Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday added two security flaws impacting Ivanti Connect Secure ICS to its Known Exploited Vulnerabilities KEV catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 CVSS score: 8...

CVE-2026-43850

A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system...

CVE-2026-43850

A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system...

CVE-2026-43850

A command injection vulnerability exists that could allow an authenticated attacker to achieve root-level code execution on the system. No specific software products, versions, or root causes are provided in the documents. Exploitation details are not provided.

CVE-2026-43850

A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system...

EUVD-2026-104851

A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system...

PT-2026-118286

A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system...

Advantech Adam-3600 command injection vulnerability

The Advantech Adam-3600 versions prior to 2.8.5.0 have a command injection vulnerability. This vulnerability stems from command injection, and it may allow authenticated attackers to execute root-level code on the system...

CVE-2026-111231

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because configrestore and configinstall ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for servicesacb.php,...

CVE-2026-111231

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because configrestore and configinstall ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for servicesacb.php,...

CVE-2026-111231 Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because configrestore and configinstall ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for servicesacb.php,...

CVE-2026-111231

Netgate pfSense CE versions through 2.9.0 are vulnerable to an authorization bypass due to how the config_restore() and config_install() functions operate. These functions fail to respect the 'User - Config: Deny Config Write' privilege, allowing read-only WebGUI users to replace the config.xml f...

CVE-2026-111231 Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because configrestore and configinstall ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for servicesacb.php,...

PT-2026-115196

Name of the Vulnerable Software and Affected Versions Netgate pfSense CE versions prior to 2.9.0 Description An authorization bypass exists that allows read-only WebGUI users to replace the config.xml file. This occurs because the config restore and config install functions ignore the User -...

CVE-2026-111231: Incorrect Authorization

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because configrestore and configinstall ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for servicesacb.php,...

CVE-2026-101965

An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI...

CVE-2026-102182 Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution

A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue requires IKE to be enabled with an RSA-signature IKE policy to be...

CVE-2026-102174 Junos OS: SRX Series: An authenticated remote-access VPN client causes iked denial of service or root-level code execution when JIMS identity publishing is enabled

A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS...

CVE-2026-101965

A Use of Externally-Controlled Format String vulnerability exists in the gRPC daemon of Juniper Networks Junos OS Evolved . An authenticated network attacker can send a crafted message to the gNMI service to trigger this flaw when network analytics telemetry is enabled. Potential impacts include ...

CVE-2026-101965: Use of Externally-Controlled Format String

An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI...