The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-10 2026 | CVE-2026-27825: Critical Unauthenticated RCE and SSRF in mcp-atlassian news 1 min read SSRF | Writeup on CVE-2026-27825, detailing critical unauthenticated RCE and SSRF vulnerabilities in mcp-atlassian. The flaws stem from missing directory confinement and inadequate path traversal validation in attachment download tools, allowing arbitrary file writes for persistence or RCE. A related SSRF issue in header-controlled Atlassian base URLs is also covered. Patched versions 0.17.0 introduce `validate_safe_path()` and `validate_url_for_ssrf()` to mitigate these risks. → arcticwolf.com |
| 2026-04-10 2026 | Unrestricted File Upload Leads to SSRF and RCE intermediate 1 min read | Writeup detailing an unrestricted file upload vulnerability, leveraging ImageMagick and its associated CVEs like CVE-2016-3714 and CVE-2016-3718. This post demonstrates how an attacker can achieve Server-Side Request Forgery (SSRF) and ultimately Remote Code Execution (RCE) through various ImageMagick exploits, including Ghostscript vulnerabilities. The author utilized Burp Suite for initial detection. |
| 2026-04-10 2026 | Complete Defense Against Node.js RCE: Real-World Exploit Analysis advanced 10 min read | Analysis of Node.js RCE vulnerabilities, including CVE-2022-24329, details how attackers exploit `child_process.exec` misuse and improper input validation to achieve command injection. The article contrasts vulnerable code patterns, such as direct passing of user input to `exec`, with secure alternatives like `spawn` or `execFile` and emphasizes strict input validation and sanitization to prevent shell meta-character interpretation. It also discusses the need for an integrated security approach, combining SAST/DAST, cloud workload security with SeekersLab's FRIIM CNAPP, and real-time threat detection via Seekurity SIEM/SOAR, augmented by KYRA AI Sandbox for analyzing suspicious code. |
| 2026-04-10 2026 | Command Injection and RCE in MetaSpore (GHSL-2025-035 to 037) news 5 min read | Writeup detailing command injection (GHSL-2025-035) and RCE (GHSL-2025-037) vulnerabilities in MetaSpore's recommendation service. The command injection allows overwriting arbitrary files and leaking AWS tokens via the `aws s3 sync` command. The RCE is achieved by exploiting an unprotected Consul instance and a Spring Expression Language injection in `spring.application.name`, leading to arbitrary code execution. An additional vulnerability (GHSL-2025-036) involves sensitive Spring Boot Actuator endpoints being exposed without authentication. → securitylab.github.com |
| 2026-04-10 2026 | Command Injection RCE in Kubernetes Log Query on Windows intermediate | Command Injection RCE in Kubernetes Log Query on Windows → akamai.com |
| 2026-04-10 2026 | Prompt Injection to RCE in AI Agents intermediate 10 min read | Writeup on prompt injection leading to RCE in AI agents, detailing design antipatterns that enable argument injection attacks against pre-approved commands. The article demonstrates one-shot RCE exploits across three AI agent platforms, bypassing human approval through techniques like `go test -exec` and `git show --format`/`ripgrep --pre`. Recommendations focus on limiting impact via sandboxing and argument separation for developers, users, and security engineers. → blog.trailofbits.com |
| 2026-04-10 2026 | React2Shell and RSC Vulnerabilities: Exploitation Threat Brief intermediate 8 min read | Library rules protecting against React2Shell (CVE-2025-55182), CVE-2025-55183, and CVE-2025-55184 offer protection for React Server Components. Exploitation attempts, including those by Asian-nexus threat groups, were observed shortly after public disclosure, utilizing vulnerability scanners like Nuclei and Burp Suite. Threat actors employed Internet-wide scanning, asset discovery platforms, and metadata analysis, including SSL certificate details, to identify vulnerable deployments, with targeted efforts observed against geopolitical intelligence priorities, government entities, and critical infrastructure. → blog.cloudflare.com |
