---METADATA---
VENDOR: WordPress
PRODUCT: Database for Contact Form 7, WPforms, Elementor forms plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient path validation in the view_page function.

Executive Summary:
A critical arbitrary file deletion vulnerability exists in the Database for Contact Form 7, WPforms, Elementor forms plugin, posing a significant risk of service disruption or site compromise.

Vulnerability Details

CVE-ID: CVE-2026-9843

Affected Software: WordPress Database for Contact Form 7, WPforms, Elementor forms plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin fails to adequately sanitize file paths within the view_page function, allowing an authenticated attacker to delete arbitrary files on the server. The required authentication level implies that an attacker must possess valid credentials to trigger the vulnerable function.

Business Impact

Successful exploitation of this vulnerability can lead to the deletion of critical system or application files, resulting in severe service downtime and potential loss of data integrity. With a CVSS score of 8.1, this high-severity flaw represents a substantial risk to business continuity and operational security, particularly if the deleted files are essential for site functionality.

Remediation Plan

Immediate Action: Update the plugin to the latest version provided by the vendor to patch the path validation flaw.

Proactive Monitoring: Audit web server logs for suspicious requests directed at the view_page function or unusual file deletion patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and suspicious parameter inputs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of the vulnerability, administrators must prioritize updating the affected plugin immediately. If an update is not currently available, consider disabling the plugin entirely to mitigate the risk of unauthorized file deletion until a vendor-supplied patch is implemented.

---METADATA---
VENDOR: Tag Groups
PRODUCT: Tag Groups is the Advanced Way to Display Your Taxonomy Terms
AFFECTED_VERSIONS: 0 up to (excluding) 2.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Tag Groups WordPress plugin before 2.2.0 is vulnerable to reflected Cross-Site Scripting (XSS) via improper escaping of an AJAX parameter.

Executive Summary:
An unauthenticated reflected Cross-Site Scripting vulnerability in the Tag Groups WordPress plugin allows remote attackers to execute arbitrary JavaScript in the browser of a logged-in user.

Vulnerability Details

CVE-ID: CVE-2026-9833

Affected Software: Tag Groups, Tag Groups is the Advanced Way to Display Your Taxonomy Terms

Affected Versions: 0 up to (excluding) 2.2.0

Vulnerability: This is a reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient sanitization of AJAX parameters. The vulnerability is exploitable by unauthenticated attackers who trick a user with high-level privileges, such as an Editor, into interacting with a malicious link.

Business Impact

The vulnerability carries a CVSS score of 7.1, classifying it as High severity. Successful exploitation allows an attacker to hijack active user sessions, perform actions on behalf of the victim, or redirect users to malicious sites, which may lead to unauthorized data access or administrative configuration changes.

Remediation Plan

Immediate Action: Update the Tag Groups plugin to version 2.2.0 or later immediately.

Proactive Monitoring: Review web server access logs for suspicious URL patterns containing unexpected script tags or encoded characters directed at the plugin's AJAX endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS injection patterns and malicious script payloads.

Exploitation Status

Public Exploit Available: No (per available data).

Analyst Notes: As of July 20, 2026, there is no public information indicating active exploitation in the wild. While CISA's SSVC assessment indicates a proof-of-concept exists, it does not confirm the presence of a weaponized exploit. The vulnerability is inherently exploitable if a user is successfully lured into clicking a crafted URL.

Analyst Recommendation

Given the High severity of this flaw, administrators should prioritize updating the plugin. Failure to patch allows unauthenticated attackers to target administrative users, potentially compromising the integrity of the entire WordPress installation.

---METADATA---
VENDOR: BookingPress
PRODUCT: BookingPress Appointment Booking Pro
AFFECTED_VERSIONS: 0 up to (excluding) 5.7.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The BookingPress Appointment Booking Pro WordPress plugin is vulnerable to improper authentication, allowing unauthenticated attackers to potentially bypass security controls.

Executive Summary:
An authentication bypass vulnerability in BookingPress Appointment Booking Pro exposes WordPress sites to unauthorized access and potential data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-9830

Affected Software: BookingPress BookingPress Appointment Booking Pro

Affected Versions: 0 up to (excluding) 5.7.3

Vulnerability: This vulnerability involves improper authentication (CWE-287), which allows an unauthenticated attacker to interact with the plugin's functionality without valid credentials. The CVSS vector confirms that no user interaction or high privileges are required to exploit this flaw.

Business Impact

The ability for an unauthenticated attacker to bypass authentication mechanisms could lead to unauthorized access to booking data, sensitive customer information, and potential modification of appointment records. With a CVSS score of 8.2, this vulnerability represents a high risk to both system integrity and customer privacy.

Remediation Plan

Immediate Action: Update the BookingPress Appointment Booking Pro plugin to version 5.7.3 or later immediately.

Proactive Monitoring: Review audit logs for unexpected account access or unauthorized modifications to appointment data.

Compensating Controls: Implement strict access control lists at the network level and utilize a WAF to filter malicious traffic attempting to interact with plugin-specific endpoints.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists in a GitHub repository (ChPratik/CVE-2026-9830).

Analyst Notes: As of July 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a public proof-of-concept significantly lowers the barrier for potential attackers.

Analyst Recommendation

Due to the existence of a public proof-of-concept and the high severity of this authentication flaw, administrators must ensure the plugin is updated to version 5.7.3 or later without delay. Failure to patch may result in unauthorized access to sensitive appointment management systems.

---METADATA---
VENDOR: Mattermost
PRODUCT: Mattermost
AFFECTED_VERSIONS: 11.7.0 through 11.7.6, 10.11.0 through 10.11.21, 11.8.0 through 11.8.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Mattermost contains an incorrect authorization vulnerability that allows authenticated users to perform unauthorized actions.

Executive Summary:
An incorrect authorization flaw in Mattermost allows authenticated attackers to perform unauthorized actions, potentially leading to full system impact.

Vulnerability Details

CVE-ID: CVE-2026-9816

Affected Software: Mattermost

Affected Versions: 11.7.0 through 11.7.6, 10.11.0 through 10.11.21, 11.8.0 through 11.8.3

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) that occurs when a low-privileged authenticated user can bypass intended access controls. The flaw permits unauthorized operations that should be restricted to administrative or higher-level roles.

Business Impact

Successful exploitation allows an authenticated user to perform actions outside their assigned permissions, which could lead to the compromise of confidential communications or unauthorized modification of system data. With a CVSS score of 8.3, the risk of privilege escalation and data integrity loss is substantial for enterprise collaboration environments.

Remediation Plan

Immediate Action: Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22, or 11.8.4 or higher to resolve the authorization logic errors.

Proactive Monitoring: Monitor audit logs for suspicious administrative actions performed by standard user accounts or unexpected changes to channel and team permissions.

Compensating Controls: Implement strict role-based access control (RBAC) policies and limit the number of users with high-level privileges until the environment is patched.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly sensitive due to the potential for unauthorized administrative actions.

Analyst Recommendation

Organizations utilizing Mattermost must prioritize these updates to maintain the integrity of their collaboration platforms. Applying the vendor-provided patches is the only reliable method to remediate this authorization bypass.

---METADATA---
VENDOR: Unknown
PRODUCT: AI Copilot (WordPress Plugin)
AFFECTED_VERSIONS: 0 up to (excluding) 1.5.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The AI Copilot WordPress plugin fails to bind OAuth tokens to specific users, allowing unauthenticated attackers to impersonate administrators and execute privileged tools.

Executive Summary:
An authentication and privilege management flaw in the AI Copilot WordPress plugin allows unauthenticated attackers to gain administrative access and execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-9810

Affected Software: AI Copilot WordPress Plugin

Affected Versions: 0 up to 1.5.4

Vulnerability: This vulnerability involves improper privilege management (CWE-269) where the plugin accepts any valid OAuth token as an administrative session. An unauthenticated attacker can complete the public OAuth flow to escalate privileges to the administrator level.

Business Impact

Successful exploitation allows an attacker to create new administrative users, escalate privileges, and execute arbitrary MCP tools. This could result in complete site takeover, data theft, and the installation of malicious payloads, presenting an extreme risk to the WordPress environment.

Remediation Plan

Immediate Action: Update the AI Copilot plugin to version 1.5.4 or higher immediately.

Proactive Monitoring: Audit WordPress user accounts for unauthorized additions or changes to roles and review logs for suspicious administrative actions.

Compensating Controls: Disable the AI Copilot plugin entirely until the update can be applied to prevent potential exploitation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it does not require prior authentication.

Analyst Recommendation

Plugin vulnerabilities of this nature are frequent targets for automated exploitation. Administrators must update the AI Copilot plugin to version 1.5.4 immediately to remediate the risk of account takeovers and privilege escalation.

---METADATA---
VENDOR: Red Hat
PRODUCT: Keycloak
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A flaw in the Red Hat Keycloak Policy Enforcer allows for improper access control, potentially bypassing security constraints during authentication processes.

Executive Summary:
A high-severity flaw in the Red Hat Keycloak Policy Enforcer could allow attackers to bypass critical access control mechanisms, leading to unauthorized resource access.

Vulnerability Details

CVE-ID: CVE-2026-9800

Affected Software: Red Hat Keycloak

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the Policy Enforcer component, which fails to correctly validate user permissions. The issue typically requires the attacker to be authenticated, potentially allowing them to escalate privileges or access resources outside their authorized scope.

Business Impact

Successful exploitation allows for unauthorized access to sensitive identity and access management (IAM) functions, which may lead to total system compromise and data breach. The CVSS score of 8.1 underscores the critical nature of this vulnerability, as it directly undermines the centralized security posture of the affected organization.

Remediation Plan

Immediate Action: Update the Red Hat build of Keycloak to the latest version provided by the vendor to remediate the policy enforcement logic.

