exploitable vulnerability in Oracle Hospitality OPERA 5 allows remote attackers to compromise the property services platform via HTTP.

Executive Summary:
A critical, easily exploitable vulnerability in Oracle Hospitality OPERA 5 allows unauthenticated remote attackers to compromise the property management system.

Vulnerability Details

CVE-ID: CVE-2026-34311

Affected Software: Oracle Hospitality OPERA 5 Property Services

Affected Versions: 5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6, and 5.6.28

Vulnerability: This vulnerability resides in the Opera component. An unauthenticated attacker with network access via HTTP can exploit this flaw to take over the Oracle Hospitality OPERA 5 Property Services platform.

Business Impact

The CVSS score of 9.8 underscores the critical risk this vulnerability poses to hospitality environments. A successful compromise could lead to the exposure of sensitive guest information, operational downtime, and a complete loss of control over property management systems.

Remediation Plan

Immediate Action: Update to the version of Oracle Hospitality OPERA 5 as recommended in the May 2026 Critical Security Patch Update Advisory.

Proactive Monitoring: Monitor for suspicious HTTP requests targeting OPERA 5 endpoints and audit access logs for unauthorized administrative activity.

Compensating Controls: Use a firewall to restrict access to the OPERA 5 platform, ensuring only authorized network segments can reach the application.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the lack of authentication required for exploitation, the risk level is extreme.

Analyst Recommendation

Operators of Oracle Hospitality systems should prioritize the immediate application of the May 2026 security patches. Given the potential for unauthenticated takeover, this vulnerability represents a primary target for malicious actors.

---METADATA---
VENDOR: SimStudio
PRODUCT: SimStudio
AFFECTED_VERSIONS: Versions below 0.5.74
---END_METADATA---

Description Summary:
SimStudio's MongoDB tool endpoints allow unauthenticated attackers to connect to arbitrary MongoDB instances and perform unauthorized data operations due to missing host restrictions.

Executive Summary:
SimStudio versions below 0.5.74 contain unauthenticated MongoDB tool endpoints that can be leveraged by attackers to read, modify, or delete data on reachable MongoDB instances.

Vulnerability Details

CVE-ID: CVE-2026-3431

Affected Software: SimStudio

Affected Versions: Below 0.5.74

Vulnerability: The MongoDB tool endpoints in SimStudio fail to implement authentication or host restrictions. An unauthenticated attacker can provide arbitrary connection parameters to these endpoints, using the server as a proxy to interact with any reachable MongoDB database.

Business Impact

This flaw facilitates unauthorized data access and manipulation, potentially leading to the destruction of critical databases or the theft of sensitive information. The CVSS score of 9.8 indicates a critical risk, as it effectively turns the SimStudio application into a tool for database exploitation.

Remediation Plan

Immediate Action: Upgrade SimStudio to version 0.5.74 or later. Ensure that all database tool endpoints are properly secured behind authentication.

Proactive Monitoring: Inspect network traffic for unusual connections to MongoDB ports (typically 27017) originating from the SimStudio application server.

Compensating Controls: Use firewall rules to restrict the SimStudio server's ability to initiate outbound connections to database ports except for authorized internal targets.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 2, 2026, there is no public information indicating active exploitation. This vulnerability is particularly dangerous because it can be used to pivot into internal database environments.

Analyst Recommendation

The exposure of database management tools without authentication is a high-risk configuration. Organizations must update SimStudio immediately and audit their network architecture to ensure that database services are not unnecessarily exposed to the application layer.

---METADATA---
VENDOR: WordPress
PRODUCT: Creative Mail
AFFECTED_VERSIONS: 1.6.5 through 1.6.9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Creative Mail WordPress plugin contains an unauthenticated SQL injection vulnerability via an unsanitized parameter, allowing attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Creative Mail WordPress plugin poses a significant risk of unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-3430

Affected Software: WordPress Creative Mail

Affected Versions: 1.6.5 through 1.6.9

Vulnerability: This is a SQL injection vulnerability (CWE-89) triggered by an unsanitized parameter during the management of abandoned cart emails. The vulnerability allows an unauthenticated attacker to inject malicious SQL commands, enabling unauthorized access to sensitive database content.

