Search: “access-control”

59 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 20 Exploit / PoC 13 AI safety & security 6 Industry 4 Threat actor 3 Data breach 3 Policy & legal 2 Research 2 Tools 2 AI tools & infra 2 Malware 2 Phishing & fraud 2

SeverityAll critical 21 high 18 medium 6 low 5 info 11

Access Control as Verified Parse Constraints

Researchers verify a class of EverParse validators that correctly enforce access-control policies, deploying a machine-checked enforcement gate on seL4.

The paper targets enforcement-code bugs in commercial security gateways by proving that forward-only, backtrack-free EverParse validators are verified recognizers for a bounded finite-state class that includes access-control decision functions with fixed-offset fields and bounded disjunction. Encoding a bounded policy language into a fixed-size byte buffer allows an SMT solver to verify the enforcement code once, covering all byte values, policies, requests, and sessions. Editing rule content over a fixed endpoint set requires no new proof, while adding endpoints reruns the toolchain. A deployment on the seL4 microkernel ensures every request passes through the gate and unverified components cannot corrupt the enforcement chain.

arXiv cs.CRSep 11, 06:33 UTC · 4d agoResearch

IAM Compliance Requirements and Best Practices

A guide maps IAM compliance requirements across SOX, PCI DSS, HIPAA, ISO 27001 and NIST 800-53, urging verified enforcement over documented policies.

The guide argues IAM compliance requires demonstrating that access controls are enforced at runtime, not merely documented, highlighting gaps between policy intent and application-layer execution. It maps recurring requirements across SOX ITGCs, PCI DSS v4.0, HIPAA, ISO/IEC 27001:2022, NIST SP 800-53 and GDPR, covering least privilege, separation of duties, access certification and audit trails. It recommends continuous, evidence-backed verification and application-layer telemetry instead of relying on identity provider logs or quarterly access reviews.

The Hacker NewsAug 28, 09:06 UTC · 18d agoIndustry

Towards Tackling Application Logic Flaws through Autonomous Formal-Logic Modeling and Automated Reasoning

LL-Verifier combines LLMs with logic model checking to automatically discover logic flaws, uncovering vulnerabilities in 27 IoT access-control protocols.

Researchers present LL-Verifier, a framework that uses LLMs to autonomously convert natural-language protocol descriptions and security goals into formal logic models in a new logic language built on Maude, then applies logic model checking for exhaustive verification. The framework targets application-logic flaws that are tied to business semantics and hard to scale with manual analysis. Evaluation on 27 access-control protocols of widely used IoT devices uncovered a range of sophisticated logic vulnerabilities with security and privacy implications.

arXiv cs.CRSep 9, 17:58 UTC · 6d agoResearch1

Fortinet FortiSandbox Vulnerability Allows Unauthenticated Attackers to Access Sensitive Information

Fortinet fixed CVE-2026-26084, an unauthenticated access-control flaw in FortiSandbox GUI rated 8.9 CVSS, with no known exploitation yet.

Fortinet disclosed CVE-2026-26084 (advisory FG-IR-26-166), a CWE-284 improper access control flaw in the GUI of FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS, rated 8.9 CVSS v3.1. An unauthenticated remote attacker can send specially crafted HTTP requests to control NAT rules and expose sensitive information. Affected versions include FortiSandbox 4.4.0-4.4.8 and 5.0.0-5.0.5 (plus Cloud/PaaS 5.0.4-5.0.5), fixed in 4.4.9 and 5.0.6. Fortinet researcher Adham El Karn found the flaw internally and the September 8 advisory reports no known exploitation.

GBHackersSep 9, 07:15 UTC · 6d agoVulnerability 2 sources CVE-2026-26084

CVE-2026-34908: Ubiquiti Networks UniFi OS Server access control ...

CVE-2026-34908, a CVSS 10.0 access-control bypass in Ubiquiti UniFi OS, was added to CISA's KEV catalog amid reported active exploitation.

CISA added CVE-2026-34908 to the Known Exploited Vulnerabilities catalog on June 23, 2026, with remediation due June 26 under BOD 26-04 guidance. The CVSS 10.0 improper access control flaw (CWE-284) in Ubiquiti UniFi OS allows unauthorized system changes without authentication. Multiple news reports referenced by the page describe the max-severity UniFi flaws being exploited in attacks, and an official patch is available.

Web discovery (articles for new exploits & KEV entries)Sep 8, 06:48 UTC · 7d agoExploit / PoC in the wildCVE-2026-34908

To raise security awareness, researchers spent months hacking mock building systems

CyberScoopJan 15, 11:00 UTC · Jan 15, 2019Exploit / PoC in the wild

Mass Scanning Targets Exposed Vite Servers to Steal AWS Keys and Azure Tokens

Attackers mass-scanned exposed Vite dev servers exploiting CVE-2026-39364 to read .env files and steal AWS keys and Azure tokens, per F5 Labs honeynet data.