Proactive Monitoring: Audit Keycloak logs for unusual policy evaluation results or unauthorized attempts to access restricted administrative functions.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) and utilize Web Application Firewalls to inspect traffic for patterns indicative of policy bypass attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations relying on Keycloak for authentication and authorization must treat this update with extreme urgency. Failure to patch the Policy Enforcer could result in a catastrophic failure of identity security across the enterprise.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A command injection vulnerability in the NVBULogDaemon component of Quest NetVault Backup enables remote attackers to execute arbitrary system commands.

Executive Summary:
A remote command injection vulnerability in the Quest NetVault Backup NVBULogDaemon component enables attackers to execute unauthorized commands on the host server.

Vulnerability Details

CVE-ID: CVE-2026-9787

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for affected versions

Vulnerability: The flaw exists within the NVBULogDaemon, which fails to properly validate input before passing it to the system shell. This allows an unauthenticated attacker to inject and execute arbitrary commands, leading to full system compromise.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to the confidentiality, integrity, and availability of the host server. A compromise of the backup server could lead to the exposure of sensitive backup data, manipulation of recovery points, or the deployment of secondary payloads within the internal network.

Remediation Plan

Immediate Action: Identify and patch all instances of NetVault Backup according to the manufacturer’s forthcoming security guidance.

Proactive Monitoring: Inspect system process logs for irregular command executions or the spawning of unexpected shells from the NVBULogDaemon process.

Compensating Controls: Utilize endpoint detection and response (EDR) solutions to block unauthorized child processes launched by backup services and limit service account privileges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to perform remote command injection makes this a high-priority risk for all environments utilizing Quest NetVault Backup. IT teams should ensure that all backup infrastructure is isolated from public-facing networks and apply vendor patches immediately upon release to remediate the underlying command injection vector.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the NVBUDashboard component of Quest NetVault Backup allows remote attackers to potentially execute arbitrary code.

Executive Summary:
A critical SQL injection vulnerability in Quest NetVault Backup could allow an unauthenticated attacker to achieve remote code execution on the underlying system.

Vulnerability Details

CVE-ID: CVE-2026-9786

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability resides in the NVBUDashboard component, where improper sanitization of database inputs permits SQL injection. Successful exploitation allows an attacker to bypass security constraints and execute arbitrary code with the privileges of the service.

Business Impact

The high CVSS score of 8.8 reflects the potential for full system compromise, including unauthorized data access, modification, or complete service disruption. As backup infrastructure is a primary target for ransomware actors, this vulnerability presents a significant risk to data integrity and organizational business continuity.

Remediation Plan

Immediate Action: Review the official Quest security advisory and apply the necessary patches or configuration changes to the NVBUDashboard component immediately.

Proactive Monitoring: Monitor database access logs for anomalous query structures and unexpected administrative activity originating from the dashboard interface.

Compensating Controls: Restrict network access to the NetVault Backup dashboard to trusted management subnets and deploy a Web Application Firewall (WAF) to filter malicious SQL syntax.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of this remote code execution vulnerability, administrators must prioritize the assessment of their NetVault Backup deployments. Until a patch can be verified and applied, strict network segmentation is required to prevent unauthorized access to the vulnerable dashboard interface.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Quest NetVault Backup is susceptible to a SQL injection vulnerability within the NVBULibrarySlot component, which could allow an attacker to perform remote code execution.

Executive Summary:
A critical SQL injection vulnerability in the Quest NetVault Backup NVBULibrarySlot component enables remote code execution, posing a severe threat to the security and integrity of the system.

Vulnerability Details

CVE-ID: CVE-2026-9785

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to sanitize input within the NVBULibrarySlot function, enabling an unauthenticated attacker to inject malicious SQL queries that facilitate remote code execution on the server.

Business Impact

The exploitation of this vulnerability could result in total system compromise, allowing an attacker to manipulate backup sets or gain persistent access to the network. The CVSS score of 8.8 reflects the high risk, necessitating immediate attention to prevent unauthorized access to sensitive data and critical infrastructure components.

Remediation Plan

Immediate Action: Ensure all Quest NetVault Backup installations are updated to the latest secure version provided by the vendor.

Proactive Monitoring: Utilize endpoint detection and response (EDR) tools to monitor for unauthorized shell commands or suspicious processes spawned by the NetVault server service.

Compensating Controls: Implement strict network segmentation to minimize the attack surface of the backup server, ensuring it is not accessible from untrusted or public networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this vulnerability allows for remote code execution, it represents a critical security risk that must be addressed promptly. Organizations should verify their current version status and prepare to deploy the necessary patches immediately to safeguard their backup environment from potential exploitation.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Quest NetVault Backup contains a SQL injection vulnerability in the NVBULibraryPort component, which may enable remote code execution by an attacker.

Executive Summary:
A critical SQL injection vulnerability in the Quest NetVault Backup NVBULibraryPort component permits remote code execution, creating a significant risk of unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2026-9784

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the NVBULibraryPort component, where improper input validation allows an unauthenticated attacker to inject malicious SQL commands, potentially resulting in remote code execution.

Business Impact

Successful exploitation allows an adversary to bypass security controls, leading to potential data exfiltration or complete system takeover. The CVSS score of 8.8 underscores the high severity, indicating that this vulnerability could lead to widespread disruption of backup operations and compromise of the enterprise backup environment.

Remediation Plan

Immediate Action: Monitor vendor communication channels and apply the official security patch as soon as it becomes available for your specific environment.

Proactive Monitoring: Inspect database logs for anomalous input strings or unauthorized access attempts directed at the library port configuration interfaces.

Compensating Controls: Restrict network access to the NetVault management console using strict firewall rules to ensure only trusted administrative segments can reach the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency, as backup infrastructure is a high-value target for attackers. Immediate application of vendor-provided patches is essential to prevent potential exploitation and secure the backup environment against unauthorized command execution.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Quest NetVault Backup is vulnerable to a SQL injection flaw within the NVBURemovableMedia component, potentially allowing for remote code execution.

Executive Summary:
A critical SQL injection vulnerability in the Quest NetVault Backup NVBURemovableMedia component poses a severe risk of remote code execution and full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-9783

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to properly sanitize user-supplied input within the NVBURemovableMedia function, leading to a SQL injection vulnerability that can be leveraged by an unauthenticated attacker to achieve remote code execution.

Business Impact

The ability to execute arbitrary code on a backup server carries catastrophic business risk, including the potential for unauthorized access to sensitive backup data, credentials, and the underlying infrastructure. With a CVSS score of 8.8, this high-severity flaw threatens the confidentiality, integrity, and availability of critical enterprise data assets.

Remediation Plan

Immediate Action: Identify and patch all instances of Quest NetVault Backup according to the vendor's forthcoming security guidance.

Proactive Monitoring: Review system and application logs for unusual database queries or unexpected process execution patterns originating from the NetVault service account.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to filter and block suspicious SQL injection patterns targeting the NetVault management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability represents a significant threat to organizational security. Administrators should prioritize the identification of affected NetVault instances and apply the necessary patches immediately upon release to mitigate the risk of unauthorized system access.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the NVBUDeviceDrive component of Quest NetVault Backup facilitates remote code execution.

Executive Summary:
A critical SQL injection vulnerability in Quest NetVault Backup’s NVBUDeviceDrive component poses a severe risk of remote code execution and unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-9782

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the NVBUDeviceDrive component and stems from insufficient SQL input validation, which can be exploited to achieve remote code execution. Attackers may target this vulnerability to execute arbitrary commands by injecting malicious SQL queries into the device drive management functions.

Business Impact

Exploitation of this vulnerability could lead to the total compromise of backup integrity, potentially allowing attackers to disable security controls or exfiltrate backed-up data. The CVSS score of 8.8 underscores the high risk to organizational operations, as a compromised backup server can serve as a pivot point for broader network attacks.

Remediation Plan

Immediate Action: Apply the vendor-supplied patches for NetVault Backup as soon as they become available to address the underlying SQL injection flaw.

Proactive Monitoring: Perform regular audits of system logs and monitor for irregular database activity or unauthorized attempts to access device drive configuration settings.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests containing common SQL injection payloads and ensure management interfaces are protected by multi-factor authentication.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability represents a significant threat to organizational security. Security teams must prioritize patching and verify that all NetVault Backup instances are running the latest software versions provided by the vendor to mitigate this high-severity risk effectively.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the NVBURASDevice component of Quest NetVault Backup enables remote code execution.

Executive Summary:
A critical SQL injection vulnerability in Quest NetVault Backup’s NVBURASDevice component poses a severe risk of remote code execution and potential unauthorized system takeover.

Vulnerability Details

CVE-ID: CVE-2026-9781

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the NVBURASDevice component, involving improper SQL input sanitization that permits an attacker to inject and execute arbitrary code. The vulnerability likely requires interaction with the device management interface, which may require authenticated access depending on the network configuration.

Business Impact

Successful exploitation allows an attacker to gain unauthorized control over the backup infrastructure, threatening the confidentiality and availability of sensitive corporate data. With a CVSS score of 8.8, the vulnerability is classified as high severity, reflecting the significant impact on enterprise security posture should the backup environment be compromised.

Remediation Plan

Immediate Action: Consult the official Quest security advisory to obtain and apply the required patches for the NetVault Backup suite.

Proactive Monitoring: Monitor for suspicious activity, specifically focusing on database-related errors or unexpected modifications to the NVBURASDevice configurations.

Compensating Controls: Implement strict network segmentation to ensure that the management interfaces of NetVault Backup are not exposed to untrusted networks or the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention from IT security teams. Organizations should treat this as a high-priority update to ensure the integrity of their backup operations and prevent exploitation by malicious actors who could leverage this flaw to gain deeper access into the environment.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Quest NetVault Backup contains a cross-site scripting (XSS) vulnerability in the addclient3 function that permits authentication bypass.

Executive Summary:
A critical authentication bypass flaw in Quest NetVault Backup via the addclient3 function exposes administrative interfaces to unauthorized script execution.

