Remote Code Execution (RCE)
Remote Code Execution (RCE) is the ability for an attacker to execute arbitrary commands or code on a target machine or process. RCE vulnerabilities represent the most critical class of security bugs — they give an attacker the same level of control as a system administrator.
RCE can manifest through many different attack vectors. Command injection occurs when user input is passed unsanitized to system shell commands. Deserialization attacks exploit unsafe object reconstruction in languages like Java, PHP, Python, and .NET. Server-Side Template Injection (SSTI) allows code execution through template engines like Jinja2, Twig, or Freemarker. File upload vulnerabilities can lead to RCE when executable files bypass upload filters and are served by the web server.
In modern applications, RCE often appears in less obvious places: expression language injection in Java frameworks, prototype pollution leading to code execution in Node.js, unsafe use of eval() or dynamic code loading, and vulnerabilities in PDF generators, image processors, and other libraries that shell out to system commands.
RCE bugs consistently command the highest payouts in bug bounty programs because the impact is total system compromise. Chaining lower-severity bugs into RCE — such as SSRF to cloud metadata to code execution — is a common and highly rewarded approach.
This page collects RCE techniques, exploitation writeups, and research across all major platforms and languages.
From Wikipedia
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-09-20 NEW 2026 | CVE-2026-77179: Docker's hypervisor for Mac compromised (Docker Desktop, Docker Sandboxes) news | Docker Desktop for Mac has a critical vulnerability, CVE-2026-77179, that allows for the compromise of its hypervisor. This could potentially lead to the compromise of Docker Sandboxes, impacting the security of containers and the host system. The vulnerability affects Docker Desktop on macOS. |
| 2026-09-18 NEW 2026 | The skb that wasn't freed - the Fragnesia primitive via Open vSwitch advanced 19 min read AuthZ | Library for exploiting the Fragnesia privilege escalation primitive, CVE-2026-90049, affecting Open vSwitch. This library details how Open vSwitch strips the SKBFL_SHARED_FRAG marker from packets, reintroducing a local privilege escalation vulnerability previously addressed by fixes for Copy Fail, Dirty Frag, and Fragnesia itself. The exploit bypasses security measures by leveraging OVS's generic netlink interface and its autoloadable module, enabling unprivileged users within namespaces to overwrite read-only memory. → blog.doyensec.com |
| 2026-09-18 NEW 2026 | MikroTrick: Inside the RouterOS Takeover Chain advanced 9 min read Recon | Writeup detailing the "MikroTrick" takeover chain affecting MikroTik RouterOS. This chain exploits CVE-2026-67279, allowing unauthenticated connections to reach post-login functionality, and CVE-2026-86060, which tricks the login helper into treating attacker-controlled data as a trusted administrative identity. Successful exploitation results in full administrative control of vulnerable RouterOS versions. → bishopfox.com |
| 2026-09-16 NEW 2026 | UANIA OS: Authenticated Remote Code Execution news 11 min read | Writeup detailing an authenticated remote code execution vulnerability in UANIA OS. The analysis begins with an examination of the web interface and an attempt to exploit the packet capture feature. While the filter field was properly sanitized, the download functionality allowed for arbitrary file reads by manipulating the `path` parameter, including accessing `/etc/passwd`. Further investigation revealed the underlying platform to be OpenWrt, leveraging its UBUS message bus exposed via rpcd. |
| 2026-09-16 NEW 2026 | Multiple Vulnerabilities in Frappe LMS Leading to Remote Code Execution news 5 min read | Writeup detailing multiple vulnerabilities in Frappe LMS, including CVE-2026-39405, a path traversal flaw in SCORM package uploads that allows for remote code execution. This vulnerability, when chained with CVE-2026-34606, a stored XSS flaw in profile bios exploitably by BeautifulSoup's get_text() function, enables a student user to achieve server-side RCE. The research demonstrates a manual exploitation path by replacing core API files and leverages XSS to trigger the RCE chain. |