Honeynet telemetry recorded 807 session-grouped attacks and roughly 32,000 raw events in August 2026 against exposed Vite development servers. CVE-2026-39364 (CVSS 7.5) is an unauthenticated file-read flaw in Vite 7.1.0 through 7.3.2 and 8.0.5 that bypasses server.fs.deny via query parameters like ?raw and ?import&raw to return files in plaintext. Attackers also probed older Vite flaws CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811, and used wordlists to locate .env files, AWS credential files, Azure token stores, and Terraform state across Linux, container, and web paths. Exposed secrets could enable lateral movement or full cloud account takeover.

GBHackersupdated 11:12 UTC · 11h agofirst 05:35 UTC · 16h agoExploit / PoC in the wild 4 sources CVE-2026-39364 CVE-2025-30208 CVE-2025-31125+1 CVEs

AI workflows may be creating a dangerous new authorization blind spot

Noma Labs researchers describe 'workflow identity hijacking,' letting unauthenticated users trigger privileged AI workflows that execute actions with high-privilege service accounts.

Noma Labs lead researcher Sasi Levi detailed 'workflow identity hijacking,' where benign unauthenticated inputs via support inboxes, GitHub issues, or web forms trigger enterprise AI pipelines that execute privileged actions. The workflow runs using high-privilege service accounts or developer API keys, decoupled from the requester's identity, effectively creating a confused-deputy condition. Unlike prompt injection, the model behaves correctly; the failure lies in authorization enforcement at the workflow layer, and activity blends into routine automation. Mitigations include identity-aware access at execution points and user-context propagation between AI outputs and downstream operations.

CSO Onlineupdated Sep 10, 12:57 UTC · 5d agofirst Sep 10, 12:04 UTC · 5d agoAI safety & security 2 sources

When the prompt becomes the payload: A practical pen-testing guide for GenAI, LLM and RAG applications

CSO Online publishes a practical penetration-testing guide for GenAI, LLM, and RAG applications, covering prompt injection, retrieval poisoning, and tenant isolation testing.

The guide frames LLM applications as attack graphs spanning prompts, retrieval layers, vector stores, tools, identities, and downstream APIs, arguing that conventional web testing misses instruction-vs-data channel risks. It builds on OWASP prompt injection guidance (direct vs. indirect injection) and NIST's 2025 adversarial machine-learning taxonomy, noting that RAG and fine-tuning do not remove injection risk. Recommended practices include documenting trust transitions across components, using canaries and synthetic records to avoid test side effects, running multi-turn and obfuscated injection campaigns, and verifying chains from poisoned documents to observable state changes. It also details testing RAG pipelines via controlled document poisoning across metadata, OCR layers, and code comments, plus cross-tenant isolation checks on retrieved document IDs.

CSO OnlineSep 9, 10:00 UTC · 6d agoAI safety & security1

CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass

Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.

CVE-2026-34486 is a fail-open regression in Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw; Apache rated it Important and NVD scores it 7.5 High. Decryption failures are now forwarded to an unfiltered ObjectInputStream, and public PoC repositories demonstrate unauthenticated RCE on default port 4000 when clustering, the EncryptInterceptor, a reachable receiver and deserialization gadgets are all present. Affected releases 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21; Tomcat 8.5 is unaffected.

Web discovery (articles for new exploits & KEV entries)Sep 8, 20:09 UTC · 7d agoExploit / PoC CVE-2026-34486 CVE-2026-291461

MemSentry: A Framework for Detecting Persistent Memory Poisoning in Agentic AI

MemSentry intercepts persistent-memory writes in agentic AI to catch memory poisoning, reaching 91.7% accuracy with SBERT+LR classification.

Memory poisoning lets adversaries plant crafted content in an agent's long-term memory to suppress security alerts, enable privilege escalation, or override policies without modifying model weights or system prompts. The paper presents MemSentry, a configuration-driven framework that evaluates proposed persistent-memory writes on source trust, semantic risk, attack radius over a dependency DAG, access risk, and a signed security-state delta to issue deterministic Accept, Review, or Quarantine decisions. Across 1,000 GPT-4-generated scenarios on a 20-asset dependency DAG, SBERT+LR achieved 91.7% accuracy and 0.908 macro-F1, all four classifiers detected 100% of external quarantine-class threats, and verified-insider writes are escalated for human review rather than auto-quarantined.

arXiv cs.CRSep 8, 13:40 UTC · 7d agoAI safety & security

FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials

Critical FreeIPA flaw chain (CVE-2026-76578, CVSS 9.8) lets anonymous clients create reusable admin credentials on default installs; fixed in 4.13.4.

