Search: “Auth0 AD/LDAP Connector”

CVE-2026-57967: Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

CVE-2026-57967: unauthenticated attackers can hijack authenticated ActiveMQ Artemis sessions via crafted CORE protocol SESSION_REATTACH packets.

An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session on Apache Artemis and ActiveMQ Artemis. Affected versions are artemis-server 2.50.0 through 2.56.0 in Apache Artemis and artemis-server 1.0.0 through 2.44.0 in Apache ActiveMQ Artemis. Apache rates the issue important.

oss-security·Sep 10, 00:46 UTC · 7d agoVulnerability 7 sourcesCVE-2026-579671

Okta Fixes Auth0 and Access Gateway Flaws Enabling XSS, Auth Bypass, and SQL Injection

Okta patched three flaws in Auth0 AD/LDAP Connector and Access Gateway, including a CVSS 9.0 stored XSS tracked as CVE-2026-85982.

Okta disclosed and patched three vulnerabilities on September 8, 2026 affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. CVE-2026-85982 is a CVSS 9.0 stored XSS in the connector's admin panel caused by improper HTML encoding of directory search results and updater logs; CVE-2026-78626 is a CVSS 8.1 authorization bypass in Access Gateway Protected Rules; CVE-2026-78623 is a CVSS 7.7 SQL injection in advanced-mode datastores via unsanitized SAML assertion attributes. Fixes ship in connector version 8.0.0 and Access Gateway 2026.9.1; no exploitation has been reported.

Cyber Security News·updated Sep 11, 09:42 UTC · 5d ago·first Sep 11, 08:13 UTC · 5d agoVulnerability 2 sourcesCVE-2026-85982CVE-2026-78626CVE-2026-786231

Windows 11 KB5124008 update breaks domain trust for some users

Microsoft is investigating Windows 11 KB5124008 breaking Active Directory domain trust, leaving some users unable to log in with valid credentials.

Administrators report the Windows 11 KB5124008 security update breaks the secure channel between domain-joined machines and Active Directory, causing login failures on Windows 11 25H2 systems after reboot. The failures are linked to the Machine Identity Isolation feature, which in enforcement mode moves machine account secrets into Credential Guard and removes the LSA copy; one admin saw 11 of roughly 256 devices affected. Workarounds include setting MachineIdentityIsolation to 0 and repairing the secure channel with Test-ComputerSecureChannel, though Microsoft has confirmed no root cause or official fix and warns disabling the feature can also break domain authentication.

BleepingComputer·updated 00:29 UTC · 3h ago·first Sep 16, 20:39 UTC · 7h agoVulnerability 2 sources

CVE-2026-81866: Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration

Apache NiFi 2.9.0-2.11.0 Connector configuration update and verification APIs skip authorization for referenced Assets and Secrets (CVE-2026-81866, Low).

Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checks on Assets and Secrets referenced in the proposed configuration. Updating or verifying a Connector configuration can apply Asset and Secret references without the caller holding the required privileges. The issue, CVE-2026-81866, is rated Low severity and affects the nifi-web-api component.

oss-security·Sep 16, 15:15 UTC · 12h agoVulnerability 4 sourcesCVE-2026-81866

CISA Warns of Critical ScreenConnect Vulnerability Actively Exploited in Attacks

CISA added actively exploited ConnectWise ScreenConnect flaw CVE-2026-84869 to the KEV catalog, setting a September 14 patch deadline.

CISA added CVE-2026-84869, a critical improper privilege management and missing authorization flaw (CWE-269, CWE-862) in ConnectWise ScreenConnect, to its Known Exploited Vulnerabilities Catalog on September 11, 2026, confirming active exploitation. The flaw lets attackers transfer files to a device and execute them during an active remote ScreenConnect session without authorization or host-user confirmation, enabling payload delivery, unauthorized tools, and persistence while blending into legitimate remote-management traffic. CISA set a September 14 remediation deadline under BOD 26-04 and flagged the vulnerability as requiring forensic triage. ConnectWise has published a security bulletin, and defenders are urged to review exposure, sessions, file-transfer records, and outbound connections.

Cyber Security News·Sep 16, 15:31 UTC · 12h agoExploit / PoC in the wild 4 sourcesCVE-2026-848691

SimpleHelp OpenID Connect Auth Bypass to RCE [CVE-2026-48558]

Metasploit adds a module chaining SimpleHelp OpenID Connect authentication bypass to remote code execution, tracked as CVE-2026-48558.

A commit to the Rapid7 Metasploit Framework (dee04cdb) adds an exploit module for CVE-2026-48558, an OpenID Connect authentication bypass in SimpleHelp that can be escalated to remote code execution. SimpleHelp is widely deployed remote access and remote support software, making the auth bypass a serious exposure for exposed deployments. The commit provides public exploit code but the listing does not state observed exploitation.