| 2026-09-16 NEW 2026 | James Kettle’s ‘autonomous research cascade’, CRLF-powered desync attacks, RCE on humanoid robots – ethical hacker news roundup news AI | This ethical hacker news roundup highlights several significant security developments. James Kettle's "autonomous research cascade" is a notable achievement in automated vulnerability discovery. The piece also details CRLF-powered desync attacks, a class of vulnerabilities that can disrupt communication protocols. Finally, it reports on the alarming discovery of remote code execution (RCE) capabilities on humanoid robots, raising serious concerns about the security of emerging AI and robotics technologies. → yeswehack.com |
| 2026-09-15 NEW 2026 | IBM Db2 Mirror for i: pre-auth RCE and the road to QSECOFR intermediate 18 min read | Writeup detailing a pre-authentication remote code execution vulnerability in IBM Db2 Mirror for i. The exploit chain bypasses authentication by leveraging servlet path parameter manipulation, then utilizes a `skipVald` parameter to disable input validation, ultimately leading to arbitrary Java/JSP execution within the Liberty application server and potential QSECOFR access on the IBM i system. |
| 2026-09-14 NEW 2026 | A revisit of remote Spectre attacks on Cloudflare Workers advanced 14 min read | Analysis of Spectre attacks against Cloudflare Workers, revisiting techniques discovered in 2021 and building an updated proof-of-concept on the production environment. This research uncovered a limitation in Cloudflare's Dynamic Process Isolation (DyPrIs) defense, successfully demonstrating a remote Spectre attack that leaked up to 12 bit/s with 99% accuracy. The attack leveraged speculative type confusion and out-of-bounds memory accesses to infer cache states. Improvements to DyPrIs, integration of the V8 Sandbox, and an in-process isolation mechanism have since been implemented to mitigate these memory disclosure risks. → blog.cloudflare.com |
| 2026-09-13 NEW 2026 | Magento StyleSmuggler RCE: Report Poisoning to Code Execution intermediate | This document details a Remote Code Execution (RCE) vulnerability in Magento, dubbed "StyleSmuggler." The exploit leverages a report poisoning technique to achieve code execution. Attackers can manipulate report generation to inject malicious code, ultimately leading to a full compromise of the Magento instance. The severity of this vulnerability makes it a critical concern for Magento users. |
| 2026-09-13 NEW 2026 | Beltdown2: Escaping the Cursor CLI sandbox intermediate 6 min read | Library for escaping the Cursor CLI's macOS Seatbelt sandbox by leveraging a vulnerable `core.fsmonitor` hook in Git. This technique bypasses the sandbox by exploiting the fact that Cursor's internal `git` process runs unsandboxed and honors repository-supplied hooks, allowing arbitrary code execution outside the confined workspace. The provided writeup details the exploit chain and demonstrates a proof-of-concept that writes to `$HOME` despite sandbox restrictions, contrasting it with a blocked sandboxed shell command, and notes that Cursor has since implemented universal Git hardening to address this vulnerability class. |
| 2026-09-12 2026 | CVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join Key news 7 min read AuthN | Writeup of CVE-2026-82329, an unauthenticated administrative access vulnerability in JFrog Artifactory. This flaw, rated CVSS 9.8, allows any attacker with network access to obtain administrator privileges by exploiting an empty cluster join key in JFrog Access. Exploitation chains a forged join request to an unauthenticated endpoint, resulting in an admin-scoped token. The vulnerability affects multiple self-managed Artifactory versions prior to the patched releases: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. CISA has added this critical CVE to its Known Exploited Vulnerabilities catalog due to in-the-wild exploitation. → bishopfox.com |
| 2026-09-11 2026 | 🕵️♂️ SonicWall SMA1000 (CVE-2026-15409): SSRF to Erlang RCE chained into automated DCSync from the appliance advanced 19 min read SSRF | Library for analyzing CVE-2026-15409, a critical SSRF vulnerability affecting SonicWall SMA1000 appliances. This library demonstrates the exploitation chain, including reaching Erlang services for RCE and subsequent use of Impacket's secretsdump for Active Directory credential theft, leading to DCSync attacks. It details the process of extracting LDAP configurations and decrypting stored passwords, revealing opportunistic targeting across multiple countries and sectors. |
| 2026-09-11 2026 | No Extensions? You Forgot One: Writing Shared Objects to RCE via SQLite's dbpage intermediate 15 min read | Library for achieving Remote Code Execution via SQLite by exploiting the `sqlite_dbpage` virtual table. This technique allows low-level write access to database pages, enabling the crafting and writing of Shared Object (.so) files directly through SQL queries. The method bypasses SQLite's mandatory header and magic bytes by relocating the ELF Program Header Table to work around immutable offsets, ultimately leading to RCE when the target process is forced to load the malicious module. |