Vulnerability Details

CVE-ID: CVE-2026-9780

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an XSS flaw within the addclient3 function, which fails to adequately sanitize user input, leading to an authentication bypass. This allows an attacker to manipulate client registration processes and gain unauthorized access to the backup management console.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a substantial threat to internal security controls. Exploitation could allow an attacker to gain administrative control over the backup environment, potentially leading to unauthorized modification of configurations or complete loss of data availability.

Remediation Plan

Immediate Action: Update the Quest NetVault Backup environment to the latest version released by the vendor to resolve the addclient3 vulnerability.

Proactive Monitoring: Monitor network traffic and application logs for unusual activity associated with client management functions.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and block malicious requests containing script-based payloads directed at the addclient3 endpoint.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this issue necessitates urgent attention from IT security teams. Applying the vendor's patch is the only definitive way to remediate this authentication bypass; regular verification of patch compliance across all backup nodes is highly recommended.

---METADATA---
VENDOR: Unraid
PRODUCT: Unraid Web Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Unraid Web Server is vulnerable to remote code execution via command injection in the ToggleState function.

Executive Summary:
A critical command injection vulnerability in the Unraid Web Server allows unauthenticated remote attackers to execute arbitrary code on the underlying host.

Vulnerability Details

CVE-ID: CVE-2026-9773

Affected Software: Unraid Web Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists due to improper sanitization of user-supplied input within the ToggleState command function, enabling command injection. An unauthenticated attacker can leverage this flaw to execute system-level commands remotely.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code poses a severe risk to data integrity, confidentiality, and system availability. With a CVSS score of 8.8, this vulnerability could lead to a complete system compromise, unauthorized access to stored data, and potential lateral movement within the network, resulting in significant operational disruption and reputational damage.

Remediation Plan

Immediate Action: Apply all available security patches provided by Unraid immediately, prioritizing internet-facing instances.

Proactive Monitoring: Review web server access logs for anomalous request patterns or suspicious command strings directed at the ToggleState endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block common command injection payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the potential for remote code execution, this vulnerability represents a significant threat to the environment. Administrators should verify their current version status against vendor bulletins and apply updates immediately. If patching is not immediately feasible, restrict access to the web interface to trusted management networks.

---METADATA---
VENDOR: Unraid
PRODUCT: Unraid Web Server
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A file upload command injection vulnerability in the Unraid web server allows remote attackers to execute arbitrary commands by uploading malicious files.

Executive Summary:
An unauthenticated remote code execution vulnerability exists in the Unraid web server, stemming from improper validation of file uploads.

Vulnerability Details

CVE-ID: CVE-2026-9772

Affected Software: Unraid Web Server

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability occurs due to insufficient validation of file types and names during the upload process. An attacker can upload a crafted file to the web server that, when processed, executes arbitrary commands on the underlying host operating system.

Business Impact

The CVSS score of 8.8 highlights the critical nature of this flaw, as it allows for trivial remote code execution. Successful exploitation could lead to total control over the Unraid host, resulting in the theft of stored data, permanent system damage, or the use of the device as a pivot point for lateral movement.

Remediation Plan

Immediate Action: Apply the vendor-provided patch or update to the latest stable version of Unraid as soon as it becomes available.

Proactive Monitoring: Review web server access and error logs for suspicious file upload activity, particularly involving files with non-standard extensions or those uploaded to unexpected directories.

Compensating Controls: Disable the web management interface if accessible from non-trusted networks and implement restrictive ingress rules at the network perimeter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly dangerous due to the ease with which an attacker can execute code via file uploads. Organizations and users must restrict access to the Unraid management interface immediately and apply the necessary software updates as soon as they are released to mitigate the risk of remote system compromise.

---METADATA---
VENDOR: zephyrproject
PRODUCT: zephyr
AFFECTED_VERSIONS: 4.0.0 up to (excluding) 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A memory safety vulnerability in the Zephyr RTOS flash_copy system call allows local attackers to achieve unauthorized memory access.

Executive Summary:
A critical memory safety vulnerability in the Zephyr RTOS flash_copy system call could allow a local attacker to achieve elevated privileges or compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-9771

Affected Software: zephyrproject zephyr

Affected Versions: 4.0.0 up to (excluding) 4.4.2

Vulnerability: The vulnerability exists within the implementation of the flash_copy system call, specifically in the verification logic handled by z_vrfy_flash_copy. This flaw allows a local, authenticated user to bypass intended memory protections.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk to embedded systems running the Zephyr RTOS. Unauthorized access to flash memory can result in complete system compromise, firmware tampering, or the exposure of sensitive data stored on the device.

Remediation Plan

Immediate Action: Update the Zephyr RTOS to version 4.4.2 or later to include the necessary security fixes for the flash_copy system call.

Proactive Monitoring: Implement strict access control lists for local system users and monitor for unauthorized attempts to access low-level system calls or memory-mapped flash regions.

Compensating Controls: If an update cannot be applied immediately, restrict access to the device to only trusted local users and disable unnecessary system calls if the hardware configuration permits.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires local access, which limits the immediate threat from remote attackers.

Analyst Recommendation

Given the critical nature of memory safety flaws in an RTOS, immediate patching is essential to prevent potential full-system compromise. Development teams should prioritize upgrading the Zephyr kernel version to 4.4.2 to ensure the integrity of the flash subsystem.

---METADATA---
VENDOR: TP-Link
PRODUCT: Kasa EC71 v4 and EC70 v4
AFFECTED_VERSIONS: 0 up to (excluding) 2.4.0 Build 20260520 rel.4191
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
TP-Link Kasa EC71 and EC70 v4 firmware versions store a static cryptographic private key on a read-only filesystem, which is shared across all devices.

Executive Summary:
The presence of a hard-coded, static cryptographic key across TP-Link Kasa devices introduces a critical risk of interception and unauthorized access to device communications.

Vulnerability Details

CVE-ID: CVE-2026-9770

Affected Software: TP-Link Kasa EC71 v4 and EC70 v4

Affected Versions: All versions prior to 2.4.0 Build 20260520 rel.4191

Vulnerability: This vulnerability (CWE-321) involves the use of hard-coded cryptographic keys, which enables an attacker with adjacent network access to potentially decrypt communications or impersonate legitimate devices.

Business Impact

The use of a shared static key undermines the security of the entire device fleet. A successful exploit could lead to the complete compromise of device confidentiality and integrity, effectively nullifying the encryption intended to protect user traffic and device management commands.

Remediation Plan

Immediate Action: Update the firmware of all Kasa EC71 and EC70 v4 devices to version 2.4.0 Build 20260520 rel.4191 or later, as provided by the TP-Link support portal.

Proactive Monitoring: Monitor the local network for unusual authentication requests or attempts to intercept traffic originating from smart home devices.

Compensating Controls: Isolate smart home devices onto a dedicated VLAN to limit the scope of potential lateral movement or interception attempts from compromised devices on the primary network.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Hard-coded keys represent a systemic flaw in product design, making them inherently exploitable once the key is extracted.

Analyst Recommendation

Due to the nature of hard-coded credentials, this vulnerability poses a significant risk to the privacy and security of the affected hardware. Users should ensure the firmware update is applied immediately to rotate or replace the insecure cryptographic material.

---METADATA---
VENDOR: EmilStenstrom
PRODUCT: justhtml
AFFECTED_VERSIONS: 0 up to (excluding) 1.10.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The justhtml library is vulnerable to uncontrolled recursion, which can be exploited by an attacker to trigger a denial of service condition via deeply nested HTML content.

Executive Summary:
An uncontrolled recursion vulnerability in the justhtml library allows unauthenticated attackers to cause a denial of service through specially crafted HTML input.

Vulnerability Details

CVE-ID: CVE-2026-9769

Affected Software: EmilStenstrom justhtml

Affected Versions: 0 up to (excluding) 1.10.0

Vulnerability: This is an uncontrolled recursion vulnerability (CWE-674) within the HTML parsing logic. It allows an unauthenticated attacker to exhaust system resources by submitting deeply nested HTML structures, leading to an application crash or service unavailability.

Business Impact

Successful exploitation of this flaw results in a denial of service, which disrupts the availability of applications relying on the justhtml library. Given the CVSS score of 7.5, this high severity issue could lead to significant operational downtime for systems that process untrusted user-supplied HTML content.

Remediation Plan

Immediate Action: Update the justhtml package to version 1.10.0 or later to incorporate the recursive logic fix.

Proactive Monitoring: Monitor application logs for sudden spikes in memory usage or frequent process restarts that may indicate attempts to exploit this recursion flaw.

Compensating Controls: Implement input validation to restrict the depth of nested HTML tags at the application level to mitigate the impact until the library can be updated.

Exploitation Status

Public Exploit Available: No (exploit_available unknown)

Analyst Notes: As of August 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any system that passes untrusted HTML input to the library without depth limitations.

Analyst Recommendation

This vulnerability presents a high risk to service availability for affected web applications. Security teams should prioritize updating the justhtml dependency to version 1.10.0 to eliminate the underlying recursive logic flaw.

---METADATA---
VENDOR: Grafana
PRODUCT: Grafana IRM
AFFECTED_VERSIONS: 1.0.0 through 1.164.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in Grafana IRM allows authenticated users to perform unauthorized actions, potentially impacting system integrity and availability.

Executive Summary:
Grafana IRM versions 1.0.0 through 1.164.0 are affected by a high-severity vulnerability that permits authenticated users to compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-9765

Affected Software: Grafana Grafana IRM

Affected Versions: 1.0.0 through 1.164.0

Vulnerability: This vulnerability involves an improper authorization flaw, which allows an authenticated attacker with low privileges to perform unauthorized modifications or disrupt service availability within the platform.

Business Impact

The exploitation of this vulnerability could lead to significant unauthorized changes to incident response configurations or service disruptions, directly impacting operational continuity. With a CVSS score of 7.1, the risk is categorized as High because it allows an attacker to manipulate core system functions despite requiring authenticated access. Failure to address this flaw may result in the corruption of critical incident data or unauthorized access to sensitive workflow parameters.

Remediation Plan

Immediate Action: Update Grafana IRM to the latest vendor-supplied patch version as detailed in the official security advisory.