Metasploit Framework commits·Sep 1, 20:43 UTC · 15d agoExploit / PoCCVE-2026-485581

2026-010: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway

Citrix patched NetScaler ADC/Gateway: auth bypass CVE-2026-19490 (CVSS 9.3) on Gateway/AAA configs and memory overflow CVE-2026-19489 (CVSS 8.8) requiring SIP ALG.

On 19 August 2026 Citrix published an advisory fixing two critical-severity issues in NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21, plus FIPS/NDcPP builds. CVE-2026-19490 (CVSS 9.3) is an authentication bypass via alternate path, exploitable when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, with a SAML action condition on newer builds. CVE-2026-19489 (CVSS 8.8) is a memory overflow causing unpredictable behaviour or denial of service, requiring SIP ALG enabled on a Large Scale NAT group. CERT-EU recommends applying updated builds as soon as possible.

CERT-EU Advisories·updated Sep 4, 19:00 UTC · 12d ago·first Aug 19, 00:00 UTC · 29d agoVulnerability 3 sourcesCVE-2026-19489CVE-2026-19490

CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass

Apache Airflow FAB provider flaw (CVE-2026-75156) lets attackers bypass Azure AD OAuth token validation via unvalidated issuer and audience claims.

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD id_tokens during OAuth login, enabling cross-tenant authentication bypass. The issue affects deployments where the FAB auth manager is configured with Azure AD as an OAuth provider. A fix is available in version 3.8.1. Severity is rated moderate.

oss-security·Sep 8, 16:37 UTC · 8d agoVulnerabilityCVE-2026-75156

AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance

Huntress maps AD RMS architecture and recon paths, setting up an offline key-extraction attack against its unrotatable 255-year root key.

Huntress's multi-part research examines Active Directory Rights Management Services, Microsoft's enterprise DRM role that still ships in Windows Server 2025 despite migration guidance favoring Azure Information Protection. Part 1 covers the trust model and how an ordinary domain account can locate RMS clusters and read rights-policy templates. Part 2 will detail four independent paths for extracting the Server Licensor Certificate (SLC) private key via service-group membership and the configuration database, enabling fully offline decryption of protected documents. The SLC certificate is valid from 2002 to 2258 and has no key-rotation mechanism, so a stolen key decrypts protected content indefinitely.

Huntress·Sep 8, 04:00 UTC · 8d agoResearch1

Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens

The Hacker News·Aug 5, 08:52 UTC · Aug 5, 2026Phishing & fraud1

TP-Link Tapo Camera Flaw Lets Attackers Gain Admin Access Without Password

Two flaws in TP-Link Tapo C200 cameras allow network-adjacent admin access without a password (CVE-2026-15315) or DoS (CVE-2026-15316); fixed in V5_1.4.6.

OPSWAT Unit 515 researchers discovered CVE-2026-15315, an authentication bypass in the Tapo C200's local HTTPS management interface on port 443, where an alternative verification path accepts a replayed device-generated value, letting unauthenticated network-adjacent attackers establish admin sessions. CVE-2026-15316 causes a denial-of-service crash in the camera's HTTPS service via oversized encrypted Wi-Fi credential data during onboarding. TP-Link confirmed both issues after the April 16, 2026 report and released firmware V5_1.4.6 on August 18, 2026. OPSWAT says additional potentially critical findings remain under coordinated disclosure.

GBHackers·updated Sep 16, 13:27 UTC · 14h ago·first Sep 16, 12:33 UTC · 15h agoVulnerability 3 sourcesCVE-2026-15315CVE-2026-15316

CISA Shares 17 Techniques Used by Hackers to Compromise Active Directory

CISA and five international agencies publish joint guidance detailing 17 techniques attackers use to compromise Microsoft Active Directory environments.

CISA, NSA, and the Australian Signals Directorate's ACSC, with contributions from Canadian, UK, and New Zealand cyber centers, released technical guidance on 17 Active Directory attack techniques. It covers AD Domain Services, AD Certificate Services, and AD Federation Services, including Kerberoasting, DCSync, Golden Ticket, Golden SAML, Skeleton Key, and Shadow Credentials. The guidance recommends treating domain controllers, CAs, AD FS servers, and Entra Connect systems as Tier 0 assets with phishing-resistant MFA, Kerberos pre-authentication enforcement, and disabling NTLM/SMBv1.

Cyber Security News·Sep 15, 16:05 UTC · 1d agoAdvisory

CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway

CVE-2026-19490 is a critical unauthenticated authentication bypass in Citrix NetScaler ADC and Gateway, remotely exploitable without user interaction.

An advisory published August 19, 2026 describes CVE-2026-19490, a critical authentication bypass affecting Citrix NetScaler ADC and NetScaler Gateway. The flaw carries a CVSS v4.0 base score of 9.3 and is remotely exploitable by unauthenticated attackers over the network without user interaction or elevated privileges. NetScaler ADC and Gateway are widely deployed enterprise products positioned at or near the network perimeter, providing load balancing, SSL/TLS offloading, and secure remote access. The text does not state whether exploitation has been observed in the wild.