Business Impact

The vulnerability carries a CVSS score of 8.6, indicating a high level of severity. Successful exploitation could lead to the exposure of sensitive customer records, internal user email addresses, and other proprietary information contained within the WordPress database. Such a compromise threatens both customer privacy and organizational reputation.

Remediation Plan

Immediate Action: Monitor the vendor advisory for a security patch and apply it as soon as it becomes available. If a fix is not immediately provided, consider disabling the plugin if the functionality is not critical to operations.

Proactive Monitoring: Review database access logs for anomalous or suspicious query patterns that may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting WordPress plugins.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 8, 2026, there is no public information indicating active exploitation in the wild. However, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

Given the high CVSS score and the existence of a proof-of-concept, this vulnerability warrants immediate attention. Organizations utilizing affected versions of the Creative Mail plugin should prioritize patching as soon as the vendor releases an update to prevent potential data exfiltration.

---METADATA---
VENDOR: Oracle
PRODUCT: Identity Manager
AFFECTED_VERSIONS: 12.2.1.4.0
---END_METADATA---

Description Summary:
An unauthenticated vulnerability in the Oracle Identity Manager Connector enables remote attackers to compromise sensitive identity data through unauthorized access.

Executive Summary:
An unauthenticated vulnerability in the Oracle Identity Manager Connector facilitates unauthorized access and modification of identity data, presenting a critical risk to enterprise security.

Vulnerability Details

CVE-ID: CVE-2026-34287

Affected Software: Oracle Fusion Middleware (Identity Manager Connector)

Affected Versions: 12.2.1.4.0

Vulnerability: The vulnerability allows an unauthenticated attacker to interact with the Core component of the connector, leading to unauthorized retrieval or modification of sensitive data.

Business Impact

The CVSS score of 9.1 signifies a critical threat. Successful exploitation allows for the compromise of identity records, which can be leveraged to gain unauthorized access to other internal systems, resulting in significant operational and security risks.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches for the Identity Manager Connector 12.2.1.4.0.

Proactive Monitoring: Monitor logs for anomalous activity, specifically focusing on unauthorized access to the Identity Manager Connector's core functions.

Compensating Controls: Implement strict network access controls to minimize the exposure of the Identity Manager Connector to untrusted network traffic.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Prompt remediation is required to secure the identity management environment. Ensure that the latest Oracle patches are applied to mitigate the risk of unauthorized identity data manipulation.

---METADATA---
VENDOR: Oracle
PRODUCT: Identity Manager
AFFECTED_VERSIONS: 12.2.1.4.0
---END_METADATA---

Description Summary:
An unauthenticated vulnerability in the Oracle Identity Manager Connector permits remote attackers to perform unauthorized operations on critical identity data.

Executive Summary:
A critical unauthenticated vulnerability in the Oracle Identity Manager Connector exposes enterprise identity repositories to unauthorized modification and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-34286

Affected Software: Oracle Fusion Middleware (Identity Manager Connector)

Affected Versions: 12.2.1.4.0

Vulnerability: An unauthenticated attacker with network access can compromise the Core component of the connector, resulting in unauthorized access or modification of sensitive identity information.

Business Impact

With a CVSS score of 9.1, this flaw poses a severe threat to organizational security. Compromising the Identity Manager allows attackers to manipulate user access rights, potentially facilitating further lateral movement or data theft across the entire enterprise.

Remediation Plan

Immediate Action: Install the security updates provided by Oracle for the Identity Manager Connector version 12.2.1.4.0.

Proactive Monitoring: Monitor for unauthorized authentication attempts and suspicious API calls to the Identity Manager Connector component.

Compensating Controls: Restrict inbound HTTPS access to the Identity Manager to verified administrative and application service endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must treat this vulnerability with high priority. Patching is essential to maintain the integrity of the identity management infrastructure and prevent unauthorized access to critical organizational data.