| 2026-09-11 2026 | Forgejo =16.0.3 Critical RCE news | Forgejo version 16.0.3 has a critical Remote Code Execution (RCE) vulnerability. This flaw allows an attacker to execute arbitrary code on the server, posing a significant security risk. No payout amount is mentioned in the provided content. |
| 2026-09-11 2026 | Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490 news 12 min read AuthZ | Library for detecting and weaponizing NetScaler CVE-2026-19490, a critical CVSS 9.3 authentication bypass in SAML handling. The library includes a detection tool that safely probes NetScaler ADC and Gateway appliances for this vulnerability without triggering crashes. It maps various configuration paths from safe checks to root command execution, detailing how an unauthenticated request can lead to pre-authentication crashes, internal network proxying, or full appliance root access, depending on the SAML configuration and global authorization settings. → bishopfox.com |
| 2026-09-10 2026 | Out of Bounds, Out of Sandbox: RCE in Go JavaScript Engine advanced 16 min read | Library detailing a Remote Code Execution (RCE) vulnerability in the Goja JavaScript engine, found within applications like Grafana k6, PocketBase, Nuclei, and Zendesk. The vulnerability arises from an out-of-bounds heap write in `TypedArray` methods (`with` and `toReversed`) due to an incorrect offset calculation, exacerbated by Go's `unsafe` package bypassing runtime bounds checking. Successful exploitation involves heap spraying and manipulating `ArrayBuffer` structures to achieve arbitrary read/write capabilities, ultimately leading to sandbox escape and code execution. |
| 2026-09-10 2026 | Fortinet Privileged Access Agent: Any Site Could Control Your Proxy and Watch Your Tab news 2 min read AuthZ | Writeup on CVE-2026-84388, a CVSS 9.1 vulnerability in Fortinet's Privileged Access Management Chrome extension. This flaw allows any website to control the user's browser proxy settings for the session and stream screen recordings from newly opened tabs to an attacker's server, enabling trivial phishing attacks. The exploit bypasses token validation and uses DOM manipulation to auto-approve consent dialogs, granting attackers full control. Fortinet has released a fix for the extension, which has over 1 million users. |
| 2026-09-10 2026 | Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise advanced 12 min read AI AuthZ | Library for securing LiteLLM deployments that exposes vulnerabilities including MCP authentication bypass (CVE-2026-59822) allowing arbitrary Bearer token sessions, unauthenticated admin access, and post-authentication cloud credential theft via pass-through endpoints lacking URL validation. The research found nearly 10% of scanned LiteLLM instances used default keys or no authentication, enabling pre-authentication RCE and IAM compromise, with patches now available and CVE-2026-59822 appearing in CISA's KEV catalog. → wiz.io |
| 2026-09-09 2026 | Two critical remote bugs found in ArangoDB news 5 min read | Writeup detailing two critical vulnerabilities, GHSA-rrgq-978q-36mq and GHSA-rvhw-4hpw-9vrx, found in ArangoDB. The first vulnerability, a path traversal flaw using URL encoding, bypasses authentication for unauthenticated superuser access to all data. The second, an improper access control in task registration, allows an authenticated user with database write permissions to achieve root-level remote code execution by leveraging a single JSON field to run arbitrary commands and access sensitive files like `/etc/shadow`. |
| 2026-09-08 2026 | The £3 WiFi Extender With a Backdoor in Every Unit beginner 22 min read | Library for analyzing the security of low-cost, white-labeled hardware, focusing on a £3 WiFi extender. The analysis details reading the device's SPI flash chip using a Bus Pirate, carving out the kernel and filesystem, and discovering a hardcoded root password accessible via an unconditionally started telnet daemon. This process highlights inherited security risks from original design manufacturers and the importance of physical access for deep hardware security assessments. |