Rapid7 Blog·Aug 19, 16:46 UTC · 28d agoVulnerabilityCVE-2026-194901

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.

Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.

Wiz Blog·Sep 9, 16:06 UTC · 7d agoExploit / PoC in the wildCVE-2026-59822CVE-2026-598211

Access Control as Verified Parse Constraints

Researchers verify a class of EverParse validators that correctly enforce access-control policies, deploying a machine-checked enforcement gate on seL4.

The paper targets enforcement-code bugs in commercial security gateways by proving that forward-only, backtrack-free EverParse validators are verified recognizers for a bounded finite-state class that includes access-control decision functions with fixed-offset fields and bounded disjunction. Encoding a bounded policy language into a fixed-size byte buffer allows an SMT solver to verify the enforcement code once, covering all byte values, policies, requests, and sessions. Editing rule content over a fixed endpoint set requires no new proof, while adding endpoints reruns the toolchain. A deployment on the seL4 microkernel ensures every request passes through the gate and unverified components cannot corrupt the enforcement chain.

arXiv cs.CR·Sep 11, 06:33 UTC · 5d agoResearch1

Dell Secure Connect Gateway Critical Flaws Allow Unauthenticated Remote Code Execution and Admin Access

Dell patched three critical Secure Connect Gateway flaws (CVE-2026-80172 up to CVSS 9.8) enabling unauthenticated admin access, remote code execution, and host takeover.

Dell Security Advisory DSA-2026-382 fixes three critical vulnerabilities in Secure Connect Gateway (SCG) 5.0, affecting appliances earlier than 5.36.00.16 and applications earlier than 5.36.00.00. CVE-2026-80172 (CVSS 9.8) allows unauthenticated replay of captured requests to obtain ADMIN access due to missing nonce and time validation; CVE-2026-61410 (9.4) enables unauthenticated command execution via missing authorization; CVE-2026-80238 (9.3) involves an exposed Docker socket allowing root access and container escape. Dell urges immediate upgrades and recommends restricting management interfaces to trusted networks and rotating credentials if compromise is suspected.

GBHackers·Sep 8, 12:04 UTC · 8d agoVulnerabilityCVE-2026-80172CVE-2026-61410CVE-2026-80238

Privilege escalation from IIS AppPool to NT Authority/SYSTEM

A write-up demonstrates privilege escalation from an IIS AppPool identity to NT AUTHORITY/SYSTEM via the AD CS RPC endpoint.

A technical write-up details a Windows privilege escalation path that moves an IIS application pool identity to NT AUTHORITY/SYSTEM by abusing the Active Directory Certificate Services RPC endpoint. The technique chains the restricted IIS AppPool service context with AD CS access to reach SYSTEM on the host. The post is relevant for defenders mapping privilege escalation paths on Windows web servers.

Lobsters · security·Aug 31, 12:36 UTC · 16d agoResearch

ZDI-26-534: (Pwn2Own) Microsoft Exchange Capture-Replay Authentication Bypass Vulnerability

Pwn2Own-demoed CVE-2026-62911 capture-replay authentication bypass in Microsoft Exchange allows unauthenticated remote attacks, CVSS 8.1.

ZDI-26-534 describes a capture-replay authentication bypass vulnerability in Microsoft Exchange, demonstrated at Pwn2Own, allowing remote attackers to bypass authentication without credentials. ZDI assigned a CVSS score of 8.1, and the flaw is tracked as CVE-2026-62911. Exchange servers are widely deployed enterprise mail infrastructure.

ZDI Published Advisories·Aug 11, 05:00 UTC · Aug 11, 2026VulnerabilityCVE-2026-62911

THost9 Android RAT Pairs Packed Loader With ADB Worm

Dark Atlas details THost9, a packed Android RAT paired with an ADB worm that installs itself on devices with exposed Android Debug Bridge services.

Dark Atlas researchers described the Hagaseca cluster, whose THost9 packed loader hides executable code in an embedded asset decoded with single-byte XOR and gzip before loading a tc9.dex second stage. The second stage adds shell execution, file transfer, tunneling, reverse shells, downloadable modules and a self-propagating ADB worm that expands single addresses into 65,025-host scan ranges. Newer builds include anti-analysis checks for Frida, and incident reports connect THost9 and THost4 to Android phones and Redroid containers with exposed ADB from October 2024 through 2026.

Infosecurity Magazine·Sep 8, 11:15 UTC · 8d agoMalware in the wild

CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor

MojoX::Authentication before 0.006 for Perl allows SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor (CVE-2026-86304).

CVE-2026-86304 affects MojoX::Authentication versions before 0.006 for Perl. The parse_assertion function builds Net::SAML2::Binding::POST without a trust anchor, so SAML assertions are not validated against a trusted signing key, enabling authentication bypass. The flaw is fixed in version 0.006 of the module.

oss-security·Sep 6, 23:14 UTC · 10d agoVulnerabilityCVE-2026-86304