Proactive Monitoring: Review audit logs for suspicious activity involving user-initiated configuration changes or unexpected spikes in service resource consumption.

Compensating Controls: Implement strict access control lists and principle of least privilege policies to limit the potential impact of an authenticated user session being compromised.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is primarily an authorization issue that requires the attacker to have established a valid user session within the environment.

Analyst Recommendation

Given the potential for unauthorized system modifications, administrators should prioritize applying the security updates provided by Grafana. Ensure that all users maintain strong, unique credentials to mitigate the risk of account compromise, which is a prerequisite for exploiting this vulnerability.

---METADATA---
VENDOR: IBM
PRODUCT: Db2
AFFECTED_VERSIONS: 11.5.0 through 11.5.9, 12.1.0 through 12.1.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
IBM Db2 is susceptible to a code injection vulnerability that could allow an authenticated local user to execute unauthorized code.

Executive Summary:
A code injection vulnerability in IBM Db2 versions 11.5 and 12.1 enables authenticated local users to potentially execute arbitrary code on the database server.

Vulnerability Details

CVE-ID: CVE-2026-9762

Affected Software: IBM Db2

Affected Versions: 11.5.0 through 11.5.9, 12.1.0 through 12.1.4

Vulnerability: The vulnerability is identified as CWE-94, which involves the improper control of code generation. It requires the attacker to have local access and low privileges to execute the injection successfully.

Business Impact

A successful code injection attack allows an authenticated local user to gain elevated control over the database environment. This could result in unauthorized data modification, exfiltration, or complete system takeover, justifying the high CVSS score of 7.8.

Remediation Plan

Immediate Action: Download and apply the appropriate interim fix or special build (e.g., Special Build #87098 or later for V11.5.9) from IBM Fix Central.

Proactive Monitoring: Audit database user permissions and monitor for unauthorized execution of administrative or system-level commands.

Compensating Controls: Enforce the principle of least privilege for all database users and ensure local system access is strictly controlled to prevent unauthorized login attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, this vulnerability is not considered automatable, which lowers the immediate risk of wide-scale automated exploitation.

Analyst Recommendation

While the exploit requires local access, the potential for code injection remains a significant security risk for database administrators. Administrators should apply the recommended interim fixes or special builds as soon as possible to mitigate this risk.

---METADATA---
VENDOR: HAYAJO
PRODUCT: Mojolicious::Plugin::Web::Auth::OAuth2
AFFECTED_VERSIONS: Through 0.17
---END_METADATA---

Description Summary:
The HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2 Perl module uses a predictable state parameter, enabling CSRF-based session hijacking.

Executive Summary:
A critical flaw in the HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2 module allows unauthenticated attackers to perform session hijacking via predictable OAuth2 state parameters.

Vulnerability Details

CVE-ID: CVE-2026-9733

Affected Software: HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2

Affected Versions: Through 0.17

Vulnerability: This vulnerability stems from the use of a predictable SHA-1 hash for the OAuth2 state parameter, which relies on low-entropy sources like epoch time and Perl's rand function. This allows an unauthenticated attacker to bypass CSRF protections and hijack user sessions.

Business Impact

The ability to hijack user sessions poses a significant risk to data integrity and confidentiality. Successful exploitation could allow unauthorized actors to impersonate legitimate users, leading to unauthorized data access or administrative control over affected applications. Given the CVSS score of 9.1, this vulnerability represents a critical threat to the security posture of any service utilizing this plugin.

Remediation Plan

Immediate Action: Update the Mojolicious::Plugin::Web::Auth::OAuth2 module to the latest patched version provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous patterns in OAuth2 callback requests or suspicious authentication flow initiation.

Compensating Controls: Implement strict Content Security Policy (CSP) headers and ensure that alternative CSRF mitigation strategies are in place while the update is being deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing the HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2 module must prioritize this update immediately. Because the vulnerability facilitates full session hijacking, the risk to application security is severe, and failure to patch leaves users highly susceptible to unauthorized account takeover.

---METADATA---
VENDOR: Drupal
PRODUCT: AlternativeCommerce (Basket)
AFFECTED_VERSIONS: 0.0.0 up to (excluding) 2.1.17
CONFIDENCE: high
MISSING: none
CREDITS: Drew Webber (mcdruid) (finder); Helena Zajika (helena zajika) (remediation developer); Drew Webber (mcdruid) (remediation developer); Greg Knaddison (greggles) (coordinator); Dave Long (longwave) (coordinator); Drew Webber (mcdruid) (coordinator)
SOURCES_JSON: [{"url":"https://www.drupal.org/sa-contrib-2026-038","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A critical object injection vulnerability exists in the Drupal AlternativeCommerce (Basket) module, allowing unauthenticated remote attackers to modify object attributes.

Executive Summary:
A critical object injection vulnerability in the Drupal AlternativeCommerce (Basket) module allows unauthenticated attackers to achieve remote code execution and full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-9726

Affected Software: Drupal AlternativeCommerce (Basket)

Affected Versions: 0.0.0 up to (excluding) 2.1.17

Vulnerability: This vulnerability is caused by improper control of dynamically determined object attributes (CWE-915). It allows an unauthenticated, remote attacker to perform object injection, leading to total impact on confidentiality, integrity, and availability.

Business Impact

The CVSS score of 9.8 reflects the extreme severity of this flaw, as it requires no authentication or user interaction to exploit. Successful exploitation could grant an attacker full control over the web application, resulting in unauthorized data access, modification of business transactions, and potential persistence within the hosting environment.

Remediation Plan

Immediate Action: Update the Drupal AlternativeCommerce (Basket) module to version 2.1.17 or the latest available release as specified in the vendor advisory.

Proactive Monitoring: Monitor server logs for suspicious HTTP POST requests or patterns indicative of serialized object manipulation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block common object injection payloads and unauthorized PHP serialization attempts.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to its automatable nature and the ability for unauthenticated attackers to execute arbitrary operations.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for total system compromise, administrators should prioritize updating the affected module immediately. If an immediate update is not feasible, restrict access to the affected module or disable it entirely to prevent unauthorized exploitation.

---METADATA---
VENDOR: printcart
PRODUCT: Printcart Web to Print Product Designer for WooCommerce
AFFECTED_VERSIONS: Up to and including 2.5.2
---END_METADATA---

Description Summary:
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion via improper path validation and nonce exposure.

Executive Summary:
A critical arbitrary file deletion vulnerability in the Printcart WordPress plugin allows unauthenticated attackers to execute unauthorized file operations, potentially leading to remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-9725

Affected Software: printcart Printcart Web to Print Product Designer for WooCommerce

Affected Versions: Up to and including 2.5.2

Vulnerability: The plugin fails to perform adequate path validation on the 'nbd_item_key' parameter and fails to properly secure the nonce required for the nbd_save_customer_design action, allowing unauthenticated attackers to delete arbitrary files.

Business Impact

This vulnerability is rated 9.1 (Critical) as it facilitates arbitrary file deletion, which can be chained to achieve Remote Code Execution (RCE). The impact includes complete site compromise, data loss, and potential total loss of control over the WordPress server environment, posing a severe threat to business continuity.

Remediation Plan

Immediate Action: Update the Printcart Web to Print Product Designer for WooCommerce plugin to the latest version immediately.

Proactive Monitoring: Monitor server filesystem integrity and review web server logs for suspicious POST requests targeting the plugin's AJAX endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests containing directory traversal sequences or unauthorized attempts to access sensitive plugin functions.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly dangerous because it allows unauthenticated attackers to perform destructive actions on the server. Site administrators must update the plugin immediately to the latest patched version to prevent potential RCE and complete site takeover.

---METADATA---
VENDOR: Schneider Electric
PRODUCT: PowerLogic P7
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
An OS command injection vulnerability exists in Schneider PowerLogic P7 devices that allows authenticated users to execute arbitrary commands with elevated privileges.

Executive Summary:
A high-severity OS command injection vulnerability in Schneider PowerLogic P7 devices allows privileged attackers to execute unauthorized commands, threatening system integrity.

Vulnerability Details

CVE-ID: CVE-2026-9717

Affected Software: Schneider Electric PowerLogic P7

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is an OS command injection vulnerability (CWE-78) triggered when a privileged authenticated user interacts with a network-exposed service. The flaw allows the injection of malicious system commands that execute with elevated permissions.

Business Impact

The CVSS score of 8.6 reflects the critical impact of command injection on industrial control systems. Unauthorized execution of system commands can lead to full device compromise, loss of confidentiality regarding operational data, and potential disruption of power management functions, posing significant operational and safety risks.

Remediation Plan

Immediate Action: Update the affected PowerLogic P7 firmware to the latest version provided by Schneider Electric to neutralize the command injection vector.

Proactive Monitoring: Monitor device audit logs for unusual command execution patterns or unexpected system-level configuration changes.

Compensating Controls: Enforce strict access control policies to ensure only minimal, necessary privileges are assigned to service accounts, reducing the impact of a compromised account.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

While this vulnerability requires authenticated access, the ability to escalate commands to the system level necessitates a high-priority response. IT and OT security teams must ensure that firmware updates are tested and deployed rapidly to maintain the integrity of the PowerLogic environment.

---METADATA---
VENDOR: Schneider Electric
PRODUCT: PowerLogic™ P7
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A NULL pointer dereference vulnerability in Schneider PowerLogic™ P7 devices can lead to a denial-of-service condition when processing malformed network requests.

Executive Summary:
A critical NULL pointer dereference vulnerability in Schneider PowerLogic™ P7 devices can be triggered by malformed network packets, resulting in a denial-of-service condition for device management.

Vulnerability Details

CVE-ID: CVE-2026-9716

Affected Software: Schneider Electric PowerLogic™ P7

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability, identified as CWE-476, occurs when the device encounters malformed requests over exposed network interfaces. The resulting NULL pointer dereference causes the device's HMI and configuration functionality to crash, effectively rendering the device unmanageable.

