On November 5, 2026, the OpenSSH project shipped OpenSSH 10.6p2 to close a password authentication bypass in sshd. The flaw, tracked as CVE-2026-123158 and nicknamed “sshhole”, affects Linux systems that use the musl C library with PAM disabled, Alpine Linux being the best-known example. Under the right account configuration, an attacker who knows the name of a password-less account can log in with any password between 257 and 1,024 bytes long, within one SSH connection [1].
Greenbone provides a remote version check and an active check. The version check flags older OpenSSH banners, but Alpine may have backported the fix without changing the advertised OpenSSH version. The active check can confirm the bypass for a username it tests; a negative result does not rule it out. Check the installed Alpine package revision and restart status when assessing exposure.
Start Your Free Trial
Find out which of your servers are exposed: the OPENVAS ENTERPRISE FEED includes a version check and an active check for CVE-2026-123158. Grab a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED to gain the deepest insight into where software vulnerabilities exist in your organization’s IT infrastructure.
Alpine Linux did not move every release to OpenSSH 10.6p2. It fixed older releases by patching the OpenSSH version they already ship. Alpine 3.21, for example, is fixed in package 9.9_p2-r1 and Alpine 3.20 in 9.7_p1-r6 [1]. A server that announces OpenSSH 9.9p2 can therefore be patched or unpatched. The version check flags candidates; the active check sends crafted requests to the SSH service and checks the responses.
Both checks are in the feed. Trigger a manual feed update to get them now.
Who Is Exposed
According to Alpine Linux, a system is exploitable only when all of the following are true:
sshd runs without PAM: the openssh-server package, or openssh-server-pam with UsePAM no.
PasswordAuthentication is set to yes, which is the OpenSSH default.
At least one account has * in its password field. Typical examples are key-only users, directory-service users (nslcd, winbind, sssd) and the alpine user in tiny-cloud images.
At least one other local account has a $5$ or $6$ password hash.
One account with a password hash is enough to make every otherwise SSH-eligible account with a * password field reachable [1]. Systems that are not affected include containers that don’t run sshd, servers with PasswordAuthentication no, openssh-server-pam with UsePAM yes, and accounts locked with ![1]. Distributions built on glibc, such as Red Hat, SUSE, Ubuntu and Debian, are reported as not affected [1].
The official tiny-cloud images from 3.18.11 through 3.24.3 ship an alpine user with a * password and passwordless doas. They are safe on first boot, but once any $6$ hash exists on the machine, for example after an admin sets a console password, an attacker can log in as alpine and use doas to become root [1].
Risk Assessment
CVE-2026-123158 carries a CVSS 3.1 base score of 8.1 (High), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, assigned by the CNA (MITRE) [1]. It is classified as CWE-394: Unexpected Status Code or Return Value.
Exploitation followed disclosure quickly:
CISA KEV: added November 9, 2026, with a remediation deadline of November 12, 2026 for US federal agencies [1].
Honeypot data: the SANS Internet Storm Center recorded the first real exploit attempt on November 5, 2026, the day of disclosure. Attempts with unusually long passwords peaked at 713 on November 6 [1].
Sensor data: Previdian saw its first attempt on November 6, 2026 at 00:05 UTC and counted 22 attempts from 14 IP addresses in 10 countries by November 10 [1].
Public PoC: proof-of-concept code is publicly available [1][2].
Technical Details
The OpenSSH project considers the root cause to lie outside sshd, “but it is exploitable via sshd and can be avoided there” [1]. On musl, the password-hashing function returns * for an over-long password. sshd compares that result with the stored password field, and for an account whose field is *, the two match [1]. OpenSSH 10.6p2 adds a minimum-length check on the stored hash, so the comparison no longer succeeds. The musl maintainers describe the behaviour as “not a bug in musl just an erroneous use by the caller” [1].
The flaw was reported by Özgün Kültekin of Wakefield [1].
Affected Versions and Mitigation
Upstream, the fix is OpenSSH 10.6p2. On Alpine Linux, edge and releases 3.16 through 3.24 are affected, including releases that no longer get regular updates. The fixed openssh packages are [1]:
Alpine branch
Fixed openssh package
edge
10.6_p2-r0
3.24
10.3_p1-r2
3.23
10.2_p1-r1
3.22
10.0_p1-r11
3.21
9.9_p2-r1
3.20
9.7_p1-r6
3.19
9.6_p1-r3
3.18
9.3_p2-r4
3.17
9.1_p1-r7
3.16
9.0_p1-r6
Tiny-cloud images built from the point releases 3.21.10, 3.22.8, 3.23.8, 3.24.4 and later include the fix.
Patch and restart. Run apk upgrade -U -a, then restart sshd. Alpine warns that “upgrading the package alone does not replace the running daemon.”
If you can’t patch yet, set PasswordAuthentication no and restart sshd. Confirm with sshd -T | grep -i passwordauthentication, and test key-based login in a second session before you close the first one.
Check for past compromise. Search /var/log/messages for Accepted password for on accounts that have no password, such as alpine, root or key-only users, and review doas use, new users, new files and authorized keys. If you can’t rule out a login, treat the system as compromised.
SolarWinds Dameware Mini Remote Control < 2026.3.1 Multiple Vulnerabilities: Local registry check
SolarWinds Dameware Remote Support < 2026.3.1 Multiple Vulnerabilities: Local registry check
New Checks This Week
Between November 5 and November 11, 2026, the feed team shipped 120 new product checks covering 267 CVEs from 30 vendors. These are the ones to look at first.
CVE-2026-111560 is an OS command injection in the timezone configuration field of several Barracuda appliances. An authenticated administrator can inject commands that run as root. CVSS 4.0 base score 8.6, assigned by the CNA (Mandiant) [1]. Barracuda says it has “identified exploitation activity affecting a small number of organizations” [1], and CISA added the CVE to KEV on November 10, 2026 [1].
The flaw affects Email Security Gateway (ESG), Load Balancer ADC, Web Application Firewall (WAF), Web Security Gateway (WSG), Message Archiver (BMA) and WAF Control Center (WCC). On ESG it can be chained with CVE-2026-116606, an authorization bypass, to gain root on the device. Barracuda lists a patch per product and recommends restricting administrative interfaces to trusted internal networks [1].
Checks for CVE-2026-111560:
Barracuda Email Security Gateway <= 9.4.0.027 OS Command Injection Vulnerability: Version check
Barracuda Web Application Firewall <= 12.3.0.011 Command Injection Vulnerability: Version check
Barracuda Load Balancer <= 6.6.0.009 OS Command Injection Vulnerability: Version check
More Critical Flaws With New Checks
The four critical CVEs with new checks this week, each shown with its CVSS severity band and EPSS exploitation-probability score
JetBrains Hub: privilege escalation by changing email authentication details during verification [CWE-915], fixed in 2026.2.52556 [1]. Check: Version check
Sonatype Nexus Repository 3: disabled or locked users can sign in again through SAML or OIDC single sign-on [CWE-1390]; affects Nexus Repository 3 Pro versions 3.86.0 through 3.97.x, fixed in 3.98.0 [1]. Check: Version check
OpenNMS: unauthenticated REST API access through non-canonical HTTP method names [CWE-862], fixed in Horizon 36.0.5 and Meridian 2024.3.14, 2025.0.11 and 2026.0.1 [1]. Check: Version check
Summary
sshhole turns a convenience setting, password authentication left on next to key-only accounts, into a way in for anyone who knows a username. It is in CISA’s KEV catalog, honeypots saw exploit attempts on the day of disclosure, and a public PoC is available. Patch to OpenSSH 10.6p2 or the fixed Alpine package, restart sshd, and check your logs for logins you can’t explain. Because Alpine fixed older releases without changing their OpenSSH version number, run the active check as well as the version check to see which servers are still exposed.
Start Your Free Trial
Find out which of your servers are exposed: the OPENVAS ENTERPRISE FEED includes a version check and an active check for CVE-2026-123158. Grab a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED to gain the deepest insight into where software vulnerabilities exist in your organization’s IT infrastructure.
Two newly exploited vulnerabilities lead this week’s security wrap-up: a flaw in the widely used Brotli decoder and a Cisco firewall issue affecting remote access VPNs. The OPENVAS ENTERPRISE FEED already includes checks for both, plus a new Sophos UTM check and broader product-specific PHP2Shell coverage. These updates help security teams find affected assets across software, network devices, and operating system packages. In three of this week’s cases, though, the software version alone does not tell you whether a system is exposed. That depends on how the product is configured, so a scan finding starts the review rather than ending it.
Brotli Coverage Spans Software and Appliances
CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder. Software that decompresses attacker-controlled Brotli data may crash, disclose memory, or potentially allow code execution. Google, the CVE Numbering Authority for the flaw, rates the issue 9.2 on CVSS 4.0, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 27 October. Affected are Brotli versions 1.0.3 up to but not including 1.0.10, 1.1.0 up to but not including 1.1.1, and 1.2.0 up to but not including 1.2.1; the fixed versions are 1.0.10, 1.1.1 and 1.2.1.
Greenbone added checks for Node.js on Linux, macOS, and Windows, plus a PAN-OS check. Package coverage continued to grow on 2 November, when 19 newly generated distribution advisory checks included this CVE. That breadth matters because a shared component can surface in several products and update channels. As of 3 November, the OPENVAS ENTERPRISE FEED lists 82 checks for CVE-2026-111497, including:
Node.js 22.x, 24.x and 26.x:Linux (package-level), macOS (executable version) and Windows (registry)
76 distribution advisory checks (package-level) for AlmaLinux, Amazon Linux, Debian, Fedora, Oracle Linux, Red Hat Enterprise Linux, Rocky Linux, SUSE, openSUSE, Slackware, Ubuntu and openEuler
For PAN-OS, exposure depends on Brotli inspection and TLS decryption settings, so teams should confirm configuration as well as software version. According to Palo Alto Networks, among PAN-OS devices, only PA-Series and VM-Series firewalls that inspect Brotli-compressed traffic with TLS/SSL decryption enabled are exposed. The management interface is not affected, and neither are PAN-OS 11.1 and 10.2. The CLI command show system setting brotli shows whether Brotli inspection is enabled. Fixed hotfixes are available for PAN-OS 11.2, 12.1 and 12.2; until they are installed, set system setting brotli-encoding disable turns Brotli inspection off.
