60
60
Pre-Auth Exploit Chains Found in Commvault Could Enable Remote Code Execution Attacks
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder
Unauthenticated remote memory exhaustion in Apache Storm Worker 3.0.x Netty decoder fixed in 3.1.0, allowing pre-auth denial of service.
CVE-2026-82435 (rated important) affects Apache Storm Worker (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0. The worker's Netty message decoder sits ahead of SASL authentication handlers and processes frames before any authentication occurs. It allocates buffers sized from an attacker-controlled length field, so a single frame from an unauthenticated peer reaching the worker can exhaust memory. Users must upgrade to 3.1.0.
45
2026-008: Critical vulnerabilities in Ivanti Sentry
Ivanti patched Sentry: pre-auth OS command injection CVE-2026-10520 (CVSS 10) enables unauthenticated root RCE, and auth bypass CVE-2026-10523 (CVSS 9.9).
On 9 June 2026 Ivanti released an advisory fixing two critical flaws in Ivanti Sentry versions 10.5.1 and prior, 10.6.1 and prior, and 10.7.0 and prior. CVE-2026-10520 (CVSS 10.0) is an OS command injection allowing a remote unauthenticated attacker to achieve root-level RCE. CVE-2026-10523 (CVSS 9.9) is an authentication bypass letting an unauthenticated attacker create arbitrary administrative accounts and obtain full admin access. CERT-EU recommends updating appliances to fixed versions following Ivanti's guidance.
70
U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog
CISA added two actively exploited PaperCut NG/MF pre-auth flaws to the KEV catalog; federal agencies must patch by September 14.
CISA added CVE-2026-81578 (CVSS 8.8, missing authentication for critical function) and CVE-2026-82078 (CVSS 9.4, unsafe reflection) in PaperCut NG/MF to its Known Exploited Vulnerabilities catalog. Huntress confirmed active pre-authentication RCE exploitation in two customer environments and reproduced the full chain against a clean PaperCut NG 25.0.11 server, chaining the auth bypass into unsafe Java class loading for SYSTEM-level execution. About 47% of roughly 2,500 tracked PaperCut installs still run version 23 or earlier with no patch available, and observed attacker activity was limited to system discovery commands.
72
60
60
60
60
60
60
60
42
47
60
Microsoft May 2026 Patch Tuesday: Many fixes, but no zero-days
60
60
60
60
60
Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience
60
60
60
"Patched" but still exposed: US federal agencies must remediate Cisco flaws (again)
60
60