Business Impact

The inability to access the HMI or configuration functionality of industrial power management hardware can lead to significant operational disruption and loss of visibility into critical infrastructure. With a CVSS score of 8.7, this vulnerability presents a high risk to operational continuity, especially in environments where remote management is essential for uptime.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware update to all affected PowerLogic™ P7 units immediately.

Proactive Monitoring: Monitor network traffic for malformed packets or unusual patterns directed toward the device's management interfaces to detect potential exploitation attempts.

Compensating Controls: Isolate critical power management devices on dedicated, firewalled network segments to prevent unauthorized or malformed traffic from reaching the device interfaces.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of PowerLogic™ devices in industrial settings, patching this vulnerability is essential to prevent potential denial-of-service attacks. If immediate patching is not possible, ensure that network segmentation is strictly enforced to minimize the attack surface of the management interfaces.

---METADATA---
VENDOR: EventON
PRODUCT: EventON (Pro) - WordPress Virtual Event Calendar Plugin
AFFECTED_VERSIONS: Up to and including 5.0.11
---END_METADATA---

Description Summary:
The EventON WordPress plugin is vulnerable to unauthenticated SQL injection via the search parameter due to insufficient input escaping and lack of parameterized queries.

Executive Summary:
A critical SQL injection vulnerability in the EventON plugin allows unauthenticated attackers to extract sensitive database information, posing a severe risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-9711

Affected Software: EventON EventON (Pro)

Affected Versions: Up to and including 5.0.11

Vulnerability: The vulnerability exists due to improper handling of the WordPress 'search' parameter. Unauthenticated attackers can inject malicious SQL commands into existing queries if the "Enable additional search queries" setting is active, allowing for unauthorized data extraction.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an extreme risk of data breach. Successful exploitation allows unauthorized access to the underlying database, potentially exposing sensitive customer data, administrative credentials, or proprietary information, leading to severe regulatory and financial consequences.

Remediation Plan

Immediate Action: Update the EventON plugin to the latest version immediately to resolve the SQL injection flaw.

Proactive Monitoring: Monitor database query logs for anomalous patterns or injection-style characters (e.g., ', --, UNION) associated with the search function.

Compensating Controls: Utilize a Web Application Firewall (WAF) with SQL injection protection rules to inspect and filter malicious search queries before they reach the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical and requires immediate attention to prevent unauthorized access to sensitive database contents. Organizations utilizing EventON must apply the latest vendor update as soon as possible to mitigate the risk of data exfiltration.

---METADATA---
VENDOR: joe007
PRODUCT: Eventer
AFFECTED_VERSIONS: 0 through 4.4.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Eventer WordPress plugin stores password reset keys in plaintext, allowing unauthenticated attackers to hijack user accounts.

Executive Summary:
A critical authentication bypass vulnerability in the Eventer WordPress plugin allows unauthenticated attackers to hijack any user account, including administrators.

Vulnerability Details

CVE-ID: CVE-2026-9701

Affected Software: joe007 Eventer

Affected Versions: 0 through 4.4.2

Vulnerability: The plugin insecurely stores plaintext password reset keys in the eventer_verification_code meta field. Unauthenticated attackers can leverage this, potentially in conjunction with other vulnerabilities like SQL injection, to retrieve these keys and reset passwords for arbitrary accounts.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating maximum severity. Successful exploitation allows for complete account takeover, granting attackers administrative access to the WordPress instance. This leads to full site control, unauthorized data access, and the potential to inject malicious content into the site.

Remediation Plan

Immediate Action: Update the Eventer plugin to the latest version immediately to ensure secure handling of password reset keys.

Proactive Monitoring: Monitor user metadata tables for suspicious entries in the eventer_verification_code field and audit successful password reset events.

Compensating Controls: Ensure the site is protected by a WAF and disable the password reset functionality if the plugin cannot be updated immediately.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Account takeover vulnerabilities are high-priority risks that must be addressed immediately. Administrators should update the Eventer plugin to the latest version, verify that no unauthorized accounts have been created or modified, and force a password reset for all administrative users.

---METADATA---
VENDOR: DBI (Perl)
PRODUCT: DBI
AFFECTED_VERSIONS: DBI versions before 1.648
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Perl DBI module occurs when error messages are written to a fixed-size 200-byte buffer without length validation.

Executive Summary:
A critical buffer overflow vulnerability in the Perl DBI module allows an attacker to execute arbitrary code by manipulating error messages in affected applications.

Vulnerability Details

CVE-ID: CVE-2026-9698

Affected Software: DBI (Perl)

Affected Versions: DBI versions before 1.648

Vulnerability: The vulnerability stems from the use of a limited 200-byte buffer for storing error messages when RaiseError, PrintError, or HandleError are enabled. If an attacker can influence the error text, they can trigger a buffer overflow, potentially leading to arbitrary code execution.

Business Impact

The CVSS score of 9.8 highlights the severity of this issue, as it enables remote code execution in applications utilizing the DBI interface. Successful exploitation could lead to full application compromise, data theft, or unauthorized database access, threatening the confidentiality and integrity of critical business information.

Remediation Plan

Immediate Action: Upgrade the Perl DBI module to version 1.648 or later to ensure proper buffer size management.

Proactive Monitoring: Monitor database-connected applications for unusual error patterns and investigate any application crashes that coincide with user-supplied input.

Compensating Controls: Implement robust input sanitization for all user-provided data that could potentially trigger database errors, preventing the input from reaching the vulnerable DBI logging mechanisms.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is critical for any Perl-based application that interacts with databases via DBI. Developers and system administrators must prioritize upgrading to version 1.648 to resolve this buffer overflow risk and prevent potential remote code execution attacks.

---METADATA---
VENDOR: Dassault Systèmes
PRODUCT: DELMIA Apriso
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper authentication vulnerability in Dassault Systèmes DELMIA Apriso (2020-2026) allows remote, unauthenticated attackers to gain privileged access to the server.

Executive Summary:
An improper authentication flaw in Dassault Systèmes DELMIA Apriso allows unauthenticated remote attackers to obtain unauthorized administrative access to the platform.

Vulnerability Details

CVE-ID: CVE-2026-9695

Affected Software: Dassault Systèmes DELMIA Apriso

Affected Versions: Release 2020 Golden through 2026 SP1 (see specific service pack ranges in metadata)

Vulnerability: This is an Improper Authentication (CWE-287) vulnerability. It allows an unauthenticated remote attacker to bypass security controls and gain privileged access to the application server.

Business Impact

With a CVSS score of 9.8, this vulnerability poses an extreme risk to business operations. An attacker gaining privileged access can manipulate production workflows, steal sensitive manufacturing data, or disrupt critical industrial processes, leading to severe financial and operational consequences.

Remediation Plan

Immediate Action: Apply the vendor-supplied patches immediately by updating to the latest service pack for your specific DELMIA Apriso release.

Proactive Monitoring: Review application access logs for anomalous login patterns, especially those originating from unexpected IP addresses or occurring outside of business hours.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict access control lists to block traffic to unauthorized administrative endpoints until the patch can be applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical and presents a significant risk of full system takeover. Organizations utilizing DELMIA Apriso must prioritize these updates immediately to prevent unauthorized access to their production environments.

---METADATA---
VENDOR: Integration for ActiveCampaign
PRODUCT: Contact Form 7, WPForms, Elementor, Ninja Forms Integration
AFFECTED_VERSIONS: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.
---END_METADATA---

Description Summary:
An unauthenticated PHP Object Injection vulnerability (CWE-502) affects the Integration for ActiveCampaign and various form plugins, potentially allowing remote code execution.

Executive Summary:
A critical deserialization vulnerability in the Integration for ActiveCampaign plugin allows unauthenticated attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-9691

Affected Software: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms

Affected Versions: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.

Vulnerability: The vulnerability is rooted in the insecure deserialization of untrusted data. An unauthenticated attacker can exploit this by sending a crafted payload to the affected plugin, bypassing security controls to execute malicious code.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. Successful exploitation allows an attacker to gain unauthorized control over the web server, which could lead to sensitive data exfiltration, modification of site content, or the installation of persistent backdoors.

Remediation Plan

Immediate Action: Upgrade the affected plugin to the latest version immediately to patch the insecure deserialization logic.

Proactive Monitoring: Review application and server access logs for anomalous traffic or unexpected execution patterns that deviate from normal plugin behavior.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out common PHP object injection patterns and block malicious HTTP requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a high risk of remote code execution. Organizations utilizing these integration plugins must prioritize patching, as unauthenticated RCE vulnerabilities are frequently targeted by automated exploit campaigns.

---METADATA---
VENDOR: WordPress
PRODUCT: Recover Exit For WooCommerce Plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The "Recover Exit For WooCommerce" WordPress plugin is vulnerable to Local File Inclusion (LFI), which could allow attackers to access sensitive server files.

Executive Summary:
A Local File Inclusion vulnerability in the Recover Exit For WooCommerce plugin for WordPress exposes the host server to potential information disclosure and unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-9662

Affected Software: WordPress Recover Exit For WooCommerce Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin is susceptible to Local File Inclusion (LFI), allowing an attacker to include files on the server that should not be accessible. This vulnerability typically allows an unauthenticated attacker to read sensitive configuration files or perform path traversal.

Business Impact

An LFI vulnerability is critical as it can lead to the exposure of configuration files (e.g., wp-config.php), database credentials, or system information. Given the CVSS score of 8.1, the risk of total site compromise is high, necessitating immediate action to secure the WordPress installation.

Remediation Plan

Immediate Action: Update the "Recover Exit For WooCommerce" plugin to the latest available version or remove the plugin if it is not strictly required.

Proactive Monitoring: Review WordPress access logs for path traversal patterns (e.g., ../../) and unexpected file access attempts.