CVE-2026-76418 can let an unauthenticated attacker cause an affected Cisco ASA or FTD device to reload through its remote access SSL VPN service. Cisco reports active exploitation and rates the issue 8.6 on CVSS 3.1. CISA added it to KEV on 29 October, and CERT-FR also reports the flaw as actively exploited.
Greenbone added separate checks for ASA (remote banner) and FTD (package-level) on the same day.
The vulnerable path requires a reachable SSL VPN service and secondary authentication configured on the affected tunnel group. Cisco points out two details that are easy to miss: the default tunnel group DefaultWEBVPNGroup counts too, and an attacker does not need a successful VPN login to reach the affected code. Teams using that configuration should review Cisco’s fixed releases and prioritize affected devices. Both Greenbone checks report vulnerable releases; where the SSL VPN and secondary authentication setup is not in place, the checks advise creating an override for the result.
The first fixed releases are:
ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1
FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1
Cisco states that no workaround addresses the vulnerability. Removing secondary authentication from the affected tunnel groups is a temporary mitigation, and Cisco strongly recommends upgrading to a fixed release.
Sophos UTM Needs a Manual Patch Review
A new Greenbone check (remote banner, added 30 October) also covers CVE-2026-118633 in Sophos UTM. Sophos describes a critical, unauthenticated path to root-level command execution when its email proxy is used with scanning enabled and an attacker wins a race condition. The underlying flaw is a path traversal, and all UTM versions are affected. UTM is end of life, and Sophos says the patch must be installed manually. The instructions are in knowledge base article KBA-000049692; the alternative is moving to a supported version of Sophos Firewall. The check identifies deployments that warrant review; administrators should confirm the email proxy configuration and patch status directly. Once the hotfix is installed, the check advises creating an override for the result.
Since Last Week: PHP2Shell Coverage Continues to Broaden
Greenbone has already published detailed PHP2Shell detection and scanning guidance. Since then, CISA has added both vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to KEV on 26 October. Recent feed additions extend the product-specific checks for both CVEs to further infrastructure products, including:
Keep the OPENVAS ENTERPRISE FEED current, scan the relevant assets, and use the results with vendor guidance to plan updates. For this week’s items:
Trigger a manual feed update to get the new checks now.
Scan the assets that run Node.js, PAN-OS, Cisco ASA or FTD, Sophos UTM and PHP, including the operating system packages that bundle Brotli.
For every PAN-OS, Cisco and Sophos finding, compare the configuration with the conditions above before you set the priority. Where a condition is not met, or a hotfix is already installed, create an override for the result.
These checks identify potentially vulnerable versions or packages; a finding does not establish that an asset has been exploited.
At it-sa 2026 in Nuremberg, AI security came up in many of the conversations at our stand. Visitors weren’t asking for another chatbot to answer their questions. They wanted to know what AI can do for them in practice: what they would have to do, how, and how much effort it takes, how AI can help steer their tools and fix what the scan finds, and whether all of it can run on-premises.
Many attacks now begin before a fix even exists. Google’s Mandiant puts the mean time to exploit in 2025 at an estimated minus seven days: “exploitation is routinely occurring before a patch is even released” (M-Trends 2026). For the sixth year in a row, exploits were the most common way in. In June, Germany’s Federal Office for Information Security (BSI) warned that AI “substantially lowers the effort, time and entry barriers for offensive cyber capabilities” (BSI, in German; our translation).
Our answer is a specific kind of AI security. We use AI once, at the source, to build deterministic vulnerability tests. Those tests run inside your network and give the same answer every time, and your vulnerability data doesn’t have to leave your infrastructure.
PHP2Shell: Attackers Didn’t Wait, and Neither Did We
On October 17, Amazon’s honeypots logged an exploitation attempt against two critical flaws in PHP (AWS). The flaws, CVE-2026-109618 and CVE-2026-109619, both have a CVSS 4.0 score of 9.2 and can allow remote code execution over HTTP without a login (our PHP2Shell post). PHP published fixes four days later, on October 21 at 14:00 UTC.
By the morning of October 21, hours before the fix, the OPENVAS ENTERPRISE FEED already had version checks for both flaws.
A day later, the feed had package-level checks for ten Linux distributions, and by October 26 for thirteen (our PHP2Shell post).
Attacks Got Cheap and Chained
Speed is only half of it. In November 2025, Anthropic described a cyber espionage campaign in which the attackers used AI “to execute 80-90% of tactical operations independently” (Anthropic). People stepped in at a few points, for example to approve the move from reconnaissance to active exploitation. Stringing many small steps together used to be the expensive part of an attack. As far as we can tell today, it isn’t anymore.
The same report has a detail that matters for defenders: the AI “frequently overstated findings and occasionally fabricated data”, including login credentials that turned out not to work. Keep that in mind for later.
Two Approaches to AI Security
Most cybersecurity AI on the market answers with more AI on the defender’s side. While this is technically impressive and enables real-time threat detection and automated responses while reducing human error, it is also usually achieved by utilizing models that run in large US clouds.
Before you sign up for that, ask three questions:
Where does my vulnerability data go? It’s a map of every weak spot in your network.
Who controls the model, and what changes with the next release?
Who decides when a production system gets changed?
The other approach does one job very well and leaves the rest to you. That’s the one we take.
Where AI Belongs in Vulnerability Management: At the Source
Based on what we know today, AI scales best in one place: building our tests, once per vulnerability. Our security researchers use a combination of expert-guided AI, lab analysis and static automation to ensure high quality and rapid delivery. The finished test then runs on every system without any additional AI cost.
So why not let AI judge your systems directly? For one, the results vary. Thinking Machines Lab sent the same prompt to a language model 1,000 times at temperature 0, the setting meant to give the same answer every time, and got 80 different completions (Thinking Machines Lab). AI findings also need checking. The vulnerability intelligence vendor VulnCheck compared severity ratings for findings from Anthropic’s Glasswing project that have both an AI and a maintainer rating: the AI rated 91.5% of them critical or high, the maintainers only 51.3% (VulnCheck). Think back to the credentials that didn’t work.
Where Deterministic Tests Beat AI
A deterministic test gives the same result on the same system, which makes it evidence. The NIS2 implementing regulation, for example, asks certain digital infrastructure and ICT service providers to “perform, where appropriate, vulnerability scans, and record evidence of the results of the scans, at planned intervals” (Implementing Regulation (EU) 2024/2690, Annex 6.10.2(b)). An answer that changes from run to run is hard to file as evidence.
Our tests run authenticated on the host, where they see installed versions and configuration, and across the network, where reachability between systems shows possible attack paths. You can also look inside. The OPENVAS scanner is licensed under the GPL (GitHub) and the management daemon under the AGPL (GitHub). The vulnerability tests in our Community Feed are open source as well. That way, sovereignty isn’t something you have to take on trust.
AI Security Also Means Securing Your Own AI
AI security cuts both ways. Departments are putting AI agents and MCP servers into production, often faster than any central inventory can keep up with. Many of these are home-grown, which makes them hard for any scanner to fingerprint reliably. Where AI tools ship as established products, they get vulnerability tests like any other software.
Your Stack, Your Choice
Greenbone focuses on what we do best: finding vulnerabilities and telling you what to do about them. Fixing them is a different job, and automating it carries risks of its own. When AWS logged the exploitation attempt, no patch existed yet. In a situation like that, an automatic remediation tool has few options left, and one of them is shutting down services your business depends on. Good prioritisation also needs something no scanner knows on its own: which of your systems matter most.
So the decision stays with you. You can keep remediation fully manual, or connect the remediation tools you already trust. We don’t lock you into one.
MCP integration is on our roadmap. Through it, you will be able to connect the patch management and AI tools of your choice, and decide which model gets to see your data.
Open source has always worked this way: one tool does one job, and you combine the tools you trust. We see no reason AI security should work differently.
Same Speed. Your Control.
AI makes attacks cheap and chained. Defense needs AI at the same speed, inside your own infrastructure and under your own control. That’s the AI security we build.
Want to talk through what AI security looks like inside your own infrastructure? Get in touch with us.
https://www.greenbone.net/wp-content/uploads/greenbone-logo-2025.png00Greenbone AGhttps://www.greenbone.net/wp-content/uploads/greenbone-logo-2025.pngGreenbone AG2026-11-04 12:59:452026-11-04 12:59:46AI Security Without Losing Control: Deterministic Tests at AI Speed
This post was last updated on November 11th 2026 at 12:11 UTC.
PHP has released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell by researchers. Every supported PHP installation should be updated immediately. According to PHP, both flaws can allow unauthenticated remote code execution, and the PHP security team rates both at CVSS v4.0 9.2. The fixed releases, published on October 21, 2026, are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older have reached end of life and no longer receive official updates, although PHP’s security team has published minimal source backports for PHP 7.4, 8.0 and 8.1. Exploitation attempts have already started: Amazon reports attempts against its honeypots since October 17, four days before disclosure, and public proofs of concept are circulating. CISA added both CVEs to its KEV catalog on October 26, 2026 (CVE-2026-109618, CVE-2026-109619). A previous critical PHP flaw, CVE-2024-4577, drew exploit attempts within a day; this time they came before the fix.
Updating the supported branches is the easy part. The harder part is finding every PHP installation in your network, including the ones you can’t see from the outside and the ones the PHP project no longer updates. CERT-EU and Germany’s BSI have issued advisories for both vulnerabilities [1][2].
Run an authenticated remote scan, i.e. with credentials stored for the target (instructions). An unauthenticated scan only reads remote information such as banners, which do not always allow conclusions about the version. For unauthenticated scans, set the QoD (Quality of Detection) filter in the results to 0.
If remote scans are not permitted in your environment, you can use the Greenbone Agent (instructions). Note: the agent is currently a Technology Preview.
