Search: “credential-rotation”

CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration

Apache Syncope CVE-2026-73236 bypasses delegated administration checks for sibling Realms sharing a name prefix.

Apache Syncope disclosed CVE-2026-73236, an important-rated incorrect authorization vulnerability. Delegated administration checks are enforced via Realm hierarchy prefix matches, so two sibling Realms whose names begin with the same string cannot be correctly distinguished, allowing delegated admins to act outside their assigned Realm. The flaw affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to fixed versions.

oss-security·Sep 14, 15:25 UTC · 2d agoVulnerability 3 sourcesCVE-2026-732361

Tycon Systems TPDIN-Monitor-WEB3

CISA reports three flaws (hard-coded credentials, CSRF, missing authorization) in Tycon TPDIN-Monitor-WEB3 <=2.2.9 enabling MitM, credential theft, or device resets.

CISA published ICSA-26-246-08 for Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior, covering CVE-2026-77847 (use of hard-coded credentials, CWE-798), CVE-2026-82712 (CSRF, CWE-352), and CVE-2026-82684 (missing authorization, CWE-862). Exploitation could enable man-in-the-middle attacks, factory resets, credential wiping, or extraction of system credentials, configurations, and flash contents; the CSRF issue scores CVSS 8.8. No public exploitation has been reported; CISA recommends isolating devices from business networks.

CISA Advisories·Sep 3, 12:00 UTC · 13d agoAdvisory 2 sourcesCVE-2026-77847CVE-2026-82712CVE-2026-82684

RightCrowd Pass unifies mobile, physical, and biometric credentials

RightCrowd launched Pass, a credentialing platform unifying mobile, physical, and biometric access credentials, cutting credential revocation from 12.2 minutes to under 60 seconds.

RightCrowd announced Pass, a solution that issues and manages mobile, physical, and biometric access credentials from a single platform instead of fragmented badge programs. Mobile credentials are provisioned through a web-based API and can be suspended or revoked individually or in groups in under 60 seconds, versus an average 12.2 minutes for handling a lost or damaged physical badge. Each mobile credential is tied to a device via two-factor authentication, works with HID, Wavelynx, and LEGIC infrastructure, and counts toward LEED and BREEAM sustainability credits. The product is available now to new and existing customers and can be added to current RightCrowd SmartAccess deployments.

Help Net Security·Aug 26, 00:00 UTC · 21d agoTools

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

Cisco warns of static low-privileged credentials in Secure Firewall Management Center's web interface, letting unauthenticated remote attackers log in and access sensitive data.

Cisco disclosed a vulnerability in the web interface of Secure Firewall Management Center (FMC) Software caused by the presence of static credentials for a low-privileged account. An unauthenticated remote attacker could log in to an affected device using the static account and access sensitive data within impacted systems. The attack surface is reduced when the FMC management interface does not have public internet access.

Cisco Security Advisories·Aug 11, 19:01 UTC · Aug 11, 2026Advisory

Credential Theft: How Attackers Steal & Use Stolen Credentials

Huntress explains how attackers steal credentials through phishing, AitM, infostealers, and dumping, then use them for lateral movement, BEC, and ransomware.

Huntress published an educational overview of credential theft, citing that roughly 70% of confirmed data breaches begin with stolen credentials. It details acquisition methods including phishing, adversary-in-the-middle attacks that capture MFA session tokens, infostealers (nearly a quarter of threats Huntress observed in 2025), Mimikatz-based credential dumping, credential stuffing, and password spraying. The piece then covers post-theft actions such as lateral movement, privilege escalation, account takeover, business email compromise, and ransomware, and closes with behavioral detection guidance and layered prevention strategies.

Huntress·Sep 10, 16:00 UTC · 6d agoResearch

CareCam Pro IP Cameras

CISA advisory details hard-coded bootloader credential CVE-2026-85083 in ANJIA AJL33PC0801 CareCam Pro cameras, allowing physical-access firmware compromise.

CISA ICS advisory ICSA-26-251-01 describes CVE-2026-85083, a hard-coded credential (CWE-798) used for bootloader authentication in the ANJIA AJL33PC0801 CareCam Pro IP camera. An attacker with physical access could gain privileged bootloader access and modify firmware and configuration, potentially fully compromising the device. The flaw scores 6.8 on CVSS 3.1 (7.0 on CVSS 4.0), is not remotely exploitable, and no public exploitation has been reported. Affected firmware is linux_linux_202008261138_svn13796 with U-Boot 2010.06; the vendor is headquartered in China with worldwide deployments.

CISA Advisories·Sep 8, 12:00 UTC · 8d agoAdvisoryCVE-2026-85083

Credential Risk Report

Enzoic's 2026 Credential Risk Report finds 85% of professionals cite compromised credentials as a primary attack path, yet only 19% monitor continuously.