Compensating Controls: Utilize a security plugin or WAF with LFI protection rules to block malicious input patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Plugin-based vulnerabilities are a common attack vector for WordPress sites. Administrators must update the affected plugin immediately or disable it to prevent attackers from leveraging this LFI flaw to gain unauthorized access to the underlying server.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: 1756-EN2, 1756-EN3, 1756-ENBT
AFFECTED_VERSIONS: 1756-EN2/EN3: 12.001 and before; 1756-ENBT: 6.006
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A denial-of-service vulnerability in Rockwell Automation communication modules arises from improper validation of CIP Implicit Connection packets, allowing unauthenticated remote disruption.

Executive Summary:
A critical denial-of-service vulnerability in Rockwell Automation communication modules poses a significant risk to industrial control systems by allowing unauthenticated remote service disruption.

Vulnerability Details

CVE-ID: CVE-2026-9653

Affected Software: Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT communication modules

Affected Versions: 1756-EN2/EN3: 12.001 and before; 1756-ENBT: 6.006

Vulnerability: This is a denial-of-service vulnerability caused by improper validation of CIP Implicit Connection packets (CWE-354). The vulnerability is exploitable by an unauthenticated remote attacker with network access to the target modules.

Business Impact

The exploitation of this vulnerability can lead to a complete loss of availability for the affected communication modules. In industrial environments, such an outage can halt critical operations, cause unplanned downtime, and potentially lead to significant safety or financial consequences. With a CVSS score of 8.7, this flaw is categorized as High severity, reflecting the ease of remote exploitation and the potential for severe operational impact.

Remediation Plan

Immediate Action: Review the official Rockwell Automation security advisory (SD1780) to identify specific firmware updates or configuration changes required for your hardware revisions. Apply all recommended vendor security updates as soon as they are made available for your specific environment.

Proactive Monitoring: Monitor industrial network traffic for anomalous CIP packet patterns or unexpected spikes in traffic directed at communication modules. Implement logging on network infrastructure to identify unauthorized attempts to communicate with control system hardware.

Compensating Controls: Restrict network access to industrial communication modules by implementing strict VLAN segmentation and firewall rules that allow only authorized traffic. Utilize an Industrial Intrusion Detection System to identify and alert on malformed CIP packets or abnormal traffic volumes.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly automatable, which increases the likelihood of future exploitation attempts once technical details become more widely understood.

Analyst Recommendation

Given the High severity of this vulnerability and its direct impact on industrial availability, organizations should prioritize the identification of affected hardware within their control networks. It is imperative to apply vendor-supplied patches as soon as they become available and to maintain strict network isolation for all vulnerable communication modules to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: Schneider Electric
PRODUCT: EasyLogic T150
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An insufficiently protected credentials vulnerability in Schneider Electric EasyLogic T150 allows unauthenticated access to sensitive system information.

Executive Summary:
A severe credential protection flaw in the Schneider Electric EasyLogic T150 controller allows unauthenticated attackers to gain unauthorized access to sensitive firmware or system files.

Vulnerability Details

CVE-ID: CVE-2026-9650

Affected Software: Schneider Electric EasyLogic T150

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability (CWE-522) involves the storage of credentials in an insufficiently protected manner within the device firmware. An unauthenticated attacker can exploit this to extract sensitive authentication data, gaining unauthorized access to the controller.

Business Impact

The ability for an unauthenticated attacker to extract credentials from an industrial controller poses a severe risk to operational technology (OT) environments. With a CVSS score of 8.7, this vulnerability could lead to total system compromise, unauthorized configuration changes, or the disruption of critical industrial processes, posing significant safety and operational risks.

Remediation Plan

Immediate Action: Update the firmware of all affected EasyLogic T150 controllers to the latest version provided by the manufacturer.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts to the controller interface and review system logs for signs of credential harvesting.

Compensating Controls: Isolate the controllers on a restricted management network with strict access control lists (ACLs) to prevent unauthorized network access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of industrial control systems, this vulnerability requires immediate attention. Organizations must identify all deployed EasyLogic T150 units and apply the vendor-provided firmware update as a matter of urgency to prevent potential remote exploitation and unauthorized access to industrial operations.

---METADATA---
VENDOR: ScadaBR
PRODUCT: ScadaBR
AFFECTED_VERSIONS: 1.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ScadaBR contains a vulnerability where authenticated users can execute arbitrary JavaScript on the server, resulting in remote code execution with root privileges.

Executive Summary:
A critical OS command injection vulnerability in ScadaBR allows authenticated attackers to execute arbitrary code and gain root-level access.

Vulnerability Details

CVE-ID: CVE-2026-9645

Affected Software: ScadaBR

Affected Versions: 1.2.0

Vulnerability: The application contains exposed methods that fail to neutralize malicious input, leading to OS command injection (CWE-78). An authenticated user can leverage this to execute JavaScript, which is subsequently interpreted as system commands running with root privileges.

Business Impact

Rated at 9.9 (Critical), this vulnerability allows for complete system compromise. Since the injected commands execute with root-level privileges, an attacker can gain total control over the server, exfiltrate sensitive process data, or sabotage industrial control systems managed by the ScadaBR platform.

Remediation Plan

Immediate Action: Apply the latest security patch or update to the version recommended by the ScadaBR vendor.

Proactive Monitoring: Review system logs for unauthorized script execution or unexpected processes spawned by the ScadaBR application service.

Compensating Controls: Restrict access to the ScadaBR interface to trusted users only and implement strict network segmentation to limit the blast radius of a potential compromise.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is an extremely severe vulnerability that grants root access to the underlying system. Immediate patching is mandatory; until patches can be applied, ensure that access to the ScadaBR interface is strictly controlled and monitored to prevent exploitation by malicious actors.

---METADATA---
VENDOR: Delta Electronics
PRODUCT: DIAView
AFFECTED_VERSIONS: Delta Electronics DIAView V4.4
---END_METADATA---

Description Summary:
A mitigation bypass vulnerability in Delta Electronics DIAView V4.4 allows unauthenticated remote attackers to access configured databases.

Executive Summary:
An unauthenticated remote database access vulnerability in Delta Electronics DIAView poses a critical risk of data compromise due to a failed previous security patch.

Vulnerability Details

CVE-ID: CVE-2026-9642

Affected Software: Delta Electronics DIAView

Affected Versions: Delta Electronics DIAView V4.4

Vulnerability: This issue is a mitigation bypass of CVE-2025-62582. An unauthenticated remote attacker can leverage this flaw to gain unauthorized access to databases within a DIAView project.

Business Impact

Successful exploitation allows an unauthenticated attacker to bypass existing security controls and access sensitive database information. With a CVSS score of 9.8, this vulnerability represents a critical threat to data confidentiality and integrity, potentially leading to unauthorized data exfiltration or manipulation of industrial project data.

Remediation Plan

Immediate Action: Review and re-apply security patches for DIAView and ensure the bypass for unauthenticated remote database access is fully addressed.

Proactive Monitoring: Audit system access logs for anomalous database connection attempts and monitor network traffic for unauthorized access patterns.

Compensating Controls: Restrict network access to database servers to trusted IP addresses only and ensure robust network segmentation is in place.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of May 26, 2026, there is public information indicating that an exploit is available. Given that this is a bypass of a previously known vulnerability, the urgency for remediation is extremely high.

Analyst Recommendation

Organizations utilizing Delta Electronics DIAView V4.4 must prioritize applying the latest security patches to remediate this bypass. Failure to address this vulnerability leaves critical database infrastructure exposed to unauthenticated remote attackers.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: CompactLogix 5380 / ControlLogix 5580
AFFECTED_VERSIONS: V33 and prior, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:13:24.965Z
SOURCES_JSON: [{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1792.html","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A denial of service vulnerability in Rockwell Automation Logix controllers allows unauthenticated attackers to cause a major nonrecoverable fault via malformed CIP messages.

Executive Summary:
A critical denial of service vulnerability in Rockwell Automation Logix controllers permits unauthenticated remote attackers to crash systems, requiring a manual power cycle for recovery.

Vulnerability Details

CVE-ID: CVE-2026-9637

Affected Software: Rockwell Automation CompactLogix 5380 / ControlLogix 5580

Affected Versions: V33 and prior, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012

Vulnerability: The flaw is caused by improper validation of input length during CIP message processing (CWE-119). This vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector AV:N/AC:L/AT:N/PR:N/UI:N.

Business Impact

The ability to trigger a major nonrecoverable fault in industrial control systems poses a severe risk to operational continuity. Because the device requires a physical power cycle to recover, a successful exploit could result in significant production downtime and operational disruption. The CVSS score of 8.7 reflects the high impact on system availability, which is critical in industrial environments.

Remediation Plan

Immediate Action: Review the official Rockwell Automation security advisory (SD1792) to identify specific firmware updates or configuration changes required for your specific hardware revision.

Proactive Monitoring: Monitor industrial network traffic for anomalous CIP message patterns or spikes in traffic directed at Logix controller communication ports.

Compensating Controls: Implement strict network segmentation and firewall rules to restrict access to industrial communication protocols to authorized engineering workstations only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to force a hard system fault without requiring authentication.

Analyst Recommendation

Given the potential for complete operational disruption, organizations using the affected Logix platforms must prioritize this advisory. Administrators should transition to the latest vendor-provided firmware as soon as testing permits to eliminate the underlying memory buffer vulnerability. In the interim, ensure that all affected controllers are isolated from untrusted networks to prevent remote exploitation.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 1250GW
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical flaw has been found in the UTT HiPER 1250GW router that may allow for unauthorized system exploitation.

Executive Summary:
A critical security flaw in UTT HiPER 1250GW routers necessitates an immediate firmware update to prevent potential network compromise.

Vulnerability Details

CVE-ID: CVE-2026-9632

Affected Software: UTT HiPER 1250GW

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw involves a weakness in the device's operational security. It is likely that this could lead to unauthorized access or control over the router, facilitating further attacks on the internal network.

Business Impact

The vulnerability carries a high impact on network confidentiality and integrity. If exploited, an attacker could gain a persistent foothold within the network, leading to significant reputational and operational damage. The 8.8 CVSS score reflects this high risk.