For Linux systems, use the “Full and fast” scan config unchanged. It checks installed packages and also searches the file system for PHP executables (php, php-cli, php5, php7, php8). It does not search for php-cgi and php-fpm. For self-compiled applications, or where PHP is bundled as middleware, further checks are required. Please note that scans of running containers are not available.
For Windows systems, enable portable app detection before scanning:
Clone the “Full and fast” scan config and search for “Options for Local Security Checks” in the search bar.
Set “Enable Detection of Portable Apps on Windows” to “yes” and save.
Optional: Check whether a version was determined for every PHP software found. Without a version, it cannot be matched against the vulnerability. If PHP was only detected generically without a version, assume that the system may be affected. To find these systems: (1) Open “Results”. (2) Enable the log entries. (3) Search for name~"CPE Inventory" and ~php and not ~"php:php:". (4) The potentially affected host names and IP addresses are displayed. Clicking the blue “CPE Inventory” shows further software and the operating system detected on the same system. We have tested this filter, and it works. Whether it catches every case in every environment is something we can neither test nor confirm. If only a banner was detected and no authenticated scan ran, or it failed, admins should search the entire file system of these systems for PHP executables and confirm their versions.
Make sure the feed is current. A manual feed update gets you the PHP2Shell checks immediately, otherwise they arrive with the automatic NVT feed update set up in your environment.
Quicker option: We provide two ready-made scan configs, one for Linux and one for Windows, that are limited to the PHP2Shell checks (download, how to import a scan config). Use them with credentials as described in step 1: SSH credentials for Linux, SMB credentials for Windows. In the Windows config, portable app detection is already enabled. The tests these configs need are part of the free COMMUNITY FEED, so the configs work with it too. The steps above remain valid.
PHP currently supports four branches: 8.2 and 8.3 receive security fixes only, while 8.4 and 8.5 are in active support. Security support for PHP 8.2 ends on December 31, 2026. Every older branch is end of life: PHP 8.1 since December 31, 2025, PHP 8.0 since November 26, 2023, PHP 7.4 since November 28, 2022, and PHP 5.6 since December 31, 2018. PHP’s advisories list every version below 8.2.35 as affected [3][4]. For end-of-life branches, PHP points to distributions and LTS vendors that provide backported fixes, and its security team has published minimal source backports for PHP 7.4, PHP 8.0 and PHP 8.1 for people who build from source. Older branches such as PHP 5.6 get neither. Before you can fix these systems, you have to know where they run.
There is a lot of old PHP on the internet. According to Mallory’s count of Shodan banners on October 20, 2026, around 884,000 internet-facing hosts advertise an end-of-life PHP version, 59% of the roughly 1.5 million hosts that show a version at all. Another 740,000 or so don’t reveal their version. These are banner counts, not confirmed vulnerable systems.
Information about both vulnerabilities leaked before the planned coordinated disclosure [5]. Amazon, which saw a first attempt on October 17, and watchTowr report exploitation attempts against both vulnerabilities. New Zealand’s NCSC says it is aware of reports of active exploitation. On October 26, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-109618, CVE-2026-109619. The BSI warning of October 22, 2026, reports no confirmed exploitation. The flaws are exploitable in practice, though: PHP’s advisory states that unauthenticated remote code execution was validated over HTTP against mod_php with default input and memory limits.
Since November 11, 2026, Greenbone’s generic PHP version checks for CVE-2026-109618 and CVE-2026-109619 on Linux and Windows are part of the free COMMUNITY FEED. On Linux, the check searches the file system for PHP binaries; on Windows, it looks for PHP .exe files, which requires portable app detection to be enabled in the scan config. Both determine the PHP version and compare it with the fixed releases. The COMMUNITY FEED also includes package-level checks for Debian, Ubuntu, Fedora, Slackware, SUSE, openSUSE, Mageia and openEuler. To use them, update your feed and run an authenticated scan with SSH credentials for Linux and SMB credentials for Windows. The ready-made scan configs work with the COMMUNITY FEED too, since the tests they need are now part of it; the “Full and fast” scan config includes all of the package-level checks listed above. Beyond these checks, the OPENVAS ENTERPRISE FEED adds package-level checks for enterprise Linux distributions and product-specific PHP2Shell checks for software that ships its own PHP, such as control panels, firewalls and appliances.
Check Your Network for PHP2Shell With Greenbone
In addition to the COMMUNITY FEED checks described above, the OPENVAS ENTERPRISE FEED adds package-level checks for enterprise Linux distributions (Red Hat, AlmaLinux, Rocky Linux, Oracle Linux, Amazon Linux, Arch and Huawei Cloud EulerOS) and product-specific PHP2Shell checks for software that ships PHP: cPanel/WHM, Plesk, Cisco Expressway, Citrix NetScaler ADC and NetScaler Gateway, F5 BIG-IP, Palo Alto Networks PAN-OS, QNAP QTS, QuTS hero and QuTScloud, IBM QRadar SIEM, Trend Micro Apex Central, Apex One and Deep Discovery Inspector, OPNsense, pfSense, Coolify, Juniper Networks Junos OS, Check Point Gaia, Aruba ClearPass Policy Manager, NetApp ONTAP 9, Symantec Endpoint Protection Manager, Quest KACE Systems Deployment Appliance and Systems Management Appliance, Mitel MiVoice Connect, Western Digital My Cloud, Unraid OS and Mailcow. See all PHP2Shell checks on SecInfo. To get the new checks right away, trigger a feed update manually. Otherwise, they arrive with the automatic NVT feed update set up in your environment. OPENVAS SCAN includes a free two-week trial of the ENTERPRISE FEED, with over 250,000 vulnerability tests and counting.
The Technical Details for CVE-2026-109618 and CVE-2026-109619 in PHP
PHP considers all PHP installations serving web requests at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs. Both advisories list use-after-free [CWE-416] among the weaknesses, and the ChangeLog records both under a single fix in PHP’s core (“Avoid state corruption via bailout”).
The two CVEs fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, each shown with its CVSS severity band and EPSS exploitation-probability score
RCE via OOM corruption (GHSA-w8hw-w9fx-j79w): when PHP runs out of memory while internal request data is only partially initialized, request cleanup can treat the invalid data as valid.
RCE via stale global state (GHSA-6wmf-4rv5-p3rp): internal state owned by one request can survive in a persistent worker after its memory has been freed, and a later request handled by the same worker can use it.
PHP’s advisories have the full technical details [6][7].
Affected Versions and Mitigation for CVE-2026-109618 and CVE-2026-109619 in PHP
Update every supported PHP installation to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you run an end-of-life branch, upgrade to a supported one. Since security support for PHP 8.2 ends on December 31, 2026, PHP 8.4 or 8.5 is the better target. If you can’t upgrade yet, check whether your distribution or LTS vendor provides a backported fix, or build from PHP’s source backports for 7.4, 8.0 and 8.1.
A side note for Windows: on October 26, PHP released rebuilt Windows packages, 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. They include Brotli 1.2.1 and fix CVE-2026-111497, a flaw in Brotli decompression. In PHP’s Windows builds, the flaw can be reached through the cURL extension when automatic HTTP response decompression is enabled; cURL disables this by default, but applications and HTTP client libraries can enable it. The -1 packages contain the Brotli fix but keep the same PHP runtime version as the original packages, so a PHP version check cannot tell them apart. If you installed one of the October 21 fixed Windows packages before the rebuild, replace it with the corresponding -1 package. Read more about CVE-2026-111497 in our post on the Brotli vulnerability.
If you can’t update immediately, PHP lists configuration changes that reduce exposure to specific attack paths, for example enforcing memory_limit=-1 against CVE-2026-109618 and setting session.upload_progress.enabled=0 against CVE-2026-109619. PHP is clear that these measures do not make an installation safe and that updating is the only complete fix. The session setting blocks individual attack paths, but not all of them. In particular, it does not protect against CVE-2026-109618. Against CVE-2026-109619, it only takes effect if it is set administratively on the server and every worker is restarted afterwards; setting it with ini_set() in the application comes too late. Treat configuration changes as an additional measure at most, never as a replacement for the update. On October 23, PHP also suggested setting session.upload_progress.enabled=0 until its next regular bugfix release, to close a separate, unlikely remote code execution path, CVE-2026-115560. It only occurs when an application switches the session serializer at runtime with ini_set() while upload progress is enabled. PHP will publish a full advisory with that release. The OPENVAS ENTERPRISE FEED includes version-based checks for CVE-2026-115560. CERT-EU additionally recommends isolating internet-facing applications from public networks until the fix is applied. CISA goes further: organizations that cannot update immediately, or that still run PHP 8.1 or older, should take PHP-based systems offline until they are patched or upgraded.
Linux distributions sometimes backport fixes to their own PHP packages without changing the version number. PHP says distributions and LTS vendors received the patches in advance, so check your vendor for updated packages. Debian, Red Hat and Ubuntu have already published fixed packages, including for branches PHP no longer supports, such as PHP 7.4 and 8.0 on Red Hat Enterprise Linux 8 and 9 [8][9][10][11]. For PHP bundled with control panels, content management systems or appliances, check with the respective vendor. The Dutch NCSC keeps a list of products that include PHP and may be affected, which it is still expanding. Several vendors have already responded: cPanel has fixed its PHP packages, including backports for PHP 7.4, 8.0 and 8.1, and Plesk has published fixed PHP builds and an update for its own management interface. Palo Alto Networks has since released hotfixes for PAN-OS, according to the timeline and FAQ of its advisory. The advisory’s solution section still refers to fixes in upcoming releases, so check the version table there before you update. Palo Alto also reports that it has observed active exploitation targeting the PAN-OS management interface exposed to the internet, and advises restricting access to that interface to trusted internal IP addresses. Industrial vendors have published advisories as well: Siemens lists affected products such as Spectrum Power and AMIS TS, some of them without a fix so far, and Phoenix Contact plans firmware updates for affected network devices in November and December, while three of its product families will not get a fix. Web applications such as WordPress, Drupal and Nextcloud run on the PHP installed beneath them, so updating that PHP fixes them.