| 2026-09-08 2026 | StyleSmuggler fix: patch the Magento and Adobe Commerce RCE intermediate 4 min read | Library providing a secure, drop-in replacement for vulnerable Magento and Adobe Commerce packages, addressing the unauthenticated StyleSmuggler RCE vulnerability (AIKIDO-2026-248927, AIKIDO-2026-123768, AIKIDO-2026-724507). The fix sanitizes template styles at two injection points, preventing PHP execution during email rendering without requiring a full Magento version upgrade, thus avoiding extension conflicts and extensive regression testing. This mitigation is crucial as Adobe has not yet released an official patch or CVE for the actively exploited zero-day. → aikido.dev |
| 2026-09-07 2026 | From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX advanced 48 min read Deser | Library for unauthenticated RCE in Telerik UI for ASP.NET AJAX, chaining an AES-CBC padding oracle vulnerability with other flaws. Affecting versions 2010.1.309 through 2026.2.519, exploitation requires a reachable RadAsyncUpload control with a custom encryption key configured. Exploitation is possible even with customErrors set to On by using timing analysis. |
| 2026-09-05 2026 | Dirty Frag (CVE-2026-43284): the Linux kernel bug that turns read access into root advanced 8 min read | Analysis of Dirty Frag (CVE-2026-43284, CVE-2026-43500, CVE-2026-46300), a Linux kernel vulnerability allowing privilege escalation by writing to read-only files via the page cache. The bug affects networking code, specifically ESP and RxRPC, and can be exploited in container environments to gain root access to the host kernel. The analysis details affected components, exposure checks using `uname -r` and `lsmod`, monitoring strategies with audit and EDR tools, and vendor-specific mitigation information. → aikido.dev |
| 2026-09-04 2026 | PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover news 3 min read | Library for securing PostgreSQL instances, addressing CVE-2026-6471 (PostGREShell), a critical vulnerability allowing server takeover via missing authorization in logical decoding. This flaw enables attackers with REPLICATION privileges to execute arbitrary code on the server, escalating to full superuser access and persistent backdoor installation. The vulnerability affects PostgreSQL versions from 9.4 up to 18.x prior to specific patched releases. → securityaffairs.com |
| 2026-09-04 2026 | Hackers exploit chained SonicWall gaps for remote code execution news | Analysis of chained SonicWall vulnerabilities, CVE-2026-83548 and CVE-2026-83549, highlights a sophisticated attack enabling remote code execution on SMA1000 appliances. Exploiting a server-side request forgery in Appliance Work Place and OS command injection in Appliance Management Console, threat actors gain unauthorized command execution. These vulnerabilities are actively exploited and listed in CISA's Known Exploited Vulnerabilities catalog, requiring immediate hotfix application. → msspalert.com |
| 2026-09-04 2026 | SonicWall Warns of Actively Exploited Vulnerabilities in SMA1000 Appliances news 1 min read | Analysis of CVE-2026-83548 and CVE-2026-83549 details two zero-day vulnerabilities in SonicWall SMA1000 appliances chained for remote code execution. CVE-2026-83548, a critical pre-authentication SSRF with command injection (CVSS 10), allows unauthorized actions, while CVE-2026-83549, a high-severity OS command injection (CVSS 7.8), permits command execution by privileged attackers. Both are listed in CISA's KEV Catalog, requiring urgent patching for affected models. |
| 2026-09-04 2026 | Over 440000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws news 2 min read | Writeup detailing exploit attempts against WordPress plugins Super Forms and Elementor Pro, specifically targeting CVE-2026-14894 and CVE-2026-32475. These vulnerabilities allow unauthenticated attackers to upload arbitrary files, including PHP web shells, leading to remote code execution. Over 440,000 exploit attempts were observed, with attackers leveraging the vulnerabilities to create admin accounts, exfiltrate data, and compromise entire WordPress sites. → thehackernews.com |
| 2026-09-04 2026 | SonicWall SMA1000 Zero-Days Under Active Attack: Patch Now news 2 min read | Vulnerability Advisory for CVE-2026-83548 and CVE-2026-83549 affecting SonicWall SMA1000 appliances. These zero-day vulnerabilities, a pre-authentication SSRF (CVE-2026-83548) and a post-authentication RCE (CVE-2026-83549), are being actively exploited and can be chained for unauthenticated operating system command execution. Immediate patching to updated hotfix versions is critical for affected SMA1000 6210, 7210, and 8200v models. Organizations should also investigate systems for compromise and implement post-compromise remediation steps. → esecurityplanet.com |