| 2026-04-10 2026 | CVE-2025-55182: React Server Components RCE via Flight Payload Deserialization intermediate 4 min read | Writeup of CVE-2025-55182, a critical RCE in React Server Components. This vulnerability allows unauthenticated attackers to achieve arbitrary JavaScript execution on the server by crafting malicious Flight payloads that exploit unsafe deserialization of Chunks. The attack leverages Promise resolution and nested deserialization to control server-side functions, enabling actions like file reading or command execution. Public exploit code exists, and affected versions include 19.0, 19.1.0, 19.1.1, and 19.2.0. |
| 2026-04-10 2026 | n8n CVE-2025-68613 RCE Exploitation: A Detailed Guide intermediate 11 min read | Guide to CVE-2025-68613, a critical remote code execution vulnerability in n8n. This flaw, with a CVSS score of 9.9, allows authenticated users to compromise the entire system by injecting JavaScript expressions. Exploitation can lead to arbitrary command execution, file access, secret theft, and lateral movement within connected systems. The guide details the vulnerability's technical underpinnings, impact, and provides exploitation and testing examples across various n8n interfaces and API endpoints. |
| 2026-04-10 2026 | 2025 Zero-Days in Review: Lessons Learned news 22 min read | Survey of 2025 zero-day exploits reveals a continued shift towards enterprise targets, with 48% of tracked vulnerabilities impacting enterprise software and edge devices. State-sponsored espionage groups, particularly those linked to the People's Republic of China (PRC) such as UNC5221 and UNC3886, heavily favored these technologies for initial network access, while commercial surveillance vendors also expanded their exploit chain development. Malware campaigns like BRICKSTORM highlighted a new paradigm of using stolen IP for long-term zero-day development. → cloud.google.com |
| 2026-04-10 2026 | Multiple Threat Actors Exploit React2Shell (CVE-2025-55182) news 8 min read | Writeup detailing exploitation of CVE-2025-55182 ("React2Shell"), a critical RCE in React Server Components, by multiple threat actors including China-nexus espionage groups. Observed payloads include MINOCAT, SNOWLIGHT, HISONIC, COMPOOD backdoors, and XMRIG miners. The writeup highlights exploitation chains and post-compromise behaviors, with specific mention of UNC6600, UNC6586, UNC6588, and UNC6603 actors, and their deployment of these tools. It also addresses misinformation surrounding initial exploit disclosures, noting a GitHub repository that initially contained non-functional AI-generated exploit code before updating with legitimate, obfuscated samples. → cloud.google.com |
| 2026-04-10 2026 | React2Shell: Critical Unauthenticated RCE in React Server Components intermediate 4 min read | Writeup of CVE-2025-55182, a critical unauthenticated RCE vulnerability affecting React Server Components and frameworks like Next.js, dubbed React2Shell. Exploitation in-the-wild has begun, with a working proof-of-concept and Metasploit module available. The vulnerability, with a CVSS of 10.0, allows attackers to execute arbitrary code via malicious HTTP requests. Remediation involves updating affected React packages to versions 19.0.1, 19.1.2, or 19.2.1. Rapid7 customers have detection capabilities via Exposure Command, InsightVM, and Nexpose. → rapid7.com |
| 2026-04-10 2026 | Defending Against React2Shell in React Server Components intermediate 12 min read | Reference detailing CVE-2025-55182 (React2Shell), a critical pre-authentication RCE vulnerability in React Server Components, affecting frameworks like Next.js. The vulnerability, stemming from insecure payload validation and prototype pollution, allows attackers to execute arbitrary code via a single HTTP request. Observed exploits target Windows and Linux environments, deploying coin miners and RATs, and attempting to steal cloud credentials using tools like TruffleHog and Gitleaks. Mitigation includes immediate patching to updated React and Next.js versions, prioritizing internet-facing assets, and potentially using WAF protections. → microsoft.com |
| 2026-04-10 2026 | Gogs Zero-Day RCE (CVE-2025-8110) Actively Exploited news 6 min read | Writeup detailing CVE-2025-8110, an actively exploited RCE in Gogs, a self-hosted Git service. This vulnerability is a symlink bypass of a previous RCE (CVE-2024-55947), allowing authenticated users to overwrite files outside the repository via the PutContents API. The exploit chain involves committing a symlink and then using the API to overwrite sensitive files like `.git/config`. Wiz Research discovered this zero-day during an investigation, finding over 700 compromised instances public-facing. A fix is available in Gogs version v0.13.4. → wiz.io |