PHP branch
Status
Fixed version
Notes
8.5
Active support until December 31, 2027
8.5.12
8.4
Active support until December 31, 2026
8.4.27
8.3
Security fixes only until December 31, 2027
8.3.36
8.2
Security fixes only until December 31, 2026
8.2.35
Upgrade to 8.4 or 8.5 recommended
8.1 and older
End of life
No official release
Listed as affected. Minimal source backports for 7.4, 8.0 and 8.1; check your distribution or LTS vendor for backported packages
Recommendations for Your Security Team
Use the scans from the scan instructions to identify as many PHP installations as possible, and patch wherever you can.
Not every PHP instance can be patched, for example appliances or PHP as middleware in a software bundle. Shut down internet-facing systems. If that is not possible, at least isolate and monitor them.
Run PHP services behind an enabled IDS/IPS and check whether PHP2Shell signatures are present.
If a PHP-based service can be taken offline temporarily, do so. If it has to stay online, apply the measures above and also assess the risk: which data would be affected if it were compromised? Security monitoring, for example with an EDR solution, is then required. Don’t rely on it alone: check whether your EDR has signatures for PHP2Shell, because variants can slip through. One hunting approach is to look for a shell started as a subprocess of PHP.
Expect more public proofs of concept. In tests, the best confirmed proof of concept so far does not work in every environment, and it is still unclear which variant works against which configuration.
With the patch and the detection we have published, you are well prepared. We cannot guarantee, however, that a new variant won’t change the picture.
How to Find Vulnerable PHP Installations With Greenbone
Run an authenticated remote scan, i.e. with credentials stored for the target (instructions). An unauthenticated scan only reads remote information such as banners, which do not always allow conclusions about the version. For unauthenticated scans, set the QoD (Quality of Detection) filter in the results to 0.
If remote scans are not permitted in your environment, you can use the Greenbone Agent (instructions). Note: the agent is currently a Technology Preview.
For Linux systems, use the “Full and fast” scan config unchanged. It checks installed packages and also searches the file system for PHP executables (php, php-cli, php5, php7, php8). It does not search for php-cgi and php-fpm. For self-compiled applications, or where PHP is bundled as middleware, further checks are required. Please note that scans of running containers are not available.
For Windows systems, enable portable app detection before scanning:
Clone the “Full and fast” scan config and search for “Options for Local Security Checks” in the search bar.
Set “Enable Detection of Portable Apps on Windows” to “yes” and save.
Optional: Check whether a version was determined for every PHP software found. Without a version, it cannot be matched against the vulnerability. If PHP was only detected generically without a version, assume that the system may be affected. To find these systems: (1) Open “Results”. (2) Enable the log entries. (3) Search for name~"CPE Inventory" and ~php and not ~"php:php:". (4) The potentially affected host names and IP addresses are displayed. Clicking the blue “CPE Inventory” shows further software and the operating system detected on the same system. We have tested this filter, and it works. Whether it catches every case in every environment is something we can neither test nor confirm. If only a banner was detected and no authenticated scan ran, or it failed, admins should search the entire file system of these systems for PHP executables and confirm their versions.
Make sure the feed is current. A manual feed update gets you the PHP2Shell checks immediately, otherwise they arrive with the automatic NVT feed update set up in your environment.
Quicker option: We provide two ready-made scan configs, one for Linux and one for Windows, that are limited to the PHP2Shell checks (download, how to import a scan config). Use them with credentials as described in step 1: SSH credentials for Linux, SMB credentials for Windows. In the Windows config, portable app detection is already enabled. The tests these configs need are part of the free COMMUNITY FEED, so the configs work with it too. The steps above remain valid.
The checks for CVE-2026-109618 and CVE-2026-109619 work in unauthenticated and authenticated scans, but the two see different things. An unauthenticated scan only sees what a server chooses to reveal. If a host hides its PHP version, the scan can’t tell which version it runs, and the result is only as reliable as the version information the server sends. An authenticated scan logs in and looks at the installed software, so it also finds PHP on hosts that don’t advertise a version, within the limits described in the steps above. For a deeper search on Windows hosts, enable portable app detection before scanning: edit your scan config (for example a copy of Full and fast), scroll down to Network Vulnerability Test Preferences, find Options for Local Security Checks, set Enable Detection of Portable Apps on Windows to yes, and save. Authenticated scans take longer and put more load on the scanned systems, so plan the scope and timing of the scan accordingly.
Summary
CVE-2026-109618 and CVE-2026-109619 are two critical vulnerabilities in PHP that can allow unauthenticated remote code execution. PHP has fixed them in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while end-of-life branches depend on backports. Exploitation attempts began before the fixes were published, and public proofs of concept are circulating. CISA has since added both CVEs to its KEV catalog. Defenders should update now and make sure to catch every PHP installation: end-of-life versions, hosts that hide their version, and PHP bundled with other software.
Updates
October 21, 2026: First published.
October 22, 2026: Added exploitation attempts reported by Amazon and watchTowr, public proofs of concept, fixed packages from Debian, Red Hat and Ubuntu, vendor responses from cPanel, Plesk and Palo Alto Networks, and CISA’s guidance for unsupported PHP versions. Greenbone’s feed now includes package-level checks for ten Linux distributions.
October 23, 2026: Added a step-by-step guide to detecting PHP2Shell with Greenbone and the EPSS values.
October 26, 2026: Expanded the scan instructions with the Greenbone Agent (Technology Preview), the scope and limits of the file system search on Linux, and an optional check for PHP detected without a version. Added recommendations for systems that cannot be patched right away and clarified the limits of the session.upload_progress setting. Added package-level checks for AlmaLinux, SUSE and openSUSE, checks for products that ship PHP, and links to the checks on SecInfo.
October 27, 2026: Added ready-made PHP2Shell scan configs for Linux and Windows to download.
October 28, 2026: Added the CISA KEV listing of both CVEs and updated the EPSS values.
November 11, 2026: Added the generic PHP version checks for Linux and Windows in the free COMMUNITY FEED and what each feed covers, new package-level checks for openEuler and Huawei Cloud EulerOS, new product checks, PHP’s Windows rebuilds for the Brotli flaw CVE-2026-111497, PHP’s suggestion on session upload progress (CVE-2026-115560), Palo Alto Networks’ hotfixes and exploitation report, and advisories from Siemens and Phoenix Contact.
CVE-2026-102764 (CVSS 9.3, EPSS ≥ 67th pct) is a critical authentication-bypass flaw affecting BeyondTrust Remote Support (RS). The vulnerability stems from improper origin validation in an internal messaging component, and exploitation allows an unauthenticated remote attacker to perform file operations on an affected appliance. The CVE was published on October 15th, 2026, and added to CISA’s KEV list the next day. In a reported campaign, attackers were able to gain admin access to the RS application and pivot to managed endpoints to steal sensitive data.
No detailed root-cause analysis or proof-of-concept (PoC) exploits are publicly available for CVE-2026-102764. Numerous national CERT agencies have issued alerts for CVE-2026-102764 and related attack campaigns [1][2][3][4][5][6][7][8]. Furthermore, BeyondTrust vulnerabilities have been featured several times on the Greenbone blog, including a December 2024 breach of the U.S. Treasury Department and ransomware attacks earlier in 2026 [9][10][11].
Start Your Free Trial
Greenbone’s OPENVAS ENTERPRISE FEED added a remote_banner check for CVE-2026-102764 immediately after it was published, allowing defenders to detect affected instances and take immediate action. OPENVAS SCAN includes a free two-week trial of the ENTERPRISE FEED, with over 250,000 vulnerability tests and counting.
A Global Risk Assessment of CVE-2026-102764 in BeyondTrust Remote Support
In general, CVE-2026-102764 can be exploited by an unauthenticated attacker with network access to an affected device. Forensic evidence shows how the vulnerability was used as the initial access point for lateral intrusions and sensitive data theft. According to Mandiant, CVE-2026-102764 was exploited as a zero-day in late August 2026. Risk is elevated because BeyondTrust RS is an enterprise service-desk and remote-access platform. These capabilities increase the operational significance of a breach because successful exploitation gives access to infrastructure used for privileged remote-access.
BeyondTrust RS is a known target for sophisticated cyber adversaries [1][2][3], and CVE-2026-102764 is the product’s second CISA KEV entry of 2026. The previous entry, CVE-2026-1731 (CVSS 9.8), is associated with ransomware attacks. Although no PoC exploits are publicly available, a GitHub repository claims to offer private access to one. Defenders should prioritize patching of internet-exposed and internally reachable self-hosted appliances.
The Technical Details for CVE-2026-102764 in BeyondTrust Remote Support
No detailed root-cause analysis is available for CVE-2026-102764. The flaw is described as inadequate validation of message origin inside an internal messaging component, leading to authentication-bypass-by-spoofing [CWE-290]. Successful exploitation allows file operations on the appliance, including arbitrary file upload.
ARMORY CASTLE Exploitation Campaign
According to Mandiant, ARMORY CASTLE (formerly tracked as UNC5221) exploited CVE-2026-102764 as a zero-day in late August 2026. The flaw was leveraged to gain a foothold on BeyondTrust RS appliances, establish persistence [TA0003], escalate privileges [TA0004], and move laterally [TA0008]. Ultimately, the attacks led to exfiltration of sensitive information from managed endpoints.
The SAWFLY PHP-based web shell [T1505.003] and BARECLAW SOCKS5 proxy tunneler are novel strains of malware observed during post-exploitation activity. Attackers also leveraged living-off-the-land (LoTL) techniques, and deletion of appliance logs [T1685.006] and other artifacts [T1070.004] to evade detection.
After initial access, attackers attempted to steal credentials [T1555] via the device’s native /ns/sbin/bt-secrets binary and subsequently logged into the RS application [T1078]. The compromised account’s Jump Items and Team permissions were elevated to Administrator [T1098], allowing access to remote downstream systems. Attackers then used BeyondTrust’s own remote management tools [T1219] to exfiltrate sensitive documents [TA0010] from the remote endpoints. Attackers also modified the device’s HAProxy configuration to expose the BARECLAW WebSocket-based SOCKS5 proxy over the appliance’s public-facing interface [T1090] for command and control (C2) [TA0011].