| 2026-09-04 2026 | Critical Elementor Pro flaw exploited to take over WordPress sites news 2 min read | Writeup of CVE-2026-32475, a critical vulnerability in Elementor Pro for WordPress, details how attackers exploit faulty file-upload validation in Elementor Pro Forms. By submitting an empty file as the first array element and a malicious PHP file as the second, attackers bypass validation, upload arbitrary PHP files to `/wp-content/uploads/elementor/forms/`, and execute commands remotely. This flaw, present in versions 4.2.1 and earlier, has seen widespread exploitation attempts since its patch on August 19. → bleepingcomputer.com |
| 2026-09-04 2026 | File upload to RCE intermediate | This post details a pentesting scenario where a file upload vulnerability led to Remote Code Execution (RCE). The author guides readers through the process of identifying and exploiting this type of flaw, offering a practical example encountered during a security assessment. The content focuses on the techniques and methodologies used to discover and leverage the RCE vulnerability stemming from insecure file handling. → infosecwriteups.com |
| 2026-09-04 2026 | MECCHA CHAMELEON can't hide from the RCE advanced 9 min read | Library for discovering arbitrary file write vulnerabilities, specifically demonstrating a delayed RCE in MECCHA CHAMELEON. The library leverages an exposed Blueprint function, `Finish Recording Output`, within Unreal Engine maps. This function allows arbitrary file writes by manipulating paths and bypassing file extension checks using null bytes, ultimately enabling the execution of arbitrary code upon system restart. → aikido.dev |
| 2026-09-04 2026 | Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root news 6 min read | Writeup on CVE-2026-20212, a critical Cisco Nexus 9000 flaw allowing unauthenticated remote code execution as root. Exploitation of this vulnerability, which affects specific Silicon One-based Nexus 9000 models, can also crash the S1HAL process. Cisco also released patches for seven IOS XR vulnerabilities, with CVE-2026-20274 and CVE-2026-20279 rated 9.8. Temporary mitigations include infrastructure access control lists (iACLs) and Live Protect shields. → thehackernews.com |
| 2026-09-04 2026 | Cisco Warns of Unpatched Secure Email Flaws Patches Critical Switch Vulnerabilities news 2 min read | Writeup detailing Cisco's recent security advisories, highlighting unpatched vulnerabilities in Secure Email (CVE-2026-20354, CVE-2026-20355) enabling man-in-the-middle attacks and plaintext interception. It also covers patches for critical flaws in IOS XR and Nexus 9000 series switches, including CVE-2026-20274, CVE-2026-20279, and CVE-2026-20212, which could lead to remote code execution and authentication bypass. A high-severity DoS vulnerability (CVE-2026-20281) in certain Cisco IP phones is also noted. → securityweek.com |
| 2026-09-04 2026 | Microsoft Edge Multiple Vulnerabilities news 1 min read | Writeup detailing multiple vulnerabilities in Microsoft Edge, including CVE-2026-84323 through CVE-2026-84359. Exploitation can lead to remote code execution, denial of service, security restriction bypass, information disclosure, elevation of privilege, data manipulation, and spoofing. Users should update to version 152.0.4191.62 or later to patch these issues. → hkcert.org |
| 2026-09-04 2026 | Google Chrome Multiple Vulnerabilities news 1 min read | Bulletin detailing multiple critical vulnerabilities in Google Chrome, including CVE-2026-85046 which is actively exploited in the wild. Exploitation can lead to remote code execution within a sandbox via crafted HTML pages, denial of service, information disclosure, security restriction bypass, and elevation of privilege. Patches are available for Linux, macOS, and Windows versions. → hkcert.org |
| 2026-09-03 2026 | HPE patches critical ArubaOS-CX remote code execution flaw news 3 min read | Writeup detailing HPE's patch for a critical remote code execution flaw in ArubaOS-CX, identified as CVE-2026-73749. This buffer overflow vulnerability allows unauthenticated remote attackers to execute code with elevated privileges by sending crafted packets to an affected daemon process. The bulletin also addresses numerous other vulnerabilities, including CVE-2026-73750, CVE-2026-73751, CVE-2026-73752, CVE-2026-73753, CVE-2026-73782, CVE-2026-73781, CVE-2026-73780, CVE-2026-73779, and CVE-2026-73778, with HPE urging customers to upgrade to specific fixed release branches. → bleepingcomputer.com |
| 2026-09-03 2026 | Critical remote code execution in vm2 a widely used Node.js sandbox library news 8 min read | Library of remote code execution vulnerabilities found in vm2, a Node.js sandboxing library, allowing arbitrary command execution. The CVSS 10.0 rated flaws stem from default configurations in the library's README, permitting sandboxed code to access the host system's real Node.js modules. Updates to version 3.11.7 address this specific escape but may not fully mitigate broader configuration risks when `require.external` is enabled without strict `require.root` settings, potentially allowing exploitation through external files. |