---METADATA---
VENDOR: Oracle
PRODUCT: Identity Manager
AFFECTED_VERSIONS: 12.2.1.4.0
---END_METADATA---

Description Summary:
An unauthenticated vulnerability in the Oracle Identity Manager Connector allows remote attackers to gain unauthorized access to critical identity data.

Executive Summary:
An unauthenticated vulnerability in the Oracle Identity Manager Connector exposes the platform to unauthorized data access and modification, presenting a critical security risk.

Vulnerability Details

CVE-ID: CVE-2026-34285

Affected Software: Oracle Fusion Middleware (Identity Manager Connector)

Affected Versions: 12.2.1.4.0

Vulnerability: This vulnerability allows an unauthenticated attacker to bypass security controls in the Core component, enabling unauthorized creation, deletion, or modification of identity data.

Business Impact

The CVSS score of 9.1 highlights the critical risk to identity and access management systems. Successful exploitation could lead to privilege escalation, unauthorized account creation, and the exfiltration of sensitive identity data, undermining the entire organization's security posture.

Remediation Plan

Immediate Action: Apply the relevant security patches for the Oracle Identity Manager Connector 12.2.1.4.0 as specified in the vendor advisory.

Proactive Monitoring: Review access logs for anomalous HTTPS requests to the Identity Manager Connector and monitor for unexpected changes to user identity records.

Compensating Controls: Use network-level controls to isolate the Identity Manager service and ensure HTTPS traffic is inspected for malicious patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the sensitivity of identity management systems, this vulnerability must be addressed immediately. Security teams should prioritize patching the Identity Manager Connector to prevent unauthorized access to critical enterprise credentials.

---METADATA---
VENDOR: Oracle
PRODUCT: Enterprise Manager
AFFECTED_VERSIONS: 13.5 and 24.1
---END_METADATA---

Description Summary:
A high-privileged vulnerability in the Oracle Enterprise Manager Event Management component allows for a full system takeover and cross-product impact.

Executive Summary:
A critical vulnerability in the Oracle Enterprise Manager Event Management component allows a high-privileged attacker to achieve complete system takeover with potential cross-product impact.

Vulnerability Details

CVE-ID: CVE-2026-34279

Affected Software: Oracle Enterprise Manager Base Platform

Affected Versions: 13.5 and 24.1

Vulnerability: The vulnerability resides in the Event Management component and, despite requiring high privileges, allows an attacker to compromise the platform and potentially impact additional products.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe threat to enterprise management infrastructure. Compromise of the Enterprise Manager can lead to unauthorized control over the entire managed environment, resulting in widespread system disruption and data exposure.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Oracle to address the Event Management component vulnerabilities.

Proactive Monitoring: Review audit logs for unusual administrative activity or changes to event management configurations by high-privileged accounts.

Compensating Controls: Enforce the principle of least privilege for all administrative accounts and ensure the Enterprise Manager interface is not exposed to untrusted networks.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

While the vulnerability requires high privileges, the potential for cross-product scope change makes this a critical risk. Administrators must audit administrative access and apply the necessary patches provided by the vendor.

---METADATA---
VENDOR: Oracle
PRODUCT: Advanced Inbound Telephony
AFFECTED_VERSIONS: 12.2.3-12.2.15
---END_METADATA---

Description Summary:
An unauthenticated, easily exploitable vulnerability in the Oracle Advanced Inbound Telephony component allows a remote attacker to achieve a full system takeover.

Executive Summary:
A critical, unauthenticated vulnerability in the Oracle Advanced Inbound Telephony component allows remote attackers to compromise the system, necessitating immediate patch management.

Vulnerability Details

CVE-ID: CVE-2026-34275

Affected Software: Oracle E-Business Suite (Advanced Inbound Telephony)

Affected Versions: 12.2.3-12.2.15

Vulnerability: The vulnerability exists within the Setup and Administration component, allowing an unauthenticated attacker with network access to gain complete control over the telephony application.