| 2026-04-10 2026 | SharePoint RCE: Exploitation, Detection, and Mitigation intermediate | SharePoint RCE: Exploitation, Detection, and Mitigation → akamai.com |
| 2026-04-10 2026 | Apache ActiveMQ RCE via Jolokia API (CVE-2026-34197) intermediate 2 min read | Writeup of CVE-2026-34197, an Apache ActiveMQ Classic RCE vulnerability leveraging the Jolokia JMX-HTTP bridge to trigger Remote Code Execution via a crafted discovery URI. Attackers can exploit this by invoking operations like BrokerService.addNetworkConnector, loading a remote Spring XML application context that leads to arbitrary code execution through Runtime.exec(). This flaw, with a CVSS score of 8.8, is particularly critical on versions 6.0.0-6.1.1 due to CVE-2024-32114, which makes exploitation unauthenticated. Patches are available in ActiveMQ Classic 5.19.4 and 6.2.3. |
| 2026-04-10 2026 | Telnet Vulnerability Opens Door to Remote Code Execution as Root intermediate 2 min read | Writeup on CVE-2026-32746, a critical vulnerability in GNU inetutils telnetd allowing pre-authentication remote code execution as root. Triggered by a buffer overflow in the LINEMODE Set Local Characters (SLC) handler, exploitation can lead to full system compromise on affected legacy infrastructure, networking equipment, and embedded systems. The flaw enables arbitrary memory writes via a corrupted pointer after exceeding a fixed buffer. Migrating to SSH, disabling telnetd, or blocking port 23 are recommended workarounds. → csoonline.com |
| 2026-04-10 2026 | CVE-2026-23744: Remote Code Execution in MCPJam Inspector PoC news | CVE-2026-23744: Remote Code Execution in MCPJam Inspector PoC |
| 2026-04-10 2026 | Remote Code Execution (RCE) 101 beginner | Remote Code Execution (RCE) 101 → bugcrowd.com |
| 2026-04-10 2026 | How I Got RCE in One of Bugcrowd's Public Programs intermediate | How I Got RCE in One of Bugcrowd's Public Programs |
| 2026-04-10 2026 | From Recon to RCE: Hunting React2Shell (CVE-2025-55182) intermediate | From Recon to RCE: Hunting React2Shell (CVE-2025-55182) → infosecwriteups.com |
| 2026-04-10 2026 | RCE via Unclaimed Node Package: $2,500 Bug Bounty Writeup intermediate | RCE via Unclaimed Node Package: $2,500 Bug Bounty Writeup |
| 2026-04-10 2026 | Max Severity Flowise RCE Vulnerability Now Exploited in Attacks news 2 min read | Library for securing Flowise, an open-source platform for LLM apps. It addresses CVE-2025-59528, a critical RCE vulnerability allowing arbitrary JavaScript code injection via the CustomMCP node. Developers should upgrade to version 3.0.6 or later to mitigate this threat, which has already been observed in active exploitation. Other Flowise vulnerabilities, CVE-2025-8943 and CVE-2025-26319, have also seen in-the-wild exploitation. → bleepingcomputer.com |
| 2026-04-10 2026 | CVE-2026-35056: XenForo RCE Vulnerability for Admin Accounts news 1 min read | Writeup of CVE-2026-35056, a High severity (CVSS 4.0: 8.6) Code Injection vulnerability in XenForo versions prior to 2.3.9 and 2.2.18. This RCE vulnerability allows authenticated admin users to execute arbitrary code remotely. While no public proof-of-concept or active exploitation has been confirmed, users should promptly apply vendor patches and review the official advisory for affected systems. |
| 2026-04-10 2026 | CVE-2026-1731: Critical Unauthenticated RCE in BeyondTrust Remote Support news 2 min read | Writeup of CVE-2026-1731, a critical unauthenticated RCE in BeyondTrust Remote Support and Privileged Remote Access products, which allows attackers to execute arbitrary OS commands. This vulnerability, with a CVSSv4 score of 9.9, affects RS versions 25.3.1 and prior, and PRA versions 24.3.4 and prior. While SaaS instances were patched, self-hosted deployments require manual updates. Discovered by Hacktron AI, the flaw was added to CISA's KEV list on February 13, 2026. Rapid7 customers using Exposure Command, InsightVM, and Nexpose can assess their exposure with authenticated checks released February 9, 2026. → rapid7.com |
| 2026-04-10 2026 | Critical n8n Flaws Allow Remote Code Execution and Credential Exposure news 3 min read | Writeup detailing critical n8n vulnerabilities including CVE-2026-27577 (expression sandbox escape for RCE) and CVE-2026-27493 (unauthenticated expression evaluation via Form nodes). These flaws, along with CVE-2026-27495 (JavaScript Task Runner code injection) and CVE-2026-27497 (Merge node SQL query mode RCE), allow for arbitrary code execution and credential exposure. Patched versions are 2.10.1, 2.9.3, and 1.123.22. → thehackernews.com |
| 2026-04-09 2026 | CISA adds second critical flaw in Ivanti EPMM to exploited vulnerabilities catalog news | CISA adds second critical flaw in Ivanti EPMM to exploited vulnerabilities catalog https://ift.tt/vfeE3wl → cybersecuritydive.com |
| 2026-04-09 2026 | Claude helps researcher dig up decade-old Apache ActiveMQ RCE vulnerability (CVE-2026-34197) news 2 min read | Writeup detailing CVE-2026-34197, a decade-old RCE vulnerability in Apache ActiveMQ Classic stemming from improper input validation and code injection. This vulnerability, exploitable with default credentials or unauthenticated in certain versions due to CVE-2024-32114, was discovered with AI assistance. Mitigation involves upgrading to ActiveMQ versions 6.2.3 or 5.19.4 and monitoring logs for specific indicators of compromise. CISA has since added CVE-2026-34197 to its Known Exploited Vulnerabilities catalog. → helpnetsecurity.com |
| 2026-04-09 2026 | ThreatsDay Bulletin: Hybrid P2P Botnet 13-Year Apache RCE ClickFix Node.js RAT & 18 More Stories news 13 min read | Library for securing applications, featuring protections against hybrid Phorpiex botnet variants, chained Apache ActiveMQ Classic RCE vulnerabilities (CVE-2026-34197, CVE-2024-32114, CVE-2022-41678), AI-driven DDoS tactics amplified by IoT botnets like TurboMirai, Magecart skimmers hidden in SVG elements affecting Magento stores, and malicious MSI installers delivering Node.js RATs. → thehackernews.com |
| 2026-04-08 2026 | 13-year-old bug in ActiveMQ lets hackers remotely execute commands news 2 min read | Writeup detailing CVE-2026-34197, a 13-year-old remote code execution vulnerability in Apache ActiveMQ Classic affecting versions before 5.19.4 and 6.2.3. Discovered using Claude AI, the flaw allows attackers to execute arbitrary commands by exploiting the Jolokia management API to load external configurations, often chaining with CVE-2024-32114 for unauthenticated access. This issue underscores ActiveMQ's history as a target for attackers, with previous RCEs like CVE-2016-3088 and CVE-2023-46604 appearing on CISA's KEV list. → bleepingcomputer.com |
| 2026-04-08 2026 | RCE Bug Lurked in Apache ActiveMQ Classic for 13 Years news 2 min read | Writeup of CVE-2026-34197, a critical RCE vulnerability in Apache ActiveMQ Classic discovered by Horizon3.ai. This flaw, present for 13 years, can be chained with CVE-2022-41678, allowing attackers to exploit the Jolokia API and VM transport to execute OS commands. In some deployments, it can be combined with CVE-2024-32114 for unauthenticated RCE. Updates to ActiveMQ Classic 5.19.4 and 6.2.3 are recommended. → securityweek.com |
| 2026-04-08 2026 | Fortinet FortiClientEMS Remote Code Execution Vulnerability news | Writeup of CVE-2026-35616 in FortiClientEMS, an Improper Access Control vulnerability allowing unauthenticated attackers to execute unauthorized code or commands via crafted requests. Exploited in the wild, this vulnerability can lead to remote code execution and elevation of privilege on affected systems. Users should update to FortiClientEMS 7.4.7 or later. → hkcert.org |
| 2026-04-08 2026 | Hackers Targeting Ninja Forms Bug That Exposes WordPress Sites to Takeover news 1 min read | Writeup on CVE-2026-0740, a critical unauthenticated arbitrary file upload vulnerability in Ninja Forms' File Uploads addon. This flaw, with a CVSS score of 9.8, allows attackers to bypass file type validation and use path traversal to upload malicious PHP code to the webroot, enabling remote code execution and complete site takeover. Defiant reports thousands of exploitation attempts against the ~50,000 affected websites. Users should update to version 3.3.27. → securityweek.com |
| 2026-04-08 2026 | Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations news 11 min read | Library detailing Storm-1175's high-tempo Medusa ransomware operations, exploiting N-days like CVE-2023-21529 (Microsoft Exchange), CVE-2023-27351 (Papercut), and CVE-2024-21887 (Ivanti), alongside zero-days. The actor rapidly chains exploits, establishes persistence via new users, uses tools like PsExec and RMMs (Atera, N-able), PDQ Deployer, and Impacket for lateral movement and credential theft before deploying ransomware. → microsoft.com |