Affected Versions and Mitigation for CVE-2026-102764 in BeyondTrust Remote Support
Organizations using self-hosted deployments of BeyondTrust RS must manually install the BT26-05-RS patch if automatic updates are not enabled. The BT26-05-RS patch applies to versions 24.3.1 through 26.2.3. For versions older than 24.3.1, users must first upgrade before applying the patch. According to BeyondTrust, although Privileged Remote Access (PRA) shares the vulnerable code segment, the vendor has not identified an exploitable path in PRA. However, BeyondTrust has released a precautionary patch and recommends that self-hosted PRA customers apply it immediately.
CISA has flagged CVE-2026-102764 for forensic triage, and patching should be paired with a compromise assessment. Appliances should be inspected for signs consistent with reported activity, including unrecognized files, changes to session-policy or account permissions, unrecognized account activity, presence of a web shell and related activity, WebSocket-based SOCKS5 tunneling, and unexplained log deletion.
Product
Affected versions
Fixed versions
Notes
BeyondTrust Remote Support self-hosted
All versions <= 26.2.3
BT26-05-RS patch for versions 24.3.1 through 26.2.3
Versions older than 24.3.1 must be upgraded before the patch can be applied.
Summary
CVE-2026-102764 is a critical-severity, remotely exploitable authentication-bypass vulnerability in BeyondTrust RS. The flaw has been actively exploited to establish persistence on a vulnerable device, escalate privileges, move laterally to managed endpoints within the victim’s network, and steal sensitive data. Defenders should urgently identify self-hosted BeyondTrust Remote Support appliances, upgrade to a patched version, and assess appliances for indicators of compromise.
Start Your Free Trial
Greenbone’s OPENVAS ENTERPRISE FEED added a remote_banner check for CVE-2026-102764 immediately after it was published, allowing defenders to detect affected instances and take immediate action. OPENVAS SCAN includes a free two-week trial of the ENTERPRISE FEED, with over 250,000 vulnerability tests and counting.
CVE-2026-21589 (CVSS 9.3, EPSS ≥ 78th pctl) is a critical-severity arbitrary file access vulnerability [CWE-552] affecting Atlassian Jira Service Management Data Center, Jira Software Data Center, Confluence Data Center, Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. All unpatched versions of the affected products are vulnerable. The file access vulnerability can be further leveraged for admin account takeover under certain conditions when Crowd SSO is in use. CVE-2026-21589 is considered actively exploited [1][2][3][4], but has not been added to CISA’s KEV list as of October 13th, 2026.
A detailed technical analysis of the full attack chain, including Jira admin account takeover, is available. Proof-of-concept (PoC) exploits for the unauthorized file read [5][6][7][8] and full account-takeover chain [9] are also publicly available. Multiple national CERT agencies have issued alerts for the flaw [10][11][12][13][14][15][16][17][18][19][20].
Start Your Free Trial
Immediately after CVE-2026-21589 was disclosed, the OPENVAS ENTERPRISE FEED added detection across all affected Atlassian products:
Remote banner check for Atlassian Jira Service Management Data Center [1]
Active check and remote banner check for Atlassian Jira Software Data Center [2][3]
Active check and remote banner check for Atlassian Confluence [4][5]
Active check and remote banner check for Atlassian Bitbucket [6][7]
Remote banner check for Atlassian Bamboo [8]
Remote banner check for Atlassian Crowd [9]
Remote banner check for Atlassian Fisheye and Crucible [10]
Greenbone’s ENTERPRISE FEED also includes regular detection for emerging vulnerabilities affecting Atlassian products. A trial copy of OPENVAS SCAN includes a free two-week trial of the ENTERPRISE FEED, with over 250,000 vulnerability tests and counting.
A Risk Assessment of CVE-2026-21589 in Atlassian Data Center Products
Atlassian Data Center products are self-hosted enterprise platforms used for project tracking, documentation, build automation, identity management, code review, and more. That makes CVE-2026-21589 a high risk across a broad set of business-critical workflows. Furthermore, Atlassian products have historically been leveraged by ransomware gangs and Advanced Persistent Threat (APT) groups. Atlassian products are listed 13 times on CISA’s KEV list; 8 instances have been flagged for ransomware activity.
CVE-2026-21589 allows unauthenticated attackers to access files within the web application root directory, and when Crowd SSO is in use, attackers may also be able to create accounts and assign administrative privileges. The full attack chain can result in unauthorized admin access. The vulnerability’s actively exploited status and the availability of detailed technical information and PoC exploits further increase the risk.
Technical Details for CVE-2026-21589 in Atlassian Data Center Products
CVE-2026-21589 (CVSS 9.3, EPSS ≥ 78th pctl) allows unauthenticated attackers to access files [CWE-552] within the web application root directory if the exact file name and path are already known. Exploitation requires prior knowledge of the exact target file name and path. CVE-2026-21589 does not allow attackers to enumerate or list directory contents. When Crowd SSO is in use and has sufficient permissions to create users and modify group memberships, attackers can create accounts and achieve admin takeover.
The vulnerability originates in the shared Atlassian Web Resource Plugin, specifically its handling of resource paths in the atlassian-plugins-webresource library. The Router.unescapeSlashes() function converts double-colon (::) sequences into forward slashes (/), allowing attackers to construct directory traversal payloads that bypass path restrictions. By submitting malicious HTTP requests to web resource endpoints, an unauthenticated attacker can exploit the resource-serving functionality to read otherwise inaccessible files within the application’s webroot directory tree. This includes sensitive configuration files under the WEB-INF directory.
Jira installations integrated with Atlassian Crowd may expose the WEB-INF/classes/crowd.properties configuration file, which contains the Crowd application name, plaintext application password, and Crowd server URL. If an attacker can obtain these credentials and has access to the Crowd server, they can authenticate to its REST API, enumerate existing users, create new accounts, and modify group memberships.
watchTowr Labs researchers created a new Crowd user and added it to the jira-administrators group, achieving Jira administrator privileges. This exploitation scenario depends on Crowd integration, exposed credentials, and network accessibility to the Crowd service. Highly restrictive Crowd IP allowlists can limit exploitability.
Affected Products and Mitigation for CVE-2026-21589 in Atlassian Data Center Products
CVE-2026-21589 affects Jira Service Management Data Center, Jira Software Data Center, Confluence Data Center, Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. All versions prior to the fixed versions are affected. Users should urgently update affected instances within their IT environment, giving priority to those that are internet-accessible.
Atlassian has provided web application firewall (WAF) rules to mitigate the vulnerability across all affected products, along with Tomcat RewriteValve rules for Confluence, Jira Service Management, Jira Software, Bamboo, and Crowd. For Bitbucket, Atlassian has provided a rule that can be added to urlrewrite.xml. The vendor-provided workarounds are temporary mitigations only.
The fixed versions are shown below:
Product
Fixed versions
Jira Service Management Data Center
5.12.40
10.3.26
11.3.12
Jira Software Data Center
9.12.40
10.3.26
11.3.12
Confluence Data Center
9.2.26
10.2.19
Bitbucket Data Center
9.4.26
10.2.8
10.5.1
Bamboo Data Center
10.2.24
12.1.12
Crowd Data Center
6.3.7
7.0.3
7.1.7
7.2.4
Crucible
4.9.15
Fisheye
4.9.15
Summary
CVE-2026-21589 is a critical-severity, actively exploited, unauthenticated arbitrary file read vulnerability affecting all unpatched versions across multiple Atlassian Data Center products. The flaw allows access to specific files in the web application root directory when an attacker already knows the exact file path and name. Attackers may also leverage CVE-2026-21589 to gain administrator privileges when Crowd SSO is in use. Users should immediately restrict access to internet-facing instances and urgently update to a patched version.
Start Your Free Trial
Immediately after CVE-2026-21589 was disclosed, the OPENVAS ENTERPRISE FEED added detection across all affected Atlassian products:
Remote banner check for Atlassian Jira Service Management Data Center [1]
Active check and remote banner check for Atlassian Jira Software Data Center [2][3]
Active check and remote banner check for Atlassian Confluence [4][5]
Active check and remote banner check for Atlassian Bitbucket [6][7]
Remote banner check for Atlassian Bamboo [8]
Remote banner check for Atlassian Crowd [9]
Remote banner check for Atlassian Fisheye and Crucible [10]
Greenbone’s ENTERPRISE FEED also includes regular detection for emerging vulnerabilities affecting Atlassian products. A trial copy of OPENVAS SCAN includes a free two-week trial of the ENTERPRISE FEED, with over 250,000 vulnerability tests and counting.
CVE-2026-104286 (CVSS 9.8, EPSS ≥ 82nd pctl) is a critical path traversal [CWE-22] and NULL-byte handling flaw [CWE-158] affecting Fortinet FortiMail. Exploitation can be achieved via HTTP/HTTPS request to the FortiMail web interface. The CVE was both published and added to CISA’s KEV list on October 1st, 2026. Successful exploitation allows writing arbitrary files with root-level permissions, remote code execution (RCE), and unauthorized command execution. Exploitation could also result in denial of service (DoS) conditions, theft of sensitive information, business email compromise (BEC), or further penetration into a victim’s IT network. No detailed code analysis or proof-of-concept (PoC) exploit code is publicly available at this time. Numerous national CERT agencies have issued alerts for CVE-2026-104286 [1][2][3][4][5][6][7][8][9][10][11][12][13][14].
Start Your Free Trial
Immediately after the flaw was disclosed, the OPENVAS ENTERPRISE FEED added a package-level check for CVE-2026-104286 in Fortinet FortiMail. Greenbone’s ENTERPRISE FEED also includes regular detection checks for emerging vulnerabilities affecting Fortinet products. A trial copy of OPENVAS SCAN includes a free two-week trial of the ENTERPRISE FEED, with over 250,000 vulnerability tests and counting.
Risk Assessment for CVE-2026-104286 in Fortinet FortiMail
FortiMail is an email security solution deployed as a physical or virtual appliance. The product is intended to defend organizations against phishing, business email compromise (BEC), and malware. An exploitable software vulnerability in FortiMail could cause disruption to essential email security controls, data theft, and allow an attacker to establish a persistent foothold within a victim’s network.