Business Impact

The CVSS score of 9.8 confirms the extreme severity of this issue. Successful exploitation results in full loss of confidentiality, integrity, and availability, potentially impacting entire business telephony operations and connected enterprise systems.

Remediation Plan

Immediate Action: Apply the latest Oracle Critical Patch Update (CPU) for the affected E-Business Suite versions.

Proactive Monitoring: Monitor network traffic to the telephony setup interfaces for unauthorized access attempts or suspicious HTTP requests.

Compensating Controls: Implement strict network segmentation and restrict access to the Oracle Advanced Inbound Telephony interface to trusted administrative IP ranges only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability requires immediate intervention. Organizations should consult the official Oracle security advisory for the specific patch release and ensure all affected instances of the E-Business Suite are updated without delay.

---METADATA---
VENDOR: SAP_SE
PRODUCT: SAP NetWeaver and ABAP Platform
AFFECTED_VERSIONS: KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT2, 7.22EXT3, 7.53, 7.54, 7.77
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SAP NetWeaver and ABAP Platform contain an out-of-bounds write vulnerability in the DIAG protocol parsing logic, enabling unauthenticated remote attackers to trigger memory corruption.

Executive Summary:
A critical memory corruption vulnerability in SAP NetWeaver and ABAP Platform allows unauthenticated attackers to execute arbitrary code or crash the system via malformed DIAG protocol packets.

Vulnerability Details

CVE-ID: CVE-2026-34265

Affected Software: SAP_SE SAP NetWeaver and ABAP Platform

Affected Versions: KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT2, 7.22EXT3, 7.53, 7.54, 7.77

Vulnerability: This is an out-of-bounds write vulnerability (CWE-787) occurring during the parsing of the DIAG protocol. An unauthenticated attacker can send specially crafted packets to the server, leading to memory corruption, information disclosure, or potential system instability.

Business Impact

The vulnerability affects the core communication protocol of SAP systems, making it a high-value target. Successful exploitation can lead to a complete denial of service or the exposure of sensitive business intelligence, significantly impacting the availability and confidentiality of the entire SAP infrastructure.

Remediation Plan

Immediate Action: Apply the relevant security patches provided by SAP via the SAP Support Portal, specifically referencing note 3714806.

Proactive Monitoring: Monitor network traffic for malformed or suspicious DIAG protocol requests targeting SAP application servers.

Compensating Controls: Use network segmentation and firewalls to restrict access to SAP application ports to trusted IP ranges only, reducing the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the DIAG protocol makes this an advanced target, but the potential for unauthenticated memory corruption is severe.

Analyst Recommendation

Given the critical nature of SAP environments, organizations must prioritize the application of the vendor-provided patches. Evaluate the exposure of your SAP NetWeaver instances and ensure that all necessary security notes are implemented as part of standard maintenance cycles.

---METADATA---
VENDOR: SAP
PRODUCT: Commerce Cloud
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
SAP Commerce Cloud allows unauthenticated users to perform arbitrary code execution due to improper Spring Security configuration.

Executive Summary:
A critical vulnerability in SAP Commerce Cloud allows an unauthenticated attacker to inject malicious code and achieve full remote code execution on the server.

Vulnerability Details

CVE-ID: CVE-2026-34263

Affected Software: SAP Commerce Cloud

Affected Versions: See vendor advisory

Vulnerability: This is a Remote Code Execution (RCE) vulnerability resulting from an insecure Spring Security configuration. This failure allows unauthorized users to upload malicious configurations and execute arbitrary server-side code.

Business Impact

The ability for an unauthenticated user to execute code on the server constitutes a complete compromise of the application's confidentiality, integrity, and availability. With a CVSS score of 9.6, this vulnerability poses an existential threat to the affected business service.

Remediation Plan

Immediate Action: Check the SAP security advisory for the specific patch release and apply it immediately.

Proactive Monitoring: Audit server logs for unauthorized configuration changes and monitor for suspicious file uploads or unexpected system processes.