Remediation Plan

Immediate Action: Update all UTT HiPER 1250GW devices to the latest available firmware provided by the vendor.

Proactive Monitoring: Review system logs for signs of unauthorized access or unexpected changes to device settings.

Compensating Controls: Isolate the router's management interface from the internet and monitor internal traffic for suspicious activity.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must prioritize this update as part of their standard security maintenance. As gateway devices are critical, ensuring they are patched is essential to maintain a secure and resilient network infrastructure.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 1250GW
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical vulnerability has been detected in the UTT HiPER 1250GW router, posing a risk of unauthorized exploitation.

Executive Summary:
A high-severity vulnerability in the UTT HiPER 1250GW router requires immediate firmware updates to secure network perimeters.

Vulnerability Details

CVE-ID: CVE-2026-9631

Affected Software: UTT HiPER 1250GW

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The detected vulnerability affects the device's firmware and could potentially be utilized by remote attackers to gain unauthorized access. Further analysis suggests a significant risk to the security boundary enforced by the device.

Business Impact

The compromise of a HiPER 1250GW router allows an attacker to control the flow of data into and out of the corporate network. This could lead to data exfiltration or the injection of malicious content, justifying the 8.8 CVSS score.

Remediation Plan

Immediate Action: Update the firmware on all UTT HiPER 1250GW units to the latest version immediately.

Proactive Monitoring: Monitor for unusual outbound traffic patterns or unauthorized access attempts to the router's management interface.

Compensating Controls: Limit access to the management UI to a specific, trusted management subnet to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the role of the UTT HiPER 1250GW as a network gateway, immediate remediation is mandatory. Security teams should ensure all units are running the most recent firmware to mitigate this high-severity risk.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 1200GW
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security weakness has been identified in the UTT HiPER 1200GW router, potentially leading to unauthorized system compromise.

Executive Summary:
A critical security weakness in UTT HiPER 1200GW routers poses a high risk to network integrity and requires immediate remediation.

Vulnerability Details

CVE-ID: CVE-2026-9628

Affected Software: UTT HiPER 1200GW

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability represents a identified weakness in the device's security architecture. It is highly likely that this flaw, similar to other vulnerabilities in this product line, could be exploited to bypass security controls.

Business Impact

Exploitation of this gateway device could lead to complete network visibility by an attacker, including data interception and unauthorized internal access. The 8.8 CVSS score underscores the high-risk nature of this vulnerability for any business using this model.

Remediation Plan

Immediate Action: Apply the latest firmware patches provided by UTT to all affected HiPER 1200GW units.

Proactive Monitoring: Inspect device logs for suspicious login attempts or unexpected configuration changes.

Compensating Controls: Implement an external firewall to protect the router's management interface if an immediate firmware update is not feasible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must verify the firmware version of all UTT HiPER 1200GW units and apply updates as a matter of urgency. Maintaining updated firmware on network infrastructure is essential to preventing remote exploits.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 1200GW
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been identified in the UTT HiPER 1200GW router, potentially allowing for unauthorized system access.

Executive Summary:
A critical security vulnerability in the UTT HiPER 1200GW requires immediate attention to protect against unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-9627

Affected Software: UTT HiPER 1200GW

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to a security weakness in the device firmware. While specific technical details are pending, such flaws in network edge devices often involve authentication bypass or command injection.

Business Impact

Compromise of a network gateway like the HiPER 1200GW can allow attackers to intercept traffic, redirect users, or gain a foothold in the internal network. The 8.8 CVSS score indicates a high risk to the overall network security posture.

Remediation Plan

Immediate Action: Update the firmware on all UTT HiPER 1200GW devices to the latest patched version.

Proactive Monitoring: Monitor the router for unauthorized configuration changes or anomalous traffic patterns originating from the management interface.

Compensating Controls: Disable remote management features on the WAN interface and restrict management access to a dedicated, secure internal management VLAN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Network administrators should prioritize updating these gateway devices immediately. As edge devices are the first line of defense, keeping them updated is critical to prevent wider network breaches.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: RSLinx Classic
AFFECTED_VERSIONS: V4.50 and prior
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:13:17.455Z
SOURCES_JSON: [{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1794.html","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A buffer overflow in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to trigger a denial-of-service condition via a crafted CIP packet.

Executive Summary:
A critical denial-of-service vulnerability in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the service by sending a specially crafted CIP packet.

Vulnerability Details

CVE-ID: CVE-2026-9625

Affected Software: Rockwell Automation RSLinx Classic

Affected Versions: V4.50 and prior

Vulnerability: The vulnerability is a buffer overflow (CWE-120) triggered when the application processes a crafted CIP packet containing an oversized embedded message request. This flaw is exploitable by unauthenticated remote attackers without requiring user interaction.

Business Impact

The exploitation of this vulnerability results in the disruption of industrial communication services, leading to potential operational downtime. With a CVSS score of 8.7, this high-severity flaw poses a significant threat to availability, as the service requires manual intervention and a restart to recover from the crash.

Remediation Plan

Immediate Action: Monitor the Rockwell Automation Trust Center for the release of an official security update and apply it to all affected RSLinx Classic installations immediately.

Proactive Monitoring: Implement network traffic analysis to detect anomalous CIP packets or unexpected spikes in service restarts that may indicate attempted exploitation.

Compensating Controls: Utilize industrial firewalls or deep packet inspection (DPI) capable network appliances to restrict CIP traffic to trusted sources and block malformed packets.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its network-accessible nature and the lack of authentication required to trigger the crash.

Analyst Recommendation

Given the high CVSS score and the potential for operational impact in industrial environments, organizations should prioritize restricting network access to the RSLinx Classic service. Ensure that all systems are prepared for patching as soon as the vendor releases the necessary firmware or software update.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: RSLinx Classic
AFFECTED_VERSIONS: V4.50 and prior
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:13:10.218Z
SOURCES_JSON: [{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1794.html","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
Rockwell Automation RSLinx Classic is vulnerable to a denial of service attack via a crafted CIP packet, which triggers a service crash due to insufficient data length validation.

Executive Summary:
A critical denial of service vulnerability in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the service, disrupting critical industrial communication processes.

Vulnerability Details

CVE-ID: CVE-2026-9624

Affected Software: Rockwell Automation RSLinx Classic

Affected Versions: V4.50 and prior

Vulnerability: This vulnerability is caused by an integer underflow (CWE-191) resulting from insufficient validation of data lengths within Common Industrial Protocol (CIP) packets. The flaw is remotely exploitable by an unauthenticated attacker, requiring no user interaction.

Business Impact

The ability for an unauthenticated attacker to remotely crash RSLinx Classic introduces significant operational risk. Because this software is essential for industrial communication, a service crash leads to immediate loss of visibility and control over automation hardware, resulting in unplanned downtime and potential safety hazards. With a CVSS score of 8.7, this high-severity vulnerability warrants immediate attention to prevent operational disruption.

Remediation Plan

Immediate Action: Review the Rockwell Automation security advisory SD1794 to identify if a firmware or software update is available for your specific environment and apply it immediately.

Proactive Monitoring: Monitor industrial network traffic for malformed CIP packets and observe the RSLinx Classic service for unexpected crashes or restart cycles.

Compensating Controls: Restrict network access to the RSLinx Classic service by implementing strict firewall rules and network segmentation, ensuring only authorized engineering workstations can communicate with the affected systems.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its status as an automatable, unauthenticated remote denial of service against industrial control system components.

Analyst Recommendation

Given the high CVSS score and the critical nature of industrial automation software, organizations should treat this vulnerability with high priority. Organizations must verify their current RSLinx Classic version and isolate affected systems from public or untrusted network segments until the vendor-supplied security update is applied.

---METADATA---
VENDOR: Rockwell
PRODUCT: RSLinx Classic
AFFECTED_VERSIONS: V4.50 and prior
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:13:02.571Z
SOURCES_JSON: [{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1794.html","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A denial-of-service vulnerability in Rockwell RSLinx Classic allows unauthenticated attackers to crash the service by sending a crafted CIP packet to the Forward Close service.

Executive Summary:
Rockwell RSLinx Classic is vulnerable to a remote denial-of-service attack that can cause service disruption via a specially crafted CIP packet.

Vulnerability Details

CVE-ID: CVE-2026-9622

Affected Software: Rockwell RSLinx Classic

Affected Versions: V4.50 and prior

Vulnerability: This integer underflow vulnerability (CWE-191) exists within the Forward Close service of RSLinx Classic. The attack vector is network-based and requires no authentication or user interaction to trigger a service crash.

Business Impact

The successful exploitation of this vulnerability results in an immediate denial-of-service condition, rendering the affected RSLinx Classic component unresponsive. Given the CVSS score of 8.7, this flaw poses a high risk to operational continuity, as it requires a manual restart of the service to restore functionality, potentially leading to significant downtime in industrial control environments.

Remediation Plan

Immediate Action: Monitor the Rockwell Automation Trust Center for the release of security updates and apply them as soon as they become available for your specific deployment.

Proactive Monitoring: Implement network intrusion detection systems to identify and alert on unusual CIP packet traffic, specifically monitoring for anomalous requests directed at the Forward Close service.

Compensating Controls: Restrict network access to the RSLinx Classic service by utilizing firewalls or access control lists to ensure only authorized devices can communicate with the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly automatable, which increases the likelihood that malicious actors could develop exploit code in the future.

Analyst Recommendation

This vulnerability presents a high risk to availability due to the ease with which an unauthenticated attacker can disrupt critical services. Administrators should prioritize identifying vulnerable instances within their network and applying vendor-supplied patches immediately upon their release to prevent potential operational outages.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: RSLinx Classic
AFFECTED_VERSIONS: V4.50 and prior
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:03:29.592Z
SOURCES_JSON: [{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1794.html","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A denial of service vulnerability in Rockwell Automation RSLinx Classic allows unauthenticated attackers to crash the service via a malformed CIP packet.

Executive Summary:
A critical vulnerability in Rockwell Automation RSLinx Classic enables unauthenticated remote attackers to trigger a denial of service condition, potentially disrupting industrial operations.