Persistent access to a FortiMail device allows an attacker to read email that traverses the device or previous email messages if the device is configured to archive email. Furthermore, a persistent foothold may allow an attacker to move laterally to other exposed systems on the same network. If exposed on the public internet, a compromised device could be used as a proxy for subsequent global cyberattacks.
CVE-2026-104286 presents an especially high risk because it can be exploited remotely without authentication. Fortinet’s description says CVE-2026-104286 allows “arbitrary file write”, indicating that attackers can reach files with root-level permissions. Although Fortinet’s initial Indicators of Compromise (IoC) included a list of added files and highly privileged modified files, these were subsequently removed.
Technical Details for CVE-2026-104286 in Fortinet FortiMail
Technical details for CVE-2026-104286 are limited. Fortinet’s FG-IR-26-175 advisory indicates that FortiMail’s webmail interface exposes the vulnerable attack surface and that the flaw combines path traversal [CWE-22] with improper neutralization of a NULL byte or NULL character [CWE-158]. Exploitation allows an unauthenticated attacker to write arbitrary files on the underlying system and achieve unauthenticated RCE. Fortinet’s description, “arbitrary file write”, implies that root-level privileged access is possible. The official workaround guidance further indicates that Identity Based Encryption (IBE) encryption is the affected component.
Affected Product and Mitigation for CVE-2026-104286 in Fortinet FortiMail
FortiMail users should update to a fixed release. The 7.2.x branch is affected, but no corresponding fixed version is available. The 7.2.x branch reached End of Engineering Support (EOES) on May 10th, 2025, and will officially reach End of Support (EOS) on November 10th, 2026.
Fortinet recommends disabling (IBE) encryption support or disabling the entire FortiMail webmail interface as a temporary mitigation. CISA has also flagged CVE-2026-104286 for forensic triage per BOD 26-04.
Affected versions
Fixed versions
8.0.0 – 8.0.1
8.0.2
7.6.0 – 7.6.6
7.6.7
7.4.0 – 7.4.8
7.4.9
7.2.0 – 7.2.9
No fixes available
Summary
CVE-2026-104286 is a critical, actively exploited vulnerability in the FortiMail IBE encryption exposed via the webmail interface. The flaw can be exploited remotely without authentication via HTTP/HTTPS requests to trigger file writes with root-level permissions, and unauthenticated RCE. A breach could also lead to business email compromise (BEC), unauthorized access to sensitive email content, DoS conditions, or broader network penetration.
Start Your Free Trial
Immediately after the flaw was disclosed, the OPENVAS ENTERPRISE FEED added a package-level check for CVE-2026-104286 in Fortinet FortiMail. Greenbone’s ENTERPRISE FEED also includes regular detection checks for emerging vulnerabilities affecting Fortinet products. A trial copy of OPENVAS SCAN includes a free two-week trial of the ENTERPRISE FEED, with over 250,000 vulnerability tests and counting.
Widespread, unchecked accumulation of security debt in enterprise IT is emerging at an accelerated pace. While the numbers are staggering, defenders need to realize that regular scanning, orderly prioritization, and timely patching are still the most fundamental way to prevent attackers from exploiting software flaws for impact. For prudent defenders applying well-orchestrated security programs, vulnerability management is still sustainable. On the other hand, some will need to improve their VM maturity to prevent an unmitigated exposure from turning catastrophic.
Here is a summary of high-risk issues for enterprise IT that emerged in September 2026.
Start Your Free Trial
Earlier in September, the Greenbone blog alerted to numerous emerging risks to IT systems. These include an actively exploited “MikroTrick” exploit chain targeting RouterOS [1], three actively exploited JFrog Artifactory vulnerabilities [2], an actively exploited flaw in GitLab [3], heightened risk for Cisco products from its September vulnerability disclosures [4], active exploitation of Roundcube Webmail CVE-2026-48842 [5], attacks targeting Zyxel GS1900 switches via CVE-2026-7273 [6], and active exploitation of the WSO2 API platform [7]. Greenbone’s OPENVAS SCAN allows IT defenders to tackle vulnerability management head-on, helping them detect and mitigate emerging threats before attackers can take advantage. A trial copy of OPENVAS SCAN includes a free two-week trial of the OPENVAS ENTERPRISE FEED, with over 250,000 vulnerability tests and counting.
CVE-2026-86218: Another Actively Exploited Unauthenticated RCE Flaw in N-able N-central
CVE-2026-86218 (CVSS 9.8, EPSS ≥ 96th pctl) is a critical unauthenticated remote code execution (RCE) flaw in N-able N-central before version 2026.3.1.14. The root cause is improper neutralization of directives in statically saved code [CWE-96]. CVE-2026-86218 has been added to CISA’s KEV list. A detailed technical analysis [1], Metasploit module [2], and at least one additional proof-of-concept exploit [3] are available, further increasing the risk of ongoing attacks.
N-central vulnerabilities also appeared on CISA’s KEV list twice last month, and were alerted twice on the Greenbone blog in 2025 [4][5]. Risk is elevated because N-central is a remote administration platform used by internal IT teams and in Managed Service Provider (MSP) environments. Compromise of an N-central server creates a threat across managed customer environments.
Living on the Edge: Emerging Risk to Perimeter Network Devices
According to the latest Verizon DBIR 2026 report, exploiting publicly exposed software vulnerabilities is now the most common vector for initial access globally. Greenbone’s OPENVAS SCAN excels at detecting perimeter vulnerabilities, via both network-based scans and host-based authenticated scans. Greenbone’s detection is industry-leading when paired with the OPENVAS ENTERPRISE FEED. Here are some of the most critical emerging threats to perimeter devices in September 2026.
Three Citrix NetScaler ADC and Gateway Flaws Actively Exploited
Update:
CISA published an alert to highlight emerging security risks to Citrix NetScaler ADC and Gateway. CVE-2026-88779 (CVSS 7.5, EPSS ≥ 47th pctl) was disclosed and added to CISA’s KEV list on October 4th, 2026. The flaw is a memory overflow [CWE-119] that allows an attacker to trigger DoS conditions. CISA warns that CVE-2026-88779 can be exploited to force a reboot to enable execution of code previously injected through exploitation of CVE-2026-88771. See the vendor advisory for more information, including affected product versions. Also, CVE-2026-107406 (CVSS 9.5), published October 8th, 2026, is a memory overflow vulnerability [CWE-119] that allows an attacker to achieve RCE and trigger DoS conditions. CVE-2026-107406 has not yet been added to CISA’s KEV list. See the vendor advisory for more information. Both new CVEs above are only applicable when Netscaler ADC or Gateway is configured as a SAML SP or SAML IdP. Immediately after disclosure, Greenbone’s OPENVAS ENTERPRISE FEED added remote banner checks for CVE-2026-88779 [1] and CVE-2026-107406 [2].
The three Citrix NetScaler ADC and Gateway CVEs added to CISA’s KEV list in September, each shown with its CVSS severity band and EPSS exploitation-probability score
An improper input validation flaw [CWE-20] allows unauthenticated, arbitrary RCE. All NetScaler ADC and NetScaler Gateway deployments are vulnerable in the default configuration.
An authentication bypass using an alternate path [CWE-288] allows a remote, unauthenticated attacker to target appliances. Exploitability requires the appliance to be configured as a Gateway or AAA virtual server, and for certain later affected builds, a SAML action must also be configured. The practical impact depends on configuration: an attacker may be able to trigger DoS conditions or, on a vulnerable Gateway, potentially obtain an anonymous authenticated VPN session with access to an organization’s internal network.
A memory overflow flaw [CWE-119] that allows RCE or triggering denial of service (DoS) conditions. Exploitability depends on DTLS being enabled, which is enabled by default on VPN vServer deployments.
Affected versions are shown below:
CVE
Affected versions
Fixed versions
CVE-2026-88771
– NetScaler ADC and Gateway 14.1 before 14.1-73.37
– NetScaler ADC and Gateway 13.1 before 13.1-64.23
– NetScaler ADC FIPS before 14.1-73.37
– NetScaler ADC FIPS and NDcPP before 13.1-37.279
– NetScaler ADC and Gateway 14.1-73.37 and later
– NetScaler ADC and Gateway 13.1-64.23 and later
– NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later
– NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later
CVE-2026-19490
– NetScaler ADC and Gateway 14.1 before 14.1-73.32
– NetScaler ADC and Gateway 13.1 before 13.1-63.21
– NetScaler ADC FIPS before 14.1-73.32
– NetScaler ADC FIPS and NDcPP before 13.1-37.277
– NetScaler ADC and Gateway 14.1-73.32 and later
– NetScaler ADC and Gateway 13.1-63.21 and later
– NetScaler ADC 14.1-FIPS 14.1-73.32 FIPS and later
– NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.277 and later
CVE-2026-88772
– NetScaler ADC and Gateway 14.1 before 14.1-73.37
– NetScaler ADC and Gateway 13.1 before 13.1-64.23
– NetScaler ADC FIPS before 14.1-73.37
– NetScaler ADC FIPS and NDcPP before 13.1-37.279
– NetScaler ADC and Gateway 14.1-73.37 and later
– NetScaler ADC and Gateway 13.1-64.23 and later
– NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later
– NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later
No workarounds have been provided by the vendor. Affected users should update systems to the most relevant fixed build as described above. Immediately after the flaws were disclosed, the OPENVAS ENTERPRISE FEED added a remote banner version check for CVE-2026-88771 and CVE-2026-88772, and a separate remote banner check and active check for CVE-2026-19490.
Two New SonicWall SMA1000 Flaws Added to CISA’s KEV List
SonicWall has confirmed that two new SMA1000 vulnerabilities, described below, are being actively exploited in the wild [1][2].
The two SonicWall SMA1000 CVEs added to CISA’s KEV list, each shown with its CVSS severity band and EPSS exploitation-probability score
A pre-authentication SSRF flaw [CWE-918] in the Appliance Work Place interface caused by an unintended alternate access path. A remote, unauthenticated attacker could gain unauthorized access to sensitive functionality and perform unauthorized operations.
An OS command injection flaw [CWE-78] in the Appliance Management Console (AMC) allows a remote authenticated attacker with admin credentials to execute arbitrary OS commands on an affected device.