Compensating Controls: Use a Web Application Firewall (WAF) to block suspicious requests and restrict access to administrative endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical security issue requiring immediate attention. Organizations using SAP Commerce Cloud must coordinate with the vendor to obtain and deploy the necessary security patches immediately.

---METADATA---
VENDOR: SAP
PRODUCT: Enterprise Search
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
SAP Enterprise Search for ABAP is vulnerable to SQL injection, allowing authenticated attackers to execute malicious database queries.

Executive Summary:
An authenticated attacker can exploit a SQL injection vulnerability in SAP Enterprise Search to gain unauthorized access to sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-34260

Affected Software: SAP Enterprise Search

Affected Versions: See vendor advisory

Vulnerability: This is a SQL injection vulnerability caused by the improper concatenation of user-controlled input into database queries. An authenticated attacker can manipulate these queries to bypass security controls and access protected backend data.

Business Impact

The ability to perform SQL injection poses a significant risk to data confidentiality and system availability. With a CVSS score of 9.6, successful exploitation could lead to large-scale data breaches or application denial-of-service, severely impacting business operations.

Remediation Plan

Immediate Action: Apply the latest security patches provided by SAP for the Enterprise Search component.

Proactive Monitoring: Audit database logs for unusual query patterns, such as unexpected syntax or large data retrieval requests.

Compensating Controls: Employ a Web Application Firewall (WAF) with SQL injection detection rules to inspect and block malicious input at the perimeter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this SQL injection vulnerability, organizations must prioritize applying the SAP security update. Ensure that all database access is audited and that input validation is enforced at the application layer.

---METADATA---
VENDOR: SAP
PRODUCT: Forecasting & Replenishment
AFFECTED_VERSIONS: SCM 702, 712, 713, 714
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An OS command execution vulnerability in SAP Forecasting & Replenishment allows an authenticated administrator to execute arbitrary OS commands.

Executive Summary:
An OS command injection vulnerability in SAP Forecasting & Replenishment enables an authenticated administrator to execute arbitrary operating system commands.

Vulnerability Details

CVE-ID: CVE-2026-34259

Affected Software: SAP Forecasting & Replenishment

Affected Versions: SCM 702, 712, 713, 714

Vulnerability: This is an OS command execution flaw (CWE-77) triggered by the abuse of a non-remote-enabled function. The attack requires high privileges (PR:H), meaning an authenticated administrator must initiate the malicious command.

Business Impact

While the attack requires administrative authorization, a successful exploit allows full control over the underlying operating system. This could lead to total compromise of the SAP application environment and potential lateral movement into the broader network. The CVSS score of 8.2 reflects the high impact on the entire system.

Remediation Plan

Immediate Action: Apply the relevant SAP Security Note (3732471) through the standard SAP support portal immediately.

Proactive Monitoring: Audit administrative activity and monitor system logs for suspicious command-line executions or unusual file modifications on the server.

Compensating Controls: Enforce strict role-based access control (RBAC) to limit the number of users with administrative authorizations and ensure that only authorized personnel can access sensitive functions.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for high-level administrative access significantly limits the attack surface.

Analyst Recommendation

Administrators should review the SAP Security Note 3732471 and apply the corresponding patches during the next maintenance window. Restricting administrative access remains a critical secondary control to prevent the abuse of such high-privilege functions.

---METADATA---
VENDOR: Xiph
PRODUCT: vorbis-tools (ogg123 utility)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch
---END_METADATA---

Description Summary:
A buffer underflow vulnerability exists in the ogg123 utility within vorbis-tools, potentially allowing for memory corruption.

Executive Summary:
A buffer underflow in the ogg123 utility of vorbis-tools poses a potential security risk for systems processing untrusted Ogg files.

Vulnerability Details

CVE-ID: CVE-2026-34253

Affected Software: Xiph vorbis-tools (ogg123)

Affected Versions: See vendor advisory

Vulnerability: This is a buffer underflow vulnerability located in the remote.c source file of the ogg123 utility. It can be triggered by unauthenticated attackers providing a malformed input, leading to partial impact on system availability or integrity.

