AcrStealer-Custom-Protocol-Credential-Theft-Payload-Extraction-Analysis

1. Network Connections & SSL/TLS Configuration Process Hacker memory analysis reveals that AcrStealer establishes network connections using SSL/TLS for secure communication with its C2 server. Key Observations: SslClientCert – Uses client certificates for authentication evades detection...

CVE-2026-114649

The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...

CVE-2026-114649

The MongoDB C# Driver is vulnerable to an authentication bypass due to insufficient certificate validation when managing cached connections. The driver incorrectly compares TLS client certificates using only the issuer and serial number . An attacker can provide a certificate mimicking another us...

CVE-2026-114649 Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache

The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...

CVE-2026-114649 Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache

The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...

EUVD-2026-108317

The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...

CVE-2026-81518

A flaw was found in mongosqld. When mongosqld is configured to use client certificates for authentication, it requests a certificate during the TLS Transport Layer Security handshake but does not enforce its presence. This allows a remote attacker with network access to establish a session withou...

CVE-2026-89072

Incorrect Authorization vulnerability in Progress MOVEit Transfer Client Certificates module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

AZL-108458 CVE-2026-97629 affecting package nginx 1.30.4-1

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

EUVD-2026-101153

Incorrect Authorization vulnerability in Progress MOVEit Transfer Client Certificates module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89072 MOVEit Transfer Authorization Flaw in Certificate Management

Incorrect Authorization vulnerability in Progress MOVEit Transfer Client Certificates module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89072

Progress MOVEit Transfer contains an incorrect authorization vulnerability (CWE-863) within the Client Certificates module . This flaw impacts versions prior to 2025.1.6 and versions from 2026.0.0 up to, but not including, 2026.0.4 . The vulnerability has a CVSS 3.1 score of 7.5 (HIGH) , indicati...

CVE-2026-97629

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

Linux Distros Unpatched Vulnerability : CVE-2026-97629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to...

CVE-2026-89072: Incorrect Authorization

Incorrect Authorization vulnerability in Progress MOVEit Transfer Client Certificates module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

PT-2026-114324

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description An incorrect authorization issue exists within the Client Certificates module of Progress MOVEit Transfer. Recommendations Update to...

PT-2026-114364

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description When configured with ssl session cache shared:name:size without explicit ssl session ticket key file directives for automatic rotation of...

CVE-2026-97629: Use of Uninitialized Resource

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

Ubuntu 24.04 LTS : curl vulnerability (USN-8670-1)

The remote Ubuntu 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8670-1 advisory. Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. This could result in the wrong client...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / etc (crlsa-2023_6245)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20236245 advisory. dotnet: Denial of Service with Client Certificates using .NET Kestrel CVE-2023-36799 Tenable has extracted the preceding description block directly from the CIQ...