Exploitation of the two flaws can be chained to achieve unauthenticated RCE on affected appliances. A Metasploit module covering the exploit chain is available. SonicWall released a combined security update in SNWLID-2026-0016. Within hours of their disclosure, the OPENVAS ENTERPRISE FEED added a remote banner check that covers both CVEs.
CVE-2025-25249 (CVSS 9.8, EPSS ≥ 90th pctl), published in January 2026, is a heap-based buffer overflow [CWE-122] in Fortinet’s cw_acd daemon. cw_acd is Fortinet’s CAPWAP (Control and Provisioning of Wireless Access Points) Access Controller daemon. The vulnerable path is reachable over the network, and exploitation allows unauthenticated arbitrary RCE on affected FortiOS, FortiSwitchManager, and FortiSASE devices. On FortiOS, the interface setting set allowaccess fabric enables the Security Fabric Connection service, which includes FortiTelemetry and the CAPWAP endpoint.
CVE-2025-25249 has been exploited in the wild since July 2026, and CISA added the flaw to its KEV catalog in September. The vulnerability has been used to deploy PivotC2, a novel Node.js malware strain against at least 178 confirmed victims.
Product
Affected versions
Fixed versions
FortiOS
– 7.6.0 through 7.6.3
– 7.4.0 through 7.4.8
– 7.2.0 through 7.2.11
– 7.0.0 through 7.0.17
– 6.4 all versions
– 7.6.4
– 7.4.9
– 7.2.12
– 7.0.18
FortiSwitchManager
– 7.2.0 through 7.2.6
– 7.0.0 through 7.0.5
– 7.2.7
– 7.0.6
FortiSASE
– 25.2.b
– 25.1.a.2
– 25.2.c
– 25.1.b
Fortinet advises that the issue can be mitigated by removing fabric access for each interface or by disallowing access to the CAPWAP daemon. Users should verify their exposure and either apply the workaround or upgrade affected devices to the latest fixed versions. Devices using FortiOS version 6.4 must migrate to a fixed release train.
Immediately after disclosure, Greenbone’s OPENVAS ENTERPRISE FEED added package-level detection for CVE-2025-25249 in FortiOS. The ENTERPRISE FEED also includes regular detection for emerging vulnerabilities affecting Fortinet products.
CVE-2026-94127 (CVSS 9.8, EPSS ≥ 82nd pctl) is a critical heap-based buffer overflow [CWE-122] affecting F5 BIG-IP APM. The flaw allows unauthenticated RCE and full-system compromise on affected devices. Exploitability depends on APM access policy and an OAuth profile being configured on the same virtual server. Deployments using APM only as an OAuth Client or Resource Server are not affected.
The attack chain involves providing an oversized Authorization: Bearer header to an OAuth endpoint such as /f5-oauth2/v1/userinfo. F5 has confirmed active exploitation in the wild, and the flaw has been added to CISA’s KEV list. Also, watchTowr Labs has published a technical write-up with exploit details.
F5 provides an official iRule-based workaround for customers with a support agreement. Other temporary mitigation controls include restricting access to OAuth endpoints using IP allow-listing or web application firewall (WAF) rules and disabling the OAuth Authorization Server if it is not in use. The OPENVAS ENTERPRISE FEED includes package detection for CVE-2026-94127 in F5 BIG-IP APM and regular detection for vulnerabilities affecting F5 products. The affected versions and corresponding hotfix patches are shown below:
Affected versions
Patched hotfixes
17.1.0 prior to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
17.1.0 Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
17.5.0 prior to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
17.5.0 Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
21.1.0 prior to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
21.1.0 Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
Critical Flaws Affecting Check Point Security Products Include Two Actively Exploited
Check Point reported active exploitation of two critical flaws: CVE-2026-85102 (CVSS 9.8, EPSS ≥ 94th pctl) affecting VPN certificate handling on Check Point Quantum Security Gateway and Spark Firewall, and CVE-2026-93616 (CVSS 9.8, EPSS ≥ 97th pctl) in the Check Point management web service. Both were added to CISA’s KEV catalog [1][2]. Two additional critical issues were disclosed in September: CVE-2026-85103 (CVSS 9.8, EPSS ≥ 89th pctl) and CVE-2026-91843 (CVSS 9.8, EPSS ≥ 42nd pctl), which affect VPN and management-plane components.
Attacks against Spark customers from anonymized IPs were observed globally. Check Point also said post-exploitation activity included internal port and service scans. Although Security Management and Log Server is not explicitly an edge networking service, Censys found 3,836 publicly accessible instances globally.
The four critical Check Point CVEs described in this section, each shown with its CVSS severity band and EPSS exploitation-probability score
Improper certificate trust [CWE-295] during VPN negotiation in Check Point Quantum Security Gateway allows an unauthenticated remote attacker to execute arbitrary code on the Gateway. A full list of affected products and versions is available from the vendor’s sk1000117 advisory.
A directory traversal flaw [CWE-22] allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server. A full list of affected products and versions is available from the vendor’s sk1000171 advisory.
A heap-based buffer overflow [CWE-122] in VPN certificate ASN.1 decoding allows an unauthenticated, remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems. A full list of affected products and versions is available from the vendor’s sk1000118 advisory.
A stack overflow [CWE-121] during the login process allows an unauthenticated, remote attacker to run arbitrary code with root privileges. A full list of affected products and versions is available from the vendor’s sk1000155 advisory.
The OPENVAS ENTERPRISE FEED includes a remote banner check that covers CVE-2026-85102 and CVE-2026-85103, and separate remote banner checks for CVE-2026-93616 [3] and CVE-2026-91843 [4]. Organizations using affected Check Point products should prioritize remediation for internet-exposed VPN and management systems, with the highest priority on the two actively exploited vulnerabilities.
Adobe Commerce/Magento: Two Actively Exploited CVEs Allow Remote PHP Code Execution and Customer Account Takeover
Adobe disclosed two critical-severity issues in Adobe Commerce and Magento Open Source. CVE-2026-75650 (CVSS 10, EPSS ≥ 90th pctl), dubbed “StyleSmuggler”, is a template-engine flaw [CWE-1336] that can enable unauthenticated arbitrary RCE. The second critical flaw, CVE-2026-71362 (CVSS 9.1, EPSS = 100th pctl), is an incorrect authorization flaw [CWE-863] that allows privilege escalation. Adobe reports that CVE-2026-75650 is being exploited in the wild. Both CVEs have been added to CISA’s KEV list [1][2] and are flagged for forensic triage.
Sansec reported that exploitation of StyleSmuggler starts with an unauthenticated request to Magento’s GraphQL endpoint. A specially crafted HTTP request allows an attacker to smuggle malicious PHP via HTTP headers and parameters into the template-processing chain. The malicious PHP is later executed during automated email rendering. Sansec also reported that CVE-2026-71362 lets attackers switch a customer session to another customer account, providing access to private customer data.
The OPENVAS ENTERPRISE FEED includes separate remote banner checks for CVE-2026-75650 [3] and CVE-2026-71362 [4] in Adobe Commerce and Magento Open Source. CVE-2026-71362 was addressed through Adobe’s APSB26-138 security update. For CVE-2026-75650 (StyleSmuggler), Adobe subsequently released the VULN-39341 hotfix. Both updates must be applied according to the affected release train. Adobe also recommends that users rotate exposed encryption keys, OAuth client secrets, tokens for integrated third-party extensions, payment credentials, and other privileged credentials.
CVE-2026-28326: Hard-Coded Key Allows Unauthenticated RCE in SolarWinds Access Rights Manager
CVE-2026-28326 (CVSS 8.8) is an unauthenticated RCE flaw in SolarWinds Access Rights Manager prior to version 2026.2.1. The root cause is a hard-coded static key [CWE-321], and exploitation allows total device compromise. Some technical details are available, which could support exploit development. ARM’s gRPC service on TCP port 55555 does not properly handle a missing client certificate during TLS authentication, but instead redirects to a fallback authentication mechanism. The fallback path accepts an HMAC token generated with a hard-coded secret, allowing an attacker to authenticate without a client certificate.
Access Rights Manager (ARM) is used to provision, deprovision, manage, and audit user access rights to systems, data, and files in corporate networks, including Microsoft Active Directory, Exchange, and SharePoint. The product’s central role in access-rights administration makes patching CVE-2026-28326 critical, especially where ARM is reachable via untrusted IP addresses.
The OPENVAS ENTERPRISE FEED includes a remote banner check for CVE-2026-28326 in SolarWinds ARM. CVE-2026-28326 affects Access Rights Manager 2026.2 and all previous versions. For deployments that cannot be updated immediately, SolarWinds strongly recommends not exposing ARM on the public internet and restricting access to trusted IPs. For full mitigation, users should upgrade to the fixed version 2026.2.1 as soon as possible.
Ivanti Patches Six Critical Flaws in Neurons ITSM
Ivanti disclosed eight new CVEs in Neurons for ITSM prior to version 2026.2; all allow RCE on the server. Six are rated critical severity. Two can be exploited without authentication, while the remaining require authenticated access. The CVEs include improper deserialization [CWE-502] and missing authorization [CWE-862] flaws. While there is no evidence of exploitation in the wild yet, Ivanti products are a popular target in cyberattacks, including ransomware attacks.
Ivanti Neurons for ITSM is used by administrators and IT staff to manage service requests, incidents, problems, and changes. Exploitation allows attackers to manipulate service-desk data, credentials, and integrations, and potentially pivot further into an organization’s IT network.
Ivanti ITSM On-premises (released September 21, 2026)
2026.2
Not affected
Ivanti’s security advisories [1][2] indicate that cloud customers are already protected, but on-premises administrators must apply the relevant patch for mitigation. Immediately after the disclosure, the OPENVAS ENTERPRISE FEED added a remote banner check covering all aforementioned CVEs in Ivanti Neurons for ITSM.
Summary
In September, critical flaws in enterprise IT products emerged at an accelerated pace. Critical flaws in N-able N-central, Citrix NetScaler, SonicWall, Fortinet, F5, Check Point, Adobe Commerce, and Ivanti Neurons ITSM illustrate persistent high-risk exposure to internet-facing systems. While the numbers are staggering, defenders need to remain vigilant. Regular scanning, orderly prioritization, and timely patching are still the most fundamental way to prevent attackers from exploiting software flaws for impact.