| 2026-04-07 2026 | Attackers exploit critical Flowise flaw CVE-2025-59528 for remote code execution news 2 min read | Writeup of CVE-2025-59528 in Flowise, detailing how attackers exploit improper JavaScript validation in the CustomMCP node for remote code execution and file system access. The vulnerability, fixed in version 3.0.6, allows arbitrary JavaScript execution with full Node.js privileges, enabling command execution and data theft, and has seen active exploitation in the wild, targeting thousands of exposed instances. → securityaffairs.com |
| 2026-04-07 2026 | Hackers exploit critical flaw in Ninja Forms WordPress plugin news 2 min read | Writeup detailing CVE-2026-0740, a critical 9.8 severity vulnerability in Ninja Forms File Uploads for WordPress versions up to 3.3.26. The flaw allows unauthenticated arbitrary file uploads, including PHP scripts, through a lack of destination filename validation and supports path traversal, enabling remote code execution. The vulnerability was discovered by Sélim Lanouar and reported to Wordfence, who provided temporary firewall mitigations before the vendor released a full fix in version 3.3.27. → bleepingcomputer.com |
| 2026-04-07 2026 | Critical Flowise Vulnerability in Attacker Crosshairs news 2 min read | Library updates address CVE-2025-59528, a critical remote code execution vulnerability in Flowise affecting versions up to 3.0.5. This flaw allows attackers to exploit unvalidated user-supplied JavaScript in MCP server configuration, granting full Node.js runtime privileges and access to the file system. Threat actors are actively exploiting this bug, posing an extreme risk to business continuity and sensitive data for thousands of exposed Flowise instances. Version 3.0.6 includes the patch. → securityweek.com |
| 2026-04-07 2026 | Over 1000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign news 7 min read | Tooling identified in a campaign targeting over 1000 exposed ComfyUI instances allows attackers to exploit custom node vulnerabilities for remote code execution. This enables enrollment into a cryptomining botnet for Monero and Conflux using XMRig and lolMiner, and deployment into a Hysteria V2 proxy botnet. The attack leverages tools that scan for vulnerable ComfyUI instances, install malicious nodes like "ComfyUI-Shell-Executor," and establish persistence via shell scripts that disable history, kill competing miners, and use `LD_PRELOAD` hooks and `chattr +i` for resilience. → thehackernews.com |
| 2026-04-07 2026 | Fortinet Releases Emergency Patch After FortiClient EMS Bug Is Exploited news 1 min read | Writeup of CVE-2026-35616, a critical improper access control vulnerability affecting FortiClient EMS, which has been exploited in the wild, allowing unauthenticated attackers to execute unauthorized code via crafted requests. This follows the discovery and exploitation of another critical flaw, CVE-2026-21643, an SQL injection vulnerability in the same platform, highlighting the significant risks associated with compromised endpoint management infrastructure. → infosecurity-magazine.com |
| 2026-04-07 2026 | Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12000 Instances Exposed news 1 min read | Writeup on CVE-2025-59528, a CVSS 10.0 code injection vulnerability in Flowise AI Agent Builder, allowing remote code execution via JavaScript code injection, similar to prior Flowise flaws like CVE-2025-8943 and CVE-2025-26319. Exploitation can grant access to Node.js modules like `child_process` and `fs`, enabling system compromise, file access, and data exfiltration. Over 12,000 instances remain exposed, facing active exploitation. → thehackernews.com |
| 2026-04-07 2026 | AI agents found vulns in this popular Linux and Unix print server news 4 min read | Writeup of CVE-2026-34980 and CVE-2026-34990 in CUPS, a popular Linux and Unix print server, detailing how two chained vulnerabilities allow unauthenticated remote attackers to execute code and achieve root file overwrite. The flaws, discovered by AI agents and a security researcher, exploit CUPS' handling of anonymous print-job requests and option parsing to enable code injection. CVE-2026-34980 provides remote code execution as the `lp` user, which can then be chained with CVE-2026-34990, an authorization flaw, to gain root privileges. → theregister.com |
| 2026-04-06 2026 | CVE-2026-2699-and-CVE-2026-2701 news 1 min read | Writeup detailing CVE-2026-2699 and CVE-2026-2701, two critical severity vulnerabilities in Progress ShareFile Storage Zones Controller (SZC) 5.x. CVE-2026-2699, an authentication bypass via improper redirect/session handling, allows unauthenticated access to administrative functions. When combined with CVE-2026-2701, an arbitrary file upload to the webroot flaw, these vulnerabilities enable pre-authentication remote code execution. Affected versions include SZC 5.x up to 5.12.3, with fixes available in 5.12.4. → arcticwolf.com |
| 2026-04-06 2026 | Attackers Exploit RCE Flaw as 14000 F5 BIG-IP APM Instances Remain Exposed news 1 min read | Writeup detailing CVE-2025-53521, a critical RCE vulnerability affecting F5 BIG-IP APM instances. Attackers are actively exploiting this flaw, which allows specially crafted traffic to trigger remote code execution when access policies are enabled. Shadowserver reports over 14,000 exposed instances, with CISA adding the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by March 30, 2026. → securityaffairs.com |
| 2026-04-06 2026 | Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992) news 1 min read | Patch for CVE-2026-21992, a critical pre-authentication RCE vulnerability in Oracle Identity Manager and Oracle Web Services Manager, is available. This unauthenticated flaw, affecting versions 12.2.1.4.0 and 14.1.2.1.0, mirrors the exploited CVE-2025-61757, also a missing authentication issue in Identity Manager reported by Assetnote / Searchlight Cyber. Urgent application of this emergency fix is recommended to prevent system takeover. → helpnetsecurity.com |
| 2026-04-06 2026 | Critical Flaws Identified in Progress Software ShareFile Service news | Critical Flaws Identified in Progress Software ShareFile Service https://ift.tt/ERZfLV6 |
| 2026-04-06 2026 | Metasploit Wrap-Up 04/03/2026 news 4 min read | Library updates for Metasploit Framework introduce new HTTP/HTTPS CMD payloads for Windows, enabling RCE against FreeScout (CVE-2026-27636, CVE-2026-28289) and Grav CMS (CVE-2025-50286). It also adds a generic HTTP command execution exploit, a Windows persistence technique via `UserInitMprLogonScript`, and various enhancements, bug fixes, and documentation updates. → rapid7.com |
| 2026-04-06 2026 | Multiple Vulnerabilities in Progress ShareFile Could Allow for Remote Code Execution news 4 min read | Advisory detailing multiple vulnerabilities in Progress ShareFile versions prior to 5.12.4. Chained exploitation of an authentication bypass (CVE-2026-2699) and a remote code execution flaw (CVE-2026-2701) allows attackers to upload malicious ASPX webshells via abuse of file upload and extraction functionality. Public proof-of-concept code is available for the mentioned CVEs. |
| 2026-04-06 2026 | Critical RCE Vulnerability in F5 BIG-IP Under Exploitation news | Critical RCE Vulnerability in F5 BIG-IP Under Exploitation |
| 2026-04-06 2026 | CVE-2026-20131 Cisco FMC RCE Vulnerability news 3 min read | Writeup of CVE-2026-20131, a critical RCE vulnerability in Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control Firewall Management. This insecure deserialization flaw in the web interface allows unauthenticated remote attackers to execute arbitrary code as root, and has been observed in ransomware campaigns. The vulnerability affects specific Cisco FMC and Security Cloud Control Firewall Management versions, with Cisco issuing software updates as the sole remediation. → horizon3.ai |
| 2026-04-06 2026 | Emerging Threat: CVE-2026-27876 Grafana Remote Code Execution via SQL Expressions news 3 min read | Writeup of CVE-2026-27876, a critical RCE vulnerability in Grafana's sqlExpressions feature, allowing arbitrary file writes to achieve remote code execution. Exploitable with viewer access, it affects specific versions of Grafana 11 and 12 when the feature is enabled, particularly impacting Information Technology and Communication Services sectors. Patches are available, with workarounds including disabling the feature toggle and network restriction. |