Red Hat warns that chaining FreeIPA's CVE-2026-76578 (CVSS 9.8) with a 389 Directory Server flaw (CVE-2026-76560, CVSS 7.5) lets an anonymous client write a Kerberos identity into the directory and land in the administrators group on default installations; Red Hat reproduced the chain twice, including on a machine with no access at all. FreeIPA 4.13.4 fixes both flaws, and fourteen 389-ds advisories shipped September 8, with RHSA-2026:64785 rated critical. A separate flaw, CVE-2026-79678 (CVSS 8.1), allows reading the server's environment variables one at a time via a Python eval() in idp-add, potentially exposing Directory Manager and administrator passwords in container installs. No real-world exploitation has been reported.

The Hacker NewsSep 8, 11:22 UTC · 7d agoVulnerability CVE-2026-76578 CVE-2026-76560 CVE-2026-79678+1 CVEs

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.

Rapid7 researchers found CVE-2026-86206 (semicolon/Forwarded access-control bypass, CWE-791, CVSSv4 6.9) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass, CWE-305, CVSSv4 7.7) in the latest N-able N-central. Chained, they let a remote unauthenticated attacker create an attacker-controlled System administrator account. The bugs stem from Envoy and Jetty disagreeing on the requested path and whether the client is local. N-able patched both in N-central 2026.3 Hotfix 3, following the earlier CVE-2026-18577 authentication bypass.

Rapid7 BlogSep 8, 11:01 UTC · 7d agoVulnerability CVE-2026-86206 CVE-2026-86207 CVE-2026-18577

Condé Nast Data of 32.8 Million Users Offered for Sale After WIRED Leak

A 32.8 million-record Conde Nast user database is offered for $15,000 on a Russian cybercrime forum, extending December's WIRED leak with millions of unseen records.

A database of 32,815,767 Conde Nast user records went on sale on 7 September 2026 for $15,000 on a Russian-language forum, containing names, addresses, birth dates and phone numbers but no passwords or payment data. Ransomnews verified a 5,000-record sample as genuine account data collected between September and late October 2025, with roughly 30.5 million non-WIRED records never previously published. The listing matches the December 2025 WIRED leak of 2,366,576 records, claimed by an actor called 'Lovely' who said 40+ million records were stolen via IDOR and broken access controls. Conde Nast has not confirmed the breach; exposed data enables credible targeted phishing and fraud.

Security AffairsSep 7, 19:40 UTC · 8d agoData breach in the wild

N-able Releases Hotfix for Critical Remote Code Execution Vulnerability

N-able shipped Hotfix 4 patching CVE-2026-86218, a CVSS 10.0 pre-authentication RCE in N-central, with no confirmed production exploitation yet.

CVE-2026-86218 is a critical pre-authentication remote code execution flaw in N-able's N-central remote monitoring and management platform, disclosed September 6 with a maximum CVSS score of 10. It affects N-central versions before 2026.3.1.14 and is patched in N-central 2026.3 Hotfix 4. N-able says it has found no evidence of exploitation in production environments. It is the fifth N-able vulnerability disclosed in weeks, following two KEV-listed authentication bypasses and two internal API bypasses.

Infosecurity MagazineSep 7, 12:45 UTC · 8d agoVulnerability CVE-2026-86218 CVE-2026-18556 CVE-2026-18577+2 CVEs

Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

Cisco patches critical CVE-2026-20212 (CVSS 9.8) in Nexus 9000 switches allowing unauthenticated remote root code execution, plus IOS XR hardening release.

Cisco released fixes for CVE-2026-20212 (CVSS 9.8), a flaw in 10 Silicon One-based Nexus 9000 switch models that binds a service to an unrestricted IP, leaving TCP ports 43210/43211 reachable in the default Layer 3 VRF and allowing unauthenticated remote attackers to execute code as root; exploitation attempts can also crash the S1HAL process. 45 NX-OS releases (10.3(1) through 10.6(3s)) are affected, with mitigations including infrastructure ACLs, the Live Protect shield lp00031, and fixed releases identified via Cisco's Software Checker. Cisco simultaneously issued an IOS XR hardening release bundling 7 umbrella CVEs, two rated 9.8 (CVE-2026-20274 for memory-safety bugs and CVE-2026-20279 for access-control bugs), affecting all releases with SMUs available for 14 releases and upgrades required for 93 of 111 listed releases. No malicious exploitation was reported as of the September 2 disclosure.

The Hacker NewsSep 3, 15:52 UTC · 12d agoVulnerability CVE-2026-20212 CVE-2026-20274 CVE-2026-20279+5 CVEs

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.