| 2026-09-03 2026 | SonicWall urges immediate patching of chained vulnerabilities news | SonicWall is issuing an urgent call for customers to patch chained vulnerabilities affecting their products. The company has released security advisories and patches to address these critical issues, which could be exploited together. Users are strongly encouraged to apply the updates promptly to safeguard their systems against potential compromise. → cybersecuritydive.com |
| 2026-09-03 2026 | Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548 CVE-2026-83549 Exploited in the Wild news 2 min read | Writeup detailing CVE-2026-83548 and CVE-2026-83549, critical vulnerabilities affecting SonicWall SMA1000 appliances. The SSRF flaw (CVE-2026-83548) can chain with command injection (CVE-2026-83549) for unauthenticated RCE, and both are actively exploited in the wild, added to CISA's KEV catalog. Immediate hotfixes are recommended, alongside evidence of compromise checks and potential re-imaging. → rapid7.com |
| 2026-09-03 2026 | Hackers exploit Sangoma Switchvox flaw to deploy reverse shells news 2 min read | Writeup on CVE-2026-9586, an unauthenticated SQL injection vulnerability in Sangoma Switchvox, enabling reverse shells and remote code execution. Researchers at Horizon3 demonstrated how crafted XML requests to the `/pa` endpoint allow attackers to execute OS commands, leading to active exploitation observed on internet-exposed Switchvox systems. System administrators are urged to upgrade to version 8.4.0.2 to mitigate this risk and check logs for compromise indicators. → bleepingcomputer.com |
| 2026-09-03 2026 | The $8,000 Shortcut: Hijacking Microsoft Edge via NTFS Directory Junctions intermediate AuthZ | An InfoSec Write-up details an $8,000 bug bounty discovery, where an NTFS directory junction vulnerability allowed for the hijacking of Microsoft Edge. This exploit leverages a classic Windows filesystem feature, effectively turning the Edge browser into a "Confused Deputy," enabling attackers to gain control. → infosecwriteups.com |
| 2026-09-03 2026 | Android App RCE via Dynamic Code Loading intermediate Mobile | This post details an Android app's Remote Code Execution (RCE) vulnerability, building on previous research into insecure content providers and notification hijacking. The exploit leverages a path traversal vulnerability alongside dynamic code loading within a document viewer app. The objective is to achieve RCE by manipulating these mechanisms. The author references a previous exploit in Adobe Acrobat Reader for Android (CVE-2021-40724) as a related example. No specific bounty payout amount is mentioned in this content. → infosecwriteups.com |
| 2026-09-03 2026 | CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners news 4 min read | Catalog of seven exploited vulnerabilities added by CISA, including CVE-2026-83548 (SonicWall SMA 1000 server-side request forgery), CVE-2026-9586 (Sangoma Switchvox SQL injection), CVE-2026-82329 (JFrog Artifactory improper authentication), CVE-2026-48710 (Kludex Starlette HTTP request/response smuggling), CVE-2026-49869 (Kestra OSS command injection), and CVE-2026-59822 (Berri LiteLLM MCP Streamable HTTP endpoint improper authentication). Attackers are deploying reverse shells, crypto miners, and achieving RCE through these flaws, with notable exploitation chains involving LiteLLM and RAGFlow. → thehackernews.com |
| 2026-09-02 2026 | Critical SonicWall SMA 1000 Flaws Enable Unauthenticated RCE news | Critical vulnerabilities have been discovered in SonicWall's Secure Mobile Access (SMA) 1000 series, allowing unauthenticated Remote Code Execution (RCE). This means attackers can exploit these flaws to gain control of affected devices without needing any credentials. The severity of these bugs poses a significant risk to organizations relying on SonicWall SMA 1000 for secure remote access. Users are strongly advised to update their systems to patch these vulnerabilities. → darkreading.com |
| 2026-09-02 2026 | SonicWall SMA1000 Series: Critical Vulnerability Exploited (Sept. 2026) news 2 min read | Writeup on CVE-2026-83548 and CVE-2026-83549 affecting SonicWall SMA1000 Series appliances. The critical CVE-2026-83548 (CVSS 10.0) allows unauthenticated attackers to exploit a pre-authentication SSRF vulnerability. The high CVE-2026-83549 (CVSS 7.8) enables authenticated attackers to achieve OS command injection. Both vulnerabilities are actively exploited, with hotfixes available for affected models 6210, 7210, and 8200v. |
