Okta Access Gateway before 2026.10.2 allows admin command execution
CVE-2026-115547 scores 9.1 but needs Admin Console access; Okta reports no active exploitation and no workaround.
1
Stories per day · 30 days
2 RSS
Relatedcontinuous-testing2database2exasol2exploit-db2parasoft2apache-couchdb1cisco1configuration1cwe-781cwe-941default-credentials1deserialization1docker1ids1input-validation1jsp1local-privilege1okta1
18 stories, newest first · one card per story
Stories tagged #command-execution
Snort 3 control socket lets low-privilege local users run commands
Missing socket authentication also allows reading and writing Snort 3 process memory; Cisco has updates and no workaround.
Exasol Database 7.1.30 remote command-execution exploit published
Exploit-DB lists a remote command-execution exploit for version 7.1.30, with no CVE or fix named.
Synametrics Syncrify 6.2 remote command execution exploit published
Exploit-DB lists a remote exploit for command execution against Syncrify 6.2; no CVE or patch is named.
Exploit-DB lists JSP command execution in Parasoft CTP 10.7.5
The remote entry covers Parasoft Continuous Testing Platform 10.7.5 and states no patch or attack status.
Parasoft CTP 10.7.5-SNAPSHOT anonymous deserialization leads to command execution
Researchers say an anonymous database-restore deserialization in the em web app can run commands as uid=1000.
CouchDB before 3.5.3 lets admins run shell commands (CVE-2026-86471)
A CouchDB server admin can execute arbitrary shell commands as the CouchDB OS user; upgrade to 3.5.3.
1
[vim-security] Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178
Vim before 9.2.1178 can run OS commands via R Markdown syntax highlighting; no CVE yet.
USN-8874-1: sg3_utils vulnerability
Ubuntu's USN-8874-1 says sg3_utils may run commands via unsanitized device identification data.
CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed
GitLab patched CVE-2026-90970, letting authenticated Duo users execute commands on self-hosted AI Gateways.
3
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers
GitLab patched CVE-2026-90970, a CVSS 9.9 command-execution flaw in self-hosted AI Gateway.
4
USN-8856-1: Kdenlive, MLT vulnerability
Ubuntu’s USN-8856-1 fixes a Kdenlive flaw letting malicious project files run commands via MLT.
USN-8809-1: libgit2 vulnerability
Ubuntu warns libgit2 mishandles some SSH repository URLs, possibly allowing command execution.
Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access
Zyxel disclosed an active exploitation of a stack-based buffer overflow in its GS1900 switch firmware (CVE-2026-7273), enabling OS command execution.
4
USN-8782-1: Rclone vulnerability
Ubuntu fixed Rclone CVE-2026-49980, where unauthenticated requests to the remote control API can execute arbitrary commands.
CVE-2026-76461: Cisco Email Gateway Flaw Exploited
Cisco confirmed active exploitation of CVE-2026-76461, a critical SQL injection flaw in Secure Email Gateway that enables OS command execution.
2
Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution
Cisco warns CVE-2026-76461 in Secure Email Gateway AsyncOS is actively exploited, letting unauthenticated attackers run root commands via crafted emails.
Payara 7.2026.1.RC1 Remote Code Execution via Server-Side Includes #exec Directive in Payara Server
Payara Server 7.2026.1.RC1 executes arbitrary OS commands when user-controlled Server-Side Includes #exec directives are passed to Runtime.exec without validation.