55
30
45
50
45
Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.
Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.
84
45
60
January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero
60
30
45
60
30
60
SolarWinds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth Bypass
60
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
60
47
60
30
30
CVE-2026-16232: Checkpoint Quantum Security Management auth bypass ...
Attackers exploit Check Point SmartConsole authentication bypass CVE-2026-16232 to take over Quantum Security Management firewall servers; CISA added it to KEV.
CVE-2026-16232 is an authentication bypass (CWE-287) in the SmartConsole login process of Check Point Quantum Security Management, exploitable via an application token. Disclosed July 22, 2026, it was added to CISA's Known Exploited Vulnerabilities catalog the same day with remediation due July 25. Rapid7, Check Point Research and other vendors confirmed exploitation in the wild, and a public PoC was released. A workaround is available, and federal agencies must comply with BOD 26-04 patching guidance.
84
Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
Hunt.io disclosed Operation CameraSwarm, compromising 14,500+ Dahua cameras via credential attacks, auth bypass CVEs, and P2P relay techniques across Ukraine and Russia.
Hunt.io reconstructed a campaign codenamed Operation CameraSwarm that compromised over 14,530 Dahua devices between June 17 and July 22, 2026. Attack paths included credential attacks against 12,324 IPs, exploitation of CVE-2021-33044 and CVE-2021-33045 affecting 1,923 cameras, and P2P relay access to 283 devices behind NAT. The operator, assessed as Russian-speaking, left behind 2,616 files including tooling and campaign logs, with confirmed compromises concentrated in Ukraine and Russia. Dahua advises factory resets and firmware updates; both 2021 CVEs remain in CISA's KEV catalog.
64
30
60
45
CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.
Rapid7 researchers found CVE-2026-86206 (semicolon/Forwarded access-control bypass, CWE-791, CVSSv4 6.9) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass, CWE-305, CVSSv4 7.7) in the latest N-able N-central. Chained, they let a remote unauthenticated attacker create an attacker-controlled System administrator account. The bugs stem from Envoy and Jetty disagreeing on the requested path and whether the client is local. N-able patched both in N-central 2026.3 Hotfix 3, following the earlier CVE-2026-18577 authentication bypass.
62
60
30
45
42
45
45
30
45
ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch
Researcher Chaotic Eclipse published a PoC bypassing Microsoft's CVE-2026-50656 Defender patch, enabling SYSTEM-level code execution on fully patched Windows systems.
Security researcher Chaotic Eclipse released a proof-of-concept for ShieldBreak, a Microsoft Defender zero-day that fully bypasses the patch for CVE-2026-50656 (RoguePlanet), a race condition in the Malware Protection Engine (mpengine.dll) allowing SYSTEM-level code execution. The PoC was tested on Windows 11 25H2 and Windows Server 2025 with a 100% success rate, and Windows 10 is also vulnerable though not supported by the PoC; the flaw may also leak 8 bytes of memory. Microsoft's MSRC had criticized the researcher's repeated uncoordinated disclosures, including YellowKey (BitLocker bypass), GreenPlasma, and LegacyHive (User Profile Service LPE).
58
47
60
60
60
47