0day Rubbish discloses two CVSS 9.8 unauthenticated SOAP command-execution flaws: DBxtra .NET 13.1.1.0 and Jitterbit Agent 12.8.1.6 (Docker)

On 2026-09-08, the 0day Rubbish Research Team disclosed two separate CVSS 9.8 vulnerabilities involving unauthenticated SOAP interfaces leading to OS command execution: one in DBxtra .NET 13.1.1.0 that abuses SQL Server's xp_cmdshell, and one in the…

The 0day Rubbish Research Team published two concurrent disclosures on 2026-09-08, both rated CVSS 9.8 and both involving unauthenticated SOAP interfaces that lead to operating system command execution. The first affects DBxtra .NET version 13.1.1.0: the flaw is classified as CWE-306 (missing authentication), is reachable via the unauthenticated SOAP API, and abuses SQL Server's xp_cmdshell to run OS commands; the vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no privileges or user interaction are required. The second affects Jitterbit Agent version 12.8.1.6 as distributed in the Docker image jitterbit/agent:12.8.1.6, which ships an unauthenticated SOAP interface protected by hard-coded credentials; attackers who recover these credentials can invoke the SOAP endpoint to execute OS commands. The two disclosures describe different products and different attack mechanics (direct xp_cmdshell abuse versus hard-coded credentials), but both carry the same 9.8 severity and come from the same research team on the same day. Neither report assigns a CVE identifier, and neither reports observed exploitation in the wild.

• DBxtra .NET 13.1.1.0: unauthenticated SOAP API leads to code execution via SQL Server xp_cmdshell (CWE-306, missing authentication)
• DBxtra .NET 13.1.1.0: rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — no privileges or user interaction required
• Jitterbit Agent 12.8.1.6 (Docker image jitterbit/agent:12.8.1.6): unauthenticated SOAP interface with hard-coded credentials leads to OS command execution
• Jitterbit Agent 12.8.1.6: rated CVSS 9.8
• Both disclosures were published by the 0day Rubbish Research Team on 2026-09-08
• No CVE identifiers were assigned in either disclosure
• No exploitation evidence in the wild was reported for either product
• The two flaws affect different products and use different mechanisms (xp_cmdshell abuse vs. hard-coded credentials); they are presented together because of matching severity, attack surface (unauthenticated SOAP), and simultaneous…