Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

0day Rubbish discloses two CVSS 9.8 unauthenticated SOAP command-execution flaws: DBxtra .NET 13.1.1.0 and Jitterbit Agent 12.8.1.6 (Docker)

1 source · 2 articlesFirst reported Updated ()3 · 1 read
What's new

Initial merged summary (no prior story): two new 0day disclosures added on 2026-09-08 — DBxtra .NET 13.1.1.0 unauthenticated SOAP to xp_cmdshell code execution (CVSS 9.8, CWE-306) and Jitterbit Agent 12.8.1.6 Docker unauthenticated SOAP with hard-coded credentials to OS command execution (CVSS 9.8). No CVEs assigned and no exploitation evidence reported yet.

Merged summary · glm-5.3-flash · rewritten as coverage arrivesSummaries by Vani AI

On 2026-09-08, the 0day Rubbish Research Team disclosed two separate CVSS 9.8 vulnerabilities involving unauthenticated SOAP interfaces leading to OS command execution: one in DBxtra .NET 13.1.1.0 that abuses SQL Server's xp_cmdshell, and one in the…

The 0day Rubbish Research Team published two concurrent disclosures on 2026-09-08, both rated CVSS 9.8 and both involving unauthenticated SOAP interfaces that lead to operating system command execution. The first affects DBxtra .NET version 13.1.1.0: the flaw is classified as CWE-306 (missing authentication), is reachable via the unauthenticated SOAP API, and abuses SQL Server's xp_cmdshell to run OS commands; the vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no privileges or user interaction are required. The second affects Jitterbit Agent version 12.8.1.6 as distributed in the Docker image jitterbit/agent:12.8.1.6, which ships an unauthenticated SOAP interface protected by hard-coded credentials; attackers who recover these credentials can invoke the SOAP endpoint to execute OS commands. The two disclosures describe different products and different attack mechanics (direct xp_cmdshell abuse versus hard-coded credentials), but both carry the same 9.8 severity and come from the same research team on the same day. Neither report assigns a CVE identifier, and neither reports observed exploitation in the wild.

Key facts
  • DBxtra .NET 13.1.1.0: unauthenticated SOAP API leads to code execution via SQL Server xp_cmdshell (CWE-306, missing authentication)
  • DBxtra .NET 13.1.1.0: rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — no privileges or user interaction required
  • Jitterbit Agent 12.8.1.6 (Docker image jitterbit/agent:12.8.1.6): unauthenticated SOAP interface with hard-coded credentials leads to OS command execution
  • Jitterbit Agent 12.8.1.6: rated CVSS 9.8
  • Both disclosures were published by the 0day Rubbish Research Team on 2026-09-08
  • No CVE identifiers were assigned in either disclosure
  • No exploitation evidence in the wild was reported for either product
  • The two flaws affect different products and use different mechanisms (xp_cmdshell abuse vs. hard-coded credentials); they are presented together because of matching severity, attack surface (unauthenticated SOAP), and simultaneous…
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Coverage

oldest first · one row per article · UTC
  1. · Sep 8, 2026 Full DisclosureFirst report

    [0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8)

    0day Rubbish disclosed an unauthenticated SOAP API flaw in DBxtra .NET 13.1.1.0 enabling xp_cmdshell command execution, rated CVSS 9.8.

  2. · Sep 8, 2026 Full Disclosure

    [0day-rubbish] Jitterbit Agent 12.8.1.6 (Docker jitterbit/agent:12.8.1.6) Unauthenticated SOAP with hard-coded credentials leading to OS command execution (9.8)

    Jitterbit Agent 12.8.1.6's Docker image exposes unauthenticated SOAP with hard-coded credentials, leading to OS command execution (CVSS 9.8).