Business Impact

While the technical impact is categorized as partial, a buffer underflow can lead to application crashes (Denial of Service) or potentially memory corruption. With a CVSS score of 8.2, the vulnerability is considered critical by the reporter, likely due to the risk of remote exploitability in media processing pipelines.

Remediation Plan

Immediate Action: Monitor the Xiph GitLab repository and official package maintainer channels for the release of a patched version of vorbis-tools.

Proactive Monitoring: Ensure that systems processing media files are running with the least privilege necessary to limit the impact of a potential crash or exploit.

Compensating Controls: Use application sandboxing or containerization to isolate the ogg123 utility from critical system resources.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The complexity of this flaw is low, making it a viable target for those capable of crafting malicious media files.

Analyst Recommendation

Users of vorbis-tools should exercise caution when processing files from untrusted sources. Monitor the upstream Xiph repository for a formal release of a fix and apply it as soon as it becomes available to remediate the buffer underflow risk.

---METADATA---
VENDOR: Rometheme
PRODUCT: RTMKit (WordPress Plugin)
AFFECTED_VERSIONS: 0 through 2.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The RTMKit Addons for Elementor plugin for WordPress contains a Local File Inclusion vulnerability allowing authenticated attackers to execute arbitrary code.

Executive Summary:
A critical Local File Inclusion vulnerability in the RTMKit Addons for Elementor plugin for WordPress allows authenticated attackers to potentially achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-3425

Affected Software: Rometheme RTMKit (WordPress Plugin)

Affected Versions: 0 through 2.0.2

Vulnerability: The plugin contains a Local File Inclusion vulnerability (CWE-98) due to improper control of filenames in include/require statements. Exploitation requires the attacker to have at least low-level (authenticated) access to the WordPress site.

Business Impact

An attacker successfully exploiting this vulnerability can read sensitive system files or execute arbitrary PHP code on the server. This could lead to a full site takeover, database compromise, and the potential for further lateral movement within the hosting environment, justifying the 8.8 CVSS score.

Remediation Plan

Immediate Action: Update the RTMKit plugin to version 2.0.3 or later immediately to address the underlying file inclusion flaw.

Proactive Monitoring: Audit WordPress user accounts for suspicious activity and monitor server access logs for requests attempting to access sensitive files or unexpected file paths.

Compensating Controls: Utilize a Web Application Firewall (WAF) with rules configured to block common LFI patterns and directory traversal attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authentication limits the risk to attackers who have already obtained valid credentials.

Analyst Recommendation

Administrators should update the RTMKit plugin immediately. Furthermore, ensure that user registration and access control policies are strictly enforced to prevent unauthorized users from reaching the vulnerable function.

---METADATA---
VENDOR: wenxian
PRODUCT: wenxian
AFFECTED_VERSIONS: Versions 0.3.1 and prior
---END_METADATA---

Description Summary:
The wenxian GitHub Actions workflow is vulnerable to command injection via untrusted user input in issue comments, allowing arbitrary code execution on the GitHub runner.

Executive Summary:
An unauthenticated attacker can execute arbitrary code on a GitHub Actions runner by simply posting a crafted comment on a repository using the wenxian tool.

Vulnerability Details

CVE-ID: CVE-2026-34243

Affected Software: wenxian (GitHub Actions workflow)

Affected Versions: Versions 0.3.1 and prior

Vulnerability: The workflow uses issue_comment.body directly inside a shell command without sanitization. An unauthenticated attacker can post a comment containing shell metacharacters to trigger command injection and execute arbitrary code within the context of the GitHub Actions runner.

Business Impact

A successful exploit allows an attacker to hijack the CI/CD pipeline. This can lead to the theft of GitHub secrets (e.g., API keys, cloud credentials), the injection of malicious code into the software supply chain, or unauthorized access to the repository. The CVSS score of 9.8 highlights the extreme risk of supply chain compromise.

Remediation Plan

Immediate Action: Disable the affected GitHub Actions workflow immediately. Since no patch is currently available, manually sanitize the workflow file to use environment variables for user input instead of direct shell interpolation.