| 2026-09-02 2026 | WordPress backup plugin flaw exposes millions of sites to takeover attacks news 2 min read | Vulnerability in All-in-One WP Migration and Backup plugin, CVE-2026-19949, allows unauthenticated attackers to achieve remote code execution and site takeover via a second-order SQL injection. Attackers can plant crafted data through trackbacks, which executes during a site restore, exposing the secret import key. This enables the import of malicious archives with executable code, potentially leading to complete website control. The flaw impacts over five million active installations, with millions still running vulnerable versions despite a vendor fix. → bleepingcomputer.com |
| 2026-09-02 2026 | Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain news 1 min read | Writeup detailing two SonicWall SMA 1000 zero-day vulnerabilities, CVE-2026-83548 (pre-authentication SSRF) and CVE-2026-83549 (post-authentication command injection), that attackers are chaining for arbitrary code execution. SonicWall recommends upgrading to patched versions, reviewing for IoCs, and potentially re-imaging affected appliances. This follows previous exploitation of other SMA 1000 flaws by threat actor UTA0533. → thehackernews.com |
| 2026-09-02 2026 | Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials news 2 min read | Writeup of CVE-2026-9586, a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997), allowing remote code execution and reverse shell deployment without credentials. Attackers exploit this flaw by crafting a request that bypasses sanitization in the /pa endpoint's XML processing, directly injecting malicious SQL into PostgreSQL queries. Horizon3.ai and SRA Labs reported this vulnerability, with exploitation attempts observed in the wild targeting internet-exposed instances. Indicators of compromise include specific log entries and attacker IP addresses. → thehackernews.com |
| 2026-09-02 2026 | GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends news 3 min read | Writeup on CVE-2026-63219 and CVE-2026-58400, two vulnerabilities in GeoNetwork chained to achieve unauthenticated RCE. The chain combines a missing authorization check on a formatter upload endpoint with an unsafe Saxon XSLT transformation engine, allowing attackers to execute arbitrary operating-system commands as the GeoNetwork process. Vulnerable versions are fixed in 4.4.12 and 4.2.17. → thehackernews.com |
| 2026-09-02 2026 | Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another advanced 4 min read | Tool that leverages Anthropic's Claude AI to port a pre-authentication remote code execution (RCE) exploit for CVE-2021-31886 from one WAGO PLC model to another, demonstrating the potential for AI to accelerate exploit development against operational technology (OT) systems. The process involved interactive sessions with Claude, Ghidra, and live PLC hardware, culminating in the successful execution of attacker-supplied ARM shellcode and the development of functional network payloads. This research highlights the evolving threat landscape where AI significantly lowers the barrier for exploit creation, posing new challenges for industrial control system security. → thehackernews.com |
| Browse all 754 Remote Code Execution (RCE) resources → | ||
Frequently Asked Questions
- What is remote code execution?
- Remote Code Execution (RCE) is a vulnerability that allows an attacker to run arbitrary commands or code on a target system. It is the most critical class of security vulnerability because it gives the attacker the same level of access as the application or server process, often leading to complete system compromise.
- What are common RCE attack vectors?
- Common vectors include command injection (unsanitized input passed to shell commands), unsafe deserialization (Java, PHP, Python, .NET), Server-Side Template Injection (Jinja2, Twig, Freemarker), file upload bypasses that execute uploaded code, expression language injection in Java frameworks, and prototype pollution in Node.js leading to code execution.
- Why does RCE pay the highest bug bounties?
- RCE represents total system compromise — an attacker can read all data, modify the application, pivot to internal networks, and potentially access cloud infrastructure. The impact is maximum, so bounty programs consistently pay their highest rewards for RCE findings, often ranging from $10,000 to $100,000+ depending on the target.
Weekly AppSec Digest
Get new resources delivered every Monday.