The 2026 Credential Risk Report from Enzoic examines where credential security programs fall short across detection, monitoring, and response. It argues that MFA and point-in-time password screening do not fully address credential exposure. The report advocates shifting from reactive password controls toward a continuous credential defense model with automated remediation.

Help Net Security·Aug 18, 00:00 UTC · 29d agoIndustry

AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key

Huntress research shows AD RMS SLC root key is unrotatable and never expires, so its compromise permanently exposes all RMS-protected documents.

Part 2 of Huntress's AD RMS series details server-side attacks: extracting the Server Licensor Certificate (SLC) private key and performing offline decryption of protected documents. The SLC key has no expiry or rotation mechanism, with a 255-year certificate validity (2002–2258), so whoever recovers it can decrypt every document the deployment ever protected, indefinitely. The author released SharpRMS, a unified tool combining the 2016 DisARMS client-side attacks with new server-side key extraction and decryption capabilities. The research frames the SLC as comparable to KRBTGT and the DPAPI domain backup key, though not equivalent to domain compromise.

Huntress·Sep 10, 04:00 UTC · 6d agoResearch

CVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roles

Apache Syncope CVE-2026-73470 lets delegated users grant roles they do not own via crafted delegations.

Apache Syncope disclosed CVE-2026-73470, an improper privilege management vulnerability rated important. Delegations can be created or updated so that delegated users are able to grant roles they do not own, breaking ownership constraints. The flaw affects syncope-core-provisioning-java in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users are advised to upgrade to the latest fixed releases.

oss-security·Sep 14, 15:29 UTC · 2d agoVulnerabilityCVE-2026-73470

Broken access control in the RADIUS type admin group

FortiWeb RADIUS admin authentication flaw (CVSS 8.8) permits remote GUI/CLI login with random credentials under specific non-default settings.

Fortinet advisory FG-IR-26-158 describes an improper authentication flaw (CWE-287) in FortiWeb's Remote RADIUS-type admin authentication, scored CVSSv3 8.8. When the configuration uses specific non-default settings, a remote unauthenticated attacker can log into the FortiWeb GUI or CLI with a random username and password. The advisory was revised on 2026-08-12 and does not state that exploitation has been observed.

Fortinet PSIRT·Aug 12, 07:00 UTC · Aug 12, 2026Advisory

CVE-2026-75015: Apache Syncope: Nested secrets leak cleartext into audit records readable

Apache Syncope leaks nested secrets in cleartext into audit records readable by unauthorized users; affects 3.0.x, 4.0.x, and 4.1.x versions.

CVE-2026-75015 is an insufficiently protected credentials vulnerability in Apache Syncope where audit events expose nested secrets in cleartext to users able to read those records. Affected component is syncope-core-provisioning-java 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Apache rates the issue moderate severity, and users should upgrade to fixed releases.

oss-security·Sep 14, 15:36 UTC · 2d agoVulnerabilityCVE-2026-75015

CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

Apache Airflow Keycloak provider before 0.10.0 lets any confidential client's credentials in the realm mint an Airflow session JWT.

CVE-2026-76187 affects apache-airflow-providers-keycloak before 0.10.0. The unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so credentials of an unrelated application can obtain an Airflow session JWT. Severity is rated moderate.

oss-security·Sep 15, 19:54 UTC · 1d agoVulnerability 2 sourcesCVE-2026-76187

ZDI-26-645: Fortinet FortiSandbox write_remote_backup_to_crontab cronValue Command Injection Remote Code Execution Vulnerability

ZDI publishes ZDI-26-645 for CVE-2026-84387, an authenticated command injection RCE in Fortinet FortiSandbox via crontab backup, rated CVSS 7.2.

Zero Day Initiative published advisory ZDI-26-645 describing a command injection flaw in Fortinet FortiSandbox's write_remote_backup_to_crontab function. Remote authenticated attackers can execute arbitrary code through the cronValue parameter. ZDI rated the issue CVSS 7.2 and assigned CVE-2026-84387.

ZDI Published Advisories·Sep 9, 05:00 UTC · 7d agoAdvisoryCVE-2026-84387

From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline

Cyble walkthrough maps how infostealer logs move from endpoint infection through aggregation and enrichment to dark web credential marketplace sales.

Cyble breaks the credential theft pipeline into stages: infostealer execution harvesting browser credential stores, cookies, session tokens, crypto wallets, and FTP configurations; aggregation of stealer logs via C2 panels into bundled archives; parsing and enrichment against previously leaked datasets; and final listing on dark web marketplaces. Enrichment adds employer and role context that raises prices and enables credential stuffing across reused passwords. The report advises SOC teams to monitor stealer logs and marketplace chatter early rather than waiting for breach alerts.