Start Your Free Trial
Earlier in September, the Greenbone blog alerted to numerous emerging risks to IT systems. These include an actively exploited “MikroTrick” exploit chain targeting RouterOS [1], three actively exploited JFrog Artifactory vulnerabilities [2], an actively exploited flaw in GitLab [3], heightened risk for Cisco products from its September vulnerability disclosures [4], active exploitation of Roundcube Webmail CVE-2026-48842 [5], attacks targeting Zyxel GS1900 switches via CVE-2026-7273 [6], and active exploitation of the WSO2 API platform [7]. Greenbone’s OPENVAS SCAN allows IT defenders to tackle vulnerability management head-on, helping them detect and mitigate emerging threats before attackers can take advantage. A trial copy of OPENVAS SCAN includes a free two-week trial of the OPENVAS ENTERPRISE FEED, with over 250,000 vulnerability tests and counting.
CVE-2026-5430 (CVSS 10), published August 6th, 2026, is a critical authentication bypass in WSO2 JSON Web Token (JWT) authentication affecting multiple WSO2 API management products. The flaw allows a token signed with an unsupported algorithm to bypass JWT authentication. Exploitation allows unauthorized access, compromise of administrative accounts, and full account takeover. Although the CVE was issued in August, the vendor had already published an early-warning security advisory WSO2-2026-5328 in May.
watchTowr’s honeypot observed malicious attacks beginning on September 13th, 2026. CISA added CVE-2026-5430 to the Known Exploited Vulnerabilities (KEV) catalog on September 24th. Global risk is high because WSO2 reports more than 950 paying customers across 90+ countries, including numerous large corporate customers and critical infrastructure entities. Furthermore, a detailed technical analysis with proof-of-concept (PoC) exploit is publicly available and the vendor’s own public repository includes commit details that can help reverse engineer the flaw.
Detected Before the CVE Was Even Published
Before a CVE was published, Greenbone’s OPENVAS ENTERPRISE FEED included separate remote banner checks for CVE-2026-5430 in WSO2 API Manager[1][2][3], WSO2 Traffic Manager, and Universal Gateway. This scenario highlights the risks defenders face when a CVE ID is not published promptly and the need to identify and patch vulnerabilities before they are targeted in malicious attacks. For defenders seeking to detect and protect, a trial copy of OPENVAS SCAN includes a free two-week trial of the OPENVAS ENTERPRISE FEED. Greenbone’s cyber security products are a surefire way to gain the deepest insight into where software vulnerabilities exist across your organization’s infrastructure.
A Global Risk Assessment of CVE-2026-5430 in WSO2 API Management Products
WSO2 rates the issue as Critical; CVE-2026-5430 is a network-reachable vulnerability that can be exploited without authentication, and with a low-complexity attack vector. Malicious attacks were observed in mid-September, and CISA has added CVE-2026-5430 to its KEV list. Furthermore, a detailed technical analysis with PoC exploit is publicly available, and the vendor’s own public repository includes commit details that can help reverse engineer the flaw. WSO2 states that successful exploitation allows unauthorized access, including compromise of administrative accounts and full account takeover in WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, and WSO2 Universal Gateway.
WSO2 reports more than 950 paying customers across 90+ countries, including numerous large-corporate customers and critical infrastructure entities. The platform is used across cloud, on-premise, and hybrid deployments. The WSO2 API Manager, Admin Portal, and Developer Portal are used to manage API keys and credentials while the Key Manager handles authentication, authorization, and tokens. In that context, a JWT authentication bypass affects systems that are directly involved in identity and access decisions.
WSO2 API management can span multiple gateway runtimes through a unified control plane and via the WSO2 Traffic Manager. The Traffic Manager and Universal Gateway enable rate limiting across gateway nodes. Given the architecture, an authentication bypass could have a broad operational impact across distributed deployments. CVE-2026-5430 was assigned a CVSS score of 10 for multi-tenant deployments and CVSS 9.8 for single-tenant deployments, where the impact is limited to a single security authority boundary.
Technical Details for CVE-2026-5430 in WSO2 API Management Products
CVE-2026-5430 is caused by flawed exception handling [CWE-703] during JWT authentication. When a token is signed using an unsupported algorithm, JWT validation failure results in fail open rather than fail closed behavior. The result is an improper verification of a token’s cryptographic signature [CWE-347].
Under normal conditions, an authenticator returning false causes an AuthenticationException and prevents the request from reaching the protected API. However, in the vulnerable code, an APIManagementException is logged, but no failed authentication state is set, allowing full access to the REST API.
Affected Products and Mitigation for CVE-2026-5430
Detected Before the CVE Was Even Published
Before a CVE was published, Greenbone’s OPENVAS ENTERPRISE FEED included separate remote banner checks for CVE-2026-5430 in WSO2 API Manager[1], Traffic Manager[2], and Universal Gateway[3]. This scenario highlights the risks defenders face when a CVE ID is not published promptly and the need to identify and patch vulnerabilities before they are targeted in malicious attacks.
CVE-2026-5430 affects various versions of WSO2 API Control Plane, WSO2 API Manager, Traffic Manager, and Universal Gateway. The vendor has published product-specific updates that address CVE-2026-5430. Organizations running affected releases should move each deployment to the corresponding update level for its product branch.
The affected products, affected versions, and fixed versions are shown below:
Product
Affected versions
Fixed versions
WSO2 API Control Plane
4.6.0
4.5.0
4.6.0 update level 22
4.5.0 update level 58
WSO2 API Manager
4.6.0
4.5.0
4.4.0
4.3.0
4.2.0
4.1.0
4.6.0 update level 21
4.5.0 update level 57
4.4.0 update level 72
4.3.0 update level 108
4.2.0 update level 197
4.1.0 update level 257
WSO2 Traffic Manager
4.6.0
4.5.0
4.6.0 update level 21
4.5.0 update level 56
WSO2 Universal Gateway
4.6.0
4.5.0
4.6.0 update level 21
4.5.0 update level 57
Summary
CVE-2026-5430 is a critical WSO2 JWT authentication bypass that can allow unauthorized access, administrative account compromise, and full account takeover. The flaw affects WSO2 API Control Plane, WSO2 API Manager, Traffic Manager, and Universal Gateway. Observation of malicious attacks further increases the risk associated with CVE-2026-5430. Organizations with WSO2 products in their IT environment should treat the published update levels as an immediate remediation requirement.
Detected Before the CVE Was Even Published
Before a CVE was published, Greenbone’s OPENVAS ENTERPRISE FEED included separate remote banner checks for CVE-2026-5430 in WSO2 API Manager[1][2][3], WSO2 Traffic Manager, and Universal Gateway. This scenario highlights the risks defenders face when a CVE ID is not published promptly and the need to identify and patch vulnerabilities before they are targeted in malicious attacks. For defenders seeking to detect and protect, a trial copy of OPENVAS SCAN includes a free two-week trial of the OPENVAS ENTERPRISE FEED. Greenbone’s cyber security products are a surefire way to gain the deepest insight into where software vulnerabilities exist across your organization’s infrastructure.
https://www.greenbone.net/wp-content/uploads/greenbone-logo-2025.png00Joseph Leehttps://www.greenbone.net/wp-content/uploads/greenbone-logo-2025.pngJoseph Lee2026-09-30 12:07:062026-09-30 12:07:06CVE-2026-5430: Full Account Takeover in WSO2 API Management Products Now Actively Exploited
Greenbone is pleased to announce CoreWin as a new distribution partner. As a Ukraine-based value-added software distributor, CoreWin is well-positioned to make OPENVAS available in Ukraine, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Moldova, and Uzbekistan.
Why Our CoreWin Partnership Matters
Organizations across these regions, in both the public and private sectors, depend on reliable cyber security infrastructure to keep critical systems running under demanding conditions. Vulnerability management plays a central role in that resilience. By continuously identifying and prioritizing security gaps, organizations can reduce risk before attackers can exploit it. Greenbone’s OPENVAS line of security products also supports the compliance requirements that are increasingly expected of organizations of all sizes, across all sectors. That’s exactly where Greenbone + CoreWin comes in.
CoreWin Brings Regional Expertise to the Table
CoreWin brings deep regional expertise through a network of 500+ resellers. Our new partner delivers high-quality software, professional technical support, and hands-on assistance to government agencies and businesses alike, making OPENVAS more accessible to organizations across these markets.
About the OPENVAS Product Line
Built on an open-source foundation and developed in Europe with full GDPR compliance, OPENVAS products are ideal for organizations seeking both transparency into the IT products they use and sovereign control over their sensitive security data.
For organizations operating enterprise IT environments, visibility is a critical factor for resilient security. After all, you can’t remediate security issues that are left undetected. OPENVAS SCAN, paired with the OPENVAS ENTERPRISE FEED, is built for high-visibility across distributed networks, remote sites, and air-gapped deployments in highly isolated locations.
Here are some of the highlights of Greenbone’s OPENVAS line of security products:
Extensive vulnerability coverage: The OPENVAS ENTERPRISE FEED is Greenbone’s most comprehensive library of vulnerability detection tests, with over 200,000 security checks and daily updates. Customers can often detect emerging vulnerabilities within a day of their publication. Its coverage includes business-critical software from vendors including Microsoft, Cisco, VMware, Oracle, Palo Alto Networks, Fortinet, an extensive list of Linux distributions, and a vast array of open-source software.
Distributed and air-gapped deployment: OPENVAS SCAN is available as turnkey hardware or virtual appliances for standard on-premises use and also supports distributed sensor architectures and air-gapped deployment for isolated networks.
https://www.greenbone.net/wp-content/uploads/greenbone-logo-2025.png00Greenbone AGhttps://www.greenbone.net/wp-content/uploads/greenbone-logo-2025.pngGreenbone AG2026-09-29 11:50:072026-09-29 11:50:54New Distributor Partnership: CoreWin Brings OPENVAS to Ukraine and the Region
