Search: “pre-authentication”

108 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 133 Exploit / PoC 112 Ransomware 25 Malware 18 Data breach 9 Advisory 5 Threat actor 5 Research 3 Industry 2 Phishing & fraud 1 Policy & legal 1

SeverityAll critical 240 high 53 medium 15 low 4 info 2

SonicWall SMA 1000 appliances under attack via zero-day flaws

SonicWall confirms active exploitation of zero-day SSRF (CVE-2026-83548) and command injection (CVE-2026-83549) flaws in SMA 1000 remote access appliances.

SonicWall confirmed attackers are actively exploiting two previously undisclosed vulnerabilities in SMA 1000 SSL VPN appliances, affecting physical and virtual models 6210, 7210, and 8200v but not SMA 100 appliances or SonicWall firewalls. CVE-2026-83548 is a pre-authentication SSRF in the Appliance Work Place interface allowing remote unauthenticated attackers to gain unauthorized access to sensitive functionality, while CVE-2026-83549 is an OS command injection in the Appliance Management Console that can yield remote code execution under specific conditions for authenticated admins. The vendor urged immediate hotfix deployment, IoC review with technical support, and re-imaging or redeployment plus password and TOTP token resets on confirmed compromise. This is the latest in a series of zero-day attacks against SMA 1000 appliances following waves in late 2025 and June-July 2026.

Help Net SecuritySep 2, 00:00 UTC · 15d agoExploit / PoC in the wildCVE-2026-83548 CVE-2026-83549

PaperCut NG/MF vulnerabilities exploited in zero-day attacks

PaperCut warns of active zero-day exploitation chaining CVE-2026-81578 and CVE-2026-82078 for pre-auth remote code execution in NG/MF print management.

PaperCut Software confirmed attackers are chaining two vulnerabilities in PaperCut NG and MF: CVE-2026-81578, an improper access control flaw in the web management interface allowing unauthenticated configuration changes, and CVE-2026-82078, unsafe dynamic class loading in database connection utilities enabling arbitrary Java bytecode execution. Huntress reproduced a pre-authentication remote configuration takeover and full RCE chain against PaperCut NG 25.0.11.75758 and observed limited exploitation at two customers, including post-exploitation whoami and ver commands. The vendor released Emergency Patch Release 2 with additional hardening and urged restricting Application Server web access to trusted IPs. In 2023, Clop and LockBit affiliates abused CVE-2023-27350 and CVE-2023-27351 in the same software.

Help Net SecurityAug 31, 14:39 UTC · 16d agoExploit / PoC in the wildCVE-2026-81578 CVE-2026-82078 CVE-2023-27350+1 CVEs1

PaperCut NG/MF Zero-day Vulnerability Exploited in the Attacks (CVE-2026-82078 & CVE-2026-81578)

PaperCut NG/MF zero-days CVE-2026-82078 and CVE-2026-81578 are actively exploited, chaining to pre-auth RCE on the Application Server.

PaperCut issued an urgent security advisory for two actively exploited vulnerabilities, CVE-2026-82078 and CVE-2026-81578, affecting all versions of PaperCut NG and PaperCut MF. When chained, the flaws enable pre-authentication remote code execution on the PaperCut Application Server, originating from a request-confusion and authorization gap. PaperCut is widely deployed for print management in enterprises and education, making unpatched instances a high-value target.

Qualys ThreatPROTECTAug 31, 12:07 UTC · 16d agoExploit / PoC in the wildCVE-2026-82078 CVE-2026-81578

Apple macOS Screen Sharing Flaw Exploited on Internet

Actively exploited CVE-2026-65400 in macOS Screen Sharing grants pre-auth root access; attackers deploy Monero miners on exposed systems.

NCSC-NL reported active exploitation of CVE-2026-65400 (CVSS 9.8), an authentication flaw in macOS Screen Sharing patched on August 6, 2026, with root access gained and a Monero miner planted on internet-exposed systems using port 5900. Related Screen Sharing bugs CVE-2026-43779, CVE-2026-43777, and CVE-2026-43760 were fixed in macOS Tahoe 26.6, and researcher @osxreverser noted a pre-auth flaw fixed alongside them affecting roughly 40,000 exposed hosts. Calif said an AI agent produced working exploits for both pre-auth bugs in four hours, underscoring the shrinking gap between patch release and weaponization.

The Hacker NewsAug 19, 05:22 UTC · 28d agoExploit / PoC in the wildCVE-2026-65400 CVE-2026-43779 CVE-2026-43777+1 CVEs

macOS Screen Sharing Flaw Exploited to Deploy Monero Miners

Dutch NCSC confirms active exploitation of critical macOS Screen Sharing flaw CVE-2026-65400, granting root access and installing Monero miners.

CVE-2026-65400 (CVSS 9.8) is an authentication state-management flaw in macOS's built-in Screen Sharing that lets network attackers authenticate without valid credentials. The Dutch NCSC confirmed active exploitation against systems with port 5900 exposed to the internet; in every documented case attackers obtained root access and installed a Monero cryptocurrency miner. Apple patched the bug in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, crediting Alfredo Pesoli of Bynario. A related researcher scan found roughly 40,000 exposed Screen Sharing hosts, and security firm Calif built working exploits for related flaws in about four hours using an AI coding agent.

Security AffairsAug 15, 08:35 UTC · Aug 15, 2026Exploit / PoC in the wildCVE-2026-65400

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase warns an actively exploited zero-day (CVE-2026-72898, CVSS 10.0) grants unauthenticated admin access; Framework, n8n, and Kilo Code disclosed data exposure.

Metabase disclosed a maximum-severity SQL injection affecting versions x.58 through x.63 that lets unauthenticated attackers inject SQL via the /api/session/reset_password endpoint and gain administrator access to Metabase instances. Metabase Cloud was attacked, patches were released, and CISA added CVE-2026-72898 to the KEV catalog with a federal remediation deadline of August 14, 2026. Downstream victims include Framework (customer names, IPs, addresses, phone numbers, and emails accessed), n8n (136 customer records, five with bcrypt-hashed passwords), and Kilo Code (Slack access tokens). Wiz estimates roughly 13% of cloud environments run self-hosted Metabase, with about 2,500 instances internet-accessible.

The Hacker NewsAug 12, 13:47 UTC · Aug 12, 2026Exploit / PoC in the wildCVE-2026-72898 CVE-2023-38646