Cyble·Sep 10, 10:45 UTC · 6d agoMalware1

Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)

Unit 42 reports actor TheHatman claims large-scale theft of Microsoft Entra credentials and provides mitigation guidance for credential attacks.

Palo Alto Networks Unit 42 published an updated threat brief on mitigating large-scale credential attacks. In August 2026, the actor TheHatman claimed to have stolen a large volume of credentials from organizations' Microsoft Entra tenants. The brief outlines defensive guidance for organizations facing large-scale credential attacks. The theft claims originate from the actor and the post focuses on mitigation steps.

Palo Alto Unit 42·Aug 18, 19:05 UTC · 29d agoThreat actor in the wild

Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data

The Hacker News·Aug 6, 16:41 UTC · Aug 6, 2026Exploit / PoC in the wildCVE-2026-20316CVE-2026-20079

AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance

Huntress maps AD RMS architecture and recon paths, setting up an offline key-extraction attack against its unrotatable 255-year root key.

Huntress's multi-part research examines Active Directory Rights Management Services, Microsoft's enterprise DRM role that still ships in Windows Server 2025 despite migration guidance favoring Azure Information Protection. Part 1 covers the trust model and how an ordinary domain account can locate RMS clusters and read rights-policy templates. Part 2 will detail four independent paths for extracting the Server Licensor Certificate (SLC) private key via service-group membership and the configuration database, enabling fully offline decryption of protected documents. The SLC certificate is valid from 2002 to 2258 and has no key-rotation mechanism, so a stolen key decrypts protected content indefinitely.

Huntress·Sep 8, 04:00 UTC · 8d agoResearch1

Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)

Cisco Talos confirms nation-state (Sandworm) and ransomware (Qilin) actors actively exploit CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center.

CVE-2026-20079 is a critical unauthenticated authentication bypass in the FMC web interface allowing root-level script and command execution via crafted HTTP requests; CVE-2026-20316 stems from static hard-coded credentials enabling unauthenticated logins. Cisco Talos detailed three intrusion clusters: web shell and JAR deployment for credential theft, a Sandworm-attributed reverse shell and credential-harvesting implant, and a suspected Qilin ransomware operator chain. Cisco urges immediate hotfixes ahead of a comprehensive hardening release the week of September 16, or taking the FMC management interface offline.

Help Net Security·updated Sep 14, 09:27 UTC · 2d ago·first Sep 10, 11:22 UTC · 6d agoExploit / PoC in the wild 11 sourcesCVE-2026-20079CVE-2026-20316

Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

Wordfence researchers disclosed a critical unauthenticated authentication bypass in the WPMU DEV Dashboard plugin, enabling admin takeover and possible RCE.

During internal research on August 19, 2026, Wordfence discovered an authentication bypass in the WPMU DEV Dashboard WordPress plugin, which has roughly 350,000 active installations. Unauthenticated attackers can gain administrator access when Hub Single-Sign On is enabled, enabling complete site takeover. If an administrator-writable code mechanism such as the plugin or theme editor is available, the flaw can lead to remote code execution.

Wordfence·Aug 27, 17:41 UTC · 20d agoVulnerability

Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day

Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) is actively exploited for root command execution; CISA added it to KEV.

Cisco disclosed critical zero-day CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway, remotely exploitable without authentication via crafted emails containing malicious SQL statements, leading to arbitrary command execution with root privileges. The flaw affects physical and virtual appliances regardless of configuration and has no workarounds. Cisco PSIRT confirmed active exploitation, and CISA added the CVE to its KEV catalog on September 14 with a federal remediation deadline of September 17. Admins should review mail_logs for suspicious SQL statements such as 'COPY.*TO PROGRAM'.

Security Affairs·updated 13:57 UTC · 6h ago·first Sep 15, 13:00 UTC · 1d agoExploit / PoC in the wild 17 sourcesCVE-2026-764615· 2 reads

Cron Job Injection in Remote Backup

Fortinet FortiSandbox command injection flaw (CVSS 6.7) in remote backup cron jobs lets privileged attackers execute arbitrary code via crafted HTTP requests.

Fortinet advisory FG-IR-26-167 discloses a command injection vulnerability (CWE-77, CVSSv3 6.7) in FortiSandbox's remote backup cron job functionality. A privileged attacker can execute unauthorized code or commands via crafted HTTP requests. The advisory was revised on 2026-09-08.

Fortinet PSIRT·Sep 8, 07:00 UTC · 8d agoAdvisory

Hackers Can Turn Vulnerable LiteLLM AI Gateways Into Root Access and Cloud Credential Theft

Wiz found multiple LiteLLM AI gateway flaws, including a CVE-2026-59822 MCP auth bypass added to CISA KEV, enabling root code execution and cloud credential theft.