Proactive Monitoring: Review GitHub Actions run history for suspicious activity and audit all secrets used by the affected repository for potential compromise.

Compensating Controls: Use "Restrict repository permissions" in GitHub to ensure that the GITHUB_TOKEN has minimal permissions (read-only) for workflows triggered by external users.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there are no publicly available patches. This vulnerability is particularly dangerous as it can be triggered by any GitHub user by simply commenting on an issue.

Analyst Recommendation

The lack of a vendor patch makes this a critical "zero-day" risk for users of wenxian. Immediate manual intervention is required to secure the GitHub Actions workflow. Ensure that all user-supplied data is treated as untrusted and never passed directly to a shell.

---METADATA---
VENDOR: Ctrlpanel
PRODUCT: Ctrlpanel
AFFECTED_VERSIONS: < 1.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Ctrlpanel is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of user-supplied input during web page generation.

Executive Summary:
A stored cross-site scripting vulnerability in Ctrlpanel could allow an authenticated attacker to execute arbitrary scripts in the context of other users' sessions.

Vulnerability Details

CVE-ID: CVE-2026-34241

Affected Software: Ctrlpanel Ctrlpanel

Affected Versions: < 1.2.0

Vulnerability: This is an Improper Neutralization of Input during Web Page Generation (CWE-79) vulnerability. An authenticated attacker with low privileges can inject malicious scripts, which are then rendered in the browser of other users, including administrators, when they access the compromised interface.

Business Impact

Successful exploitation allows for session hijacking, unauthorized actions performed on behalf of legitimate users, and potential theft of sensitive billing or hosting configuration data. With a CVSS score of 8.7, this is a High-severity risk that could lead to significant account takeover scenarios within the hosting management environment.

Remediation Plan

Immediate Action: Upgrade to Ctrlpanel version 1.2.0 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Review application logs for unusual script tags or unexpected characters in user-submitted input fields.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common XSS patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable by authenticated users who can successfully inject content into the application.

Analyst Recommendation

Given the potential for privilege escalation and session compromise, organizations should prioritize the update to version 1.2.0. Failure to patch leaves administrative accounts vulnerable to script-based attacks that could compromise the entire hosting infrastructure.

---METADATA---
VENDOR: CtrlPanel
PRODUCT: CtrlPanel
AFFECTED_VERSIONS: 1.1.1 and prior
---END_METADATA---

Description Summary:
CtrlPanel contains an unauthenticated Remote Code Execution (RCE) vulnerability in its web-based installer, allowing attackers to execute arbitrary commands on the server.

Executive Summary:
An actively exploited, unauthenticated RCE vulnerability in CtrlPanel allows remote attackers to execute arbitrary code with server-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-34234

Affected Software: CtrlPanel

Affected Versions: 1.1.1 and prior

Vulnerability: An unauthenticated attacker can trigger code execution via the web-based installer, which fails to properly validate the installation state and passes user input directly into shell commands.

Business Impact

With a CVSS score of 10.0, this vulnerability is critical and poses an immediate threat to the entire hosting infrastructure. Active exploitation in the wild indicates that attackers are likely using this flaw to establish persistent backdoors, exfiltrate hosting data, or deploy ransomware, leading to total loss of control over the affected servers.

Remediation Plan

Immediate Action: Update CtrlPanel to version 1.2.0 or higher immediately; if an update is not possible, remove or disable the public/installer/index.php file.

Proactive Monitoring: Search for evidence of unauthorized shell processes, unexpected file creations in web directories, and anomalous outbound network traffic.

Compensating Controls: Immediately restrict public access to the installer endpoint via WAF rules or server-level configuration (e.g., .htaccess or Nginx deny directives).

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of May 19, 2026, there is confirmed active exploitation of this vulnerability in the wild. Immediate patching is mandatory to secure the environment.

Analyst Recommendation

This is an extremely high-risk vulnerability with confirmed active exploitation. Organizations must treat this as a high-priority incident and apply the necessary patches or mitigating controls without delay to prevent unauthorized remote command execution.