Vulnerability Details

CVE-ID: CVE-2026-9621

Affected Software: Rockwell Automation RSLinx Classic

Affected Versions: V4.50 and prior

Vulnerability: This vulnerability is caused by an integer overflow or wraparound condition (CWE-190) that occurs when the software processes malformed Common Industrial Protocol (CIP) packets. Because the vulnerability is accessible via the network without authentication (PR:N, UI:N), an attacker can remotely cause the service to crash.

Business Impact

The exploitation of this flaw leads to a complete service disruption of the RSLinx Classic application, which is a critical component for communication between industrial control systems. Given the CVSS score of 9.2, this vulnerability represents a severe operational risk that could result in significant downtime for manufacturing or process control environments.

Remediation Plan

Immediate Action: Update Rockwell Automation RSLinx Classic to the latest version provided by the vendor in the official security advisory.

Proactive Monitoring: Monitor network traffic for anomalous CIP packets and review system logs for recurring RSLinx service crashes or unexpected process terminations.

Compensating Controls: Implement network segmentation to restrict access to the RSLinx service to authorized hosts only and deploy industrial firewalls capable of inspecting and filtering malformed CIP traffic.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Sep 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to its automatable nature and the ability for an unauthenticated attacker to remotely disrupt industrial communications.

Analyst Recommendation

Due to the critical nature of this vulnerability and the potential for operational impact in industrial settings, administrators should prioritize patching immediately. If patching is not immediately feasible, network-level isolation of the affected RSLinx instances is strongly recommended to minimize the attack surface until the update can be applied.

---METADATA---
VENDOR: Ivanti
PRODUCT: Neurons for ITSM
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An improper access control vulnerability in Ivanti Neurons for ITSM allows authenticated attackers to escalate privileges to administrative levels.

Executive Summary:
An improper access control vulnerability in Ivanti Neurons for ITSM enables authenticated attackers to gain administrative access, posing a critical threat to organizational security.

Vulnerability Details

CVE-ID: CVE-2026-9614

Affected Software: Ivanti Neurons for ITSM

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an access control flaw that allows a remote, authenticated attacker to bypass standard permissions and gain administrative control over the ITSM platform.

Business Impact

The CVSS score of 8.8 highlights the severity of this issue. An attacker gaining administrative access to an ITSM platform can compromise sensitive organizational data, modify system configurations, and potentially pivot into other internal systems, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Ivanti for the Neurons for ITSM platform immediately.

Proactive Monitoring: Review administrative audit logs for unauthorized user activity or suspicious privilege elevation events.

Compensating Controls: Enforce strict Multi-Factor Authentication (MFA) for all administrative accounts and restrict access to the management console to trusted internal IP ranges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for complete platform compromise, organizations using Ivanti Neurons for ITSM must prioritize this update. Ensure that all patches are tested and deployed rapidly to mitigate the risk of unauthorized administrative access.

---METADATA---
VENDOR: SEPPmail
PRODUCT: SEPPmail Secure Email Gateway & SEPPmail Cloud
AFFECTED_VERSIONS: Before 15.0.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SEPPmail Secure Email Gateway improperly uses the GET method for sensitive operations, leading to the potential exposure of session tokens within logs or browser history.

Executive Summary:
A security flaw in SEPPmail Secure Email Gateway and Cloud allows for the potential exposure of sensitive session tokens through insecure GET request usage.

Vulnerability Details

CVE-ID: CVE-2026-9592

Affected Software: SEPPmail Secure Email Gateway & SEPPmail Cloud

Affected Versions: Before 15.0.4.2

Vulnerability: The software exhibits a CWE-598 vulnerability where sensitive query strings containing session information are transmitted via GET requests. An unauthenticated attacker positioned on the local network could potentially intercept these tokens to facilitate session hijacking.

Business Impact

The exposure of session tokens allows attackers to impersonate legitimate users, potentially leading to unauthorized access to encrypted email communications and internal administrative functions. While the CVSS score is 7.5, the risk is elevated in environments where sensitive email privacy is a primary business requirement.

Remediation Plan

Immediate Action: Upgrade to SEPPmail version 15.0.4.2 or later, which addresses the login redirect behavior to prevent token disclosure.

Proactive Monitoring: Monitor network traffic and server logs for abnormal session handling or unexpected GET requests containing sensitive parameters.

Compensating Controls: Ensure that the gateway is deployed within a secure, isolated management network to restrict the physical or network access required for interception.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires an attacker to be present on the adjacent network to successfully intercept the sensitive traffic.

Analyst Recommendation

Administrators must prioritize the update to version 15.0.4.2 to ensure session tokens are not inadvertently leaked. Failure to patch this issue could lead to significant breaches of confidentiality within secure communication channels.

---METADATA---
VENDOR: Sangoma
PRODUCT: Switchvox SMB Edition
AFFECTED_VERSIONS: 8.3 (104997) up to (excluding) 8.4.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in Sangoma Switchvox SMB Edition allows authenticated users to inject malicious scripts into the web interface.

Executive Summary:
A stored cross-site scripting vulnerability in Sangoma Switchvox SMB Edition allows authenticated attackers to execute malicious scripts, potentially compromising administrative sessions.

Vulnerability Details

CVE-ID: CVE-2026-9588

Affected Software: Sangoma Switchvox SMB Edition

Affected Versions: 8.3 (104997) up to (excluding) 8.4.0.2

Vulnerability: The application is susceptible to stored cross-site scripting (CWE-79) due to improper neutralization of user-supplied input. This vulnerability can be exploited by an authenticated attacker who provides malicious input that is subsequently stored and executed in the browser of another user, such as an administrator.

Business Impact

Successful exploitation may allow an attacker to hijack user sessions, perform unauthorized actions on behalf of other users, or steal sensitive session cookies. Given the CVSS score of 7.0, this vulnerability presents a significant risk to the security of the management console, potentially leading to full administrative compromise if an administrator interacts with the malicious payload.

Remediation Plan

Immediate Action: Upgrade Sangoma Switchvox SMB Edition to version 8.4.0.2 or later as specified in the vendor release notes.

Proactive Monitoring: Monitor the application for unexpected script execution or unusual entries within fields that accept user input, as these may indicate attempted XSS injection.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common XSS payloads directed at the Switchvox web interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows for persistent malicious code execution within the context of the application.

Analyst Recommendation

Due to the persistent nature of stored XSS, this vulnerability poses an ongoing threat to all users of the Switchvox web interface. Organizations must prioritize upgrading to version 8.4.0.2 to ensure that input sanitization is correctly implemented and to secure the management environment against potential session-based attacks.

---METADATA---
VENDOR: Sangoma
PRODUCT: Switchvox SMB Edition
AFFECTED_VERSIONS: 8.3 (104997) up to (excluding) 8.4.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Sangoma Switchvox SMB Edition contains an authenticated local file inclusion vulnerability that allows attackers to access sensitive files on the server.

Executive Summary:
Sangoma Switchvox SMB Edition is vulnerable to authenticated local file inclusion, which may allow an attacker to read unauthorized files on the target system.

Vulnerability Details

CVE-ID: CVE-2026-9587

Affected Software: Sangoma Switchvox SMB Edition

Affected Versions: 8.3 (104997) up to (excluding) 8.4.0.2

Vulnerability: This is a local file inclusion vulnerability (CWE-73) that requires the attacker to have authenticated access to the system. Once authenticated, an attacker can manipulate file paths to gain access to files they should not be able to read.

Business Impact

The ability to perform local file inclusion can lead to the exposure of sensitive system configuration files, database credentials, or internal application data. With a CVSS score of 7.1, this vulnerability poses a high risk to the confidentiality of the environment, particularly for administrators or users with access to the management interface.

Remediation Plan

Immediate Action: Upgrade Sangoma Switchvox SMB Edition to version 8.4.0.2 or later to address the file inclusion flaw.

Proactive Monitoring: Monitor system logs for suspicious file access requests or authentication events originating from unusual accounts or IP addresses.

Compensating Controls: Restrict access to the management interface of the Switchvox appliance to trusted internal networks or VPNs to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires authenticated access, which limits the potential threat actors to those who have already compromised or possess legitimate user credentials.

Analyst Recommendation

Administrators must prioritize updating their Switchvox SMB Edition instances to version 8.4.0.2. While the vulnerability requires authentication, the potential for sensitive data exposure makes patching essential to maintain the security posture of the telecommunications infrastructure.

---METADATA---
VENDOR: Sangoma
PRODUCT: Switchvox SMB Edition
AFFECTED_VERSIONS: 8.3 (104997) up to (excluding) 8.4.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition that allows remote attackers to execute arbitrary database commands via the /pa endpoint.

Executive Summary:
A critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition allows remote attackers to execute arbitrary database operations and potentially achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-9586

Affected Software: Sangoma Switchvox SMB Edition

Affected Versions: 8.3 (104997) up to (excluding) 8.4.0.2

Vulnerability: This is an improper neutralization of special elements used in an SQL command (CWE-89). The /pa endpoint fails to sanitize user-controlled input, allowing an unauthenticated attacker to inject malicious SQL statements directly into PostgreSQL queries.

Business Impact

Successful exploitation poses a severe threat to the integrity and confidentiality of the backend database. Given the CVSS score of 9.3, this flaw enables a remote attacker to bypass authentication, access sensitive information, or potentially gain full system control, leading to significant service disruption and data loss.

Remediation Plan

Immediate Action: Update Sangoma Switchvox SMB Edition to version 8.4.0.2 or later immediately.

Proactive Monitoring: Monitor server logs for suspicious requests to the /pa endpoint, particularly those containing SQL syntax or unusual XML structures.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests to the /pa endpoint containing unexpected SQL keywords or characters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication and the potential for direct database interaction.

Analyst Recommendation

This vulnerability is highly critical due to the lack of authentication required for exploitation. Administrators must prioritize updating affected Switchvox instances to the latest version to prevent potential remote code execution and unauthorized data access.