Sygnia investigated an intrusion in which Fire Ant expanded beyond VMware hypervisors to Cisco IOS XR routers, TACACS servers and Linux management hosts. The actor deployed purpose-built router implants that hid a GRE tunnel, filtered log messages, captured PCAPs uploaded to external FTP servers, and used TacTap to inject a library into tac_plus and steal TACACS credentials obfuscated with a single-byte XOR key of 0xEF. A Linux backdoor named BridgeAgent masqueraded as a Zabbix agent, persisted via a root systemd unit, disguised itself as /usr/bin/gnome-shell and received commands over TLS on port 443. The group also used Medusa and REPTILE rootkits, SSH backdoors and renamed binaries impersonating SentinelOne and Cybereason agents, while suppressing logs, disabling SELinux and rewriting login history. Sygnia assesses strong overlap with UNC3886 and published IoCs.

The Hacker NewsAug 31, 09:04 UTC · 15d agoThreat actor in the wild1

Critical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers

Critical unauthenticated PHP object injection (CVE-2026-82222) in the GiveWP WordPress donation plugin chains to remote code execution; version 4.16.7.2 fixes it.

Patchstack disclosed CVE-2026-82222 (CVSS 10.0), an unauthenticated PHP object injection in GiveWP versions through 4.16.7.1 that chains through TCPDF and Give\TestData gadget classes to arbitrary OS command execution as the web server user. On versions 4.16.5.1 and below, a default installation with one published donation form is enough to exploit, with no user interaction required. Version 4.16.7.2 blocks unsafe serialized data, hardens the gadget chain and cleans already-stored database records; a separate registration bypass issue remains unresolved.

Security AffairsAug 31, 07:54 UTC · 15d agoVulnerability CVE-2026-82222

Key Reasons Why Identity Fabric Matters in 2026

Identity sprawl and unowned machine identities leave enterprise access unobserved at runtime; identity fabrics aim to close the gap between policy intent and execution.

This sponsored explainer describes identity fabric as an architectural approach connecting identity providers, governance systems, applications, and infrastructure into one observable layer that compares designed access intent with runtime execution. It argues identity sprawl across SaaS, APIs, and cloud workloads, plus unmanaged non-human identities (service accounts, bots, workloads, API keys), leaves overprivileged, dormant, and unowned machine identities unmonitored. IdP-only monitoring misses application-layer attacks, and the piece advocates behavioral visibility and lifecycle governance for secrets and machine identities.

The Hacker NewsAug 28, 11:30 UTC · 18d agoIndustry

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

Red Hat patched critical Keycloak flaw CVE-2026-18963 (CVSS 9.1) allowing unauthenticated attackers to take over any account, including administrative ones.

Keycloak and Red Hat patched CVE-2026-18963, a CVSS 9.1 flaw (CWE-640) caused by improper state validation in the reset-credentials flow, letting an unauthenticated remote attacker force a password reset without the emailed action token and achieve full account takeover, including admin accounts. Upstream Keycloak 26.7.2 and Red Hat Build of Keycloak 26.4.15/26.6.6 contain fixes; four RHSA errata were issued August 18, 2026. No evidence of exploitation or public exploits exists as of August 24, 2026; mitigation is disabling the Forgot Password feature in all realms.

The Hacker NewsAug 24, 11:56 UTC · 22d agoVulnerability CVE-2026-18963 CVE-2026-15571

Google’s AI security agents found 100+ critical software vulnerabilities in just two days

Google Mandiant's AVDH, a chain of AI agents, found over 100 verified high-severity vulnerabilities and 12 assigned CVEs scanning code for ten months.

Google Mandiant disclosed AVDH (Agentic Vulnerability Discovery Harness), an internal pipeline of chained AI agents built on the Agent Development Kit that hunts vulnerabilities in source code. In a live investigation of stolen corporate repositories it verified more than 100 high-severity flaws in two days; over ten months it scanned tens of millions of lines of code and produced tens of thousands of findings, yielding 12 assigned CVEs including CVE-2026-13242 and CVE-2026-55803, with about a dozen more in active disclosure. Human consultants manually reproduce every confirmed finding before it counts.

Help Net SecurityAug 19, 00:00 UTC · 27d agoTools CVE-2026-13242 CVE-2026-558031

GeoServer Zero-Day Is Already Being Probed. That’s the Problem

Unpatched GeoServer zero-day enabling SQL injection and possible RCE is being actively probed across exposed systems.

A zero-day in GeoServer's jsonArrayContains functionality allows unauthorized SQL injection and, in some configurations, remote code execution. Disclosed on August 12, 2026 without a CVE ID, it drew hundreds of exploitation probes from watchTowr within hours. No patch is available yet; GeoServer was previously mass-exploited via CVE-2024-36401.

Security AffairsAug 15, 07:18 UTC · Aug 15, 2026Exploit / PoC in the wildCVE-2024-36401