An internet scan of 3,074 exposed LiteLLM instances found 294 (9.6%) accepting the default sk-1234 master key and 191 (6.2%) requiring no authentication. CVE-2026-59822 lets a single-character Bearer token establish a valid MCP session via an OAuth2 fallback in versions before 1.84.0; the flaw is in CISA's Known Exploited Vulnerabilities catalog. CVE-2026-59821 allows Python code execution as root in the gateway container via unsanitized Custom Code Guardrails registration before 1.82.0-stable, and CVE-2026-35029 permits config changes leading to RCE and admin takeover. Admin access plus pass-through endpoints can reach cloud metadata services to steal IAM credentials.

GBHackers·Sep 10, 12:56 UTC · 6d agoAI safety & security in the wild 3 sourcesCVE-2026-59822CVE-2026-59821CVE-2026-35029

New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root

cPanel patched CVE-2026-67401, an SQL injection in EmailTrack letting an account with mail privileges run code as root on the server.

cPanel released an advisory on September 8 for CVE-2026-67401, an SQL injection in EmailTrack that allows an authenticated account holder with mail-related privileges to create files and execute code as root. All supported cPanel and WHM release lines (11.110, 11.134, 11.136, 11.138 and WP Squared 11.138.1.9) are affected, with fixed builds published for each. No public exploit or exploitation has been reported and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog. The advisory carries no CVSS score, and the CVE record had not been published as of September 9.

The Hacker News·Sep 9, 08:19 UTC · 7d agoVulnerabilityCVE-2026-67401

CVE-2026-49364: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

Apache Artemis CVE-2026-49364 exposes cluster credentials to network-adjacent peers discovered before authentication completes.

Apache disclosed a pre-authentication credential exposure issue in Apache Artemis and Apache ActiveMQ Artemis, tracked as CVE-2026-49364. Affected components span artemis-core-client and artemis-server from version 1.0.0 (ActiveMQ Artemis) and 2.50.0 (Artemis) through 2.44.0 and 2.56.0 respectively. An unauthenticated network-adjacent attacker can leverage credentials exposed to discovered cluster peers. Apache rates the issue as important.

oss-security·Sep 10, 00:43 UTC · 6d agoVulnerability 7 sourcesCVE-2026-493641

Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain

The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.

The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.

Cyber Security News·Sep 8, 12:10 UTC · 8d agoThreat actor in the wild

Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure

Microsoft links 30+ rotating domains to the MacSync macOS infostealer, confirming active credential and file exfiltration through chunked HTTP PUT uploads.

Microsoft Defender Experts correlated 30+ domains with MacSync Stealer, requiring aligned endpoint and network behaviors (process ancestry, command-line patterns, /curl/, /dynamic?txd=, and /gate?buildtxd= paths, API-key headers, chunked HTTP PUT parameters) to link infrastructure. Execution begins from an interactive zsh session consistent with ClickFix social engineering, with curl retrieving and Base64/gunzip decoding the payload, followed by collection of Keychain data, browser credentials, SSH keys, AWS credentials, Kubernetes configs, and Apple Notes. Data is zipped to /tmp/osalogging.zip, chunked, uploaded via HTTP PUT, and artifacts are deleted afterward; the analysis builds on RST Cloud's May 8 findings and overlaps with Microsoft's earlier 250+ domain ClickFix campaign distributing MacSync and Atomic Stealer (AMOS).

The Hacker News·Aug 19, 06:01 UTC · 28d agoMalware in the wild

CVE-2026-75030: Apache Syncope: Incomplete authorization checks for Group members deprovisioning

Apache Syncope patches missing authorization checks (CVE-2026-75030) in Group members deprovisioning that administrators can abuse.

CVE-2026-75030 is a moderate-severity missing authorization vulnerability in Apache Syncope's Group members deprovisioning logic (syncope-core-idrepo-logic). An administrator with task execution permissions can bypass the incomplete authorization checks. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security·Sep 14, 15:38 UTC · 2d agoVulnerabilityCVE-2026-750301

Why federal cyber defense demands an offense-driven mindset

Opinion piece argues federal agencies should prioritize exploitability and autonomous penetration testing over static CVSS-based patching, citing CISA's BOD 26-04 and NSA's CAPT program.

The author argues that static CVSS-driven patching leaves federal agencies exposed because vulnerable does not equal exploitable, and adversaries chain misconfigurations and stolen credentials instead of burning zero-days. The piece cites CISA's BOD 26-04 and the NSA's Continuous Autonomous Penetration Testing (CAPT) program, which logged 28,282 completed pentests across 822 Defense Industrial Base organizations and closed 71% of critical findings within 30 days. It recommends defining risk by exploitability and mission impact and augmenting human pentesting with autonomous validation and verification.

CyberScoop·Sep 8, 18:30 UTC · 8d agoIndustry