Tagged: CVE
12 posts · browse all tags
-
A Backdoor Named forticloud-sync: Inside the Gunra Ransomware Advisory and Two Fortinet CVEs From Early 2025
Six agencies, one ransomware gang, and two Fortinet CVEs that have been patchable since early 2025 and are still getting exploited. The most interesting detail in the advisory isn't the encryption — it's an MFA bypass that leaves the identity provider's own logs looking completely clean.
-
The One DNS Patch That's Actually Wormable: Inside CVE-2026-62878 on Windows DNS Server
August 2026 Patch Tuesday shipped four separate Windows DNS Server RCE fixes. Only one is unauthenticated, needs no user interaction, and is a wormable stack-based buffer overflow: CVE-2026-62878, CVSS 9.8, on a service that's usually running directly on your domain controllers.
-
Two Ways to Lose a VPN Gateway: FortiBleed's Credential Harvest and PAN-OS's Forged Auth Cookie
Two 2026 VPN gateway incidents, same attack surface, opposite root causes. FortiBleed has no CVE and no patch: a hashing migration that never finished, cracked at scale. CVE-2026-0257 is a real code defect: a certificate reused for two trust purposes that led straight to Qilin ransomware.
-
One Crafted Request From a Reload: Inside CVE-2026-20349 on Cisco Secure Firewall ASA and FTD
An unauthenticated attacker who can reach the Remote Access SSL VPN service on an ASA or FTD device can crash it with one crafted HTTP request. No login, no workaround, just a reload. What CVE-2026-20349 actually is, and why VPN-facing edges keep being the softest part of the firewall.
-
Seven CWEs, One Advisory: Cisco's August 2026 IOS XE Hardening Release
Cisco's IOS XE team ran the same internal-review model it used on Catalyst SD-WAN in August, grouping fixes by CWE class instead of shipping one CVE per bug. Seven CVE IDs, seven vulnerability classes, no known exploitation, and the same AI-assisted discovery line in the source section.
-
The Wildcard That Wasn't: CVE-2026-26035 and FortiWeb's RADIUS Admin Login Bypass
A non-default setting meant to make RADIUS group matching more flexible turns into a way to log into FortiWeb's GUI and CLI with a username and password that don't need to be correct. CVE-2026-26035, and why "wildcard" is a word worth treating with suspicion in any auth config.
-
Wearing Someone Else's Certificate: CVE-2026-70468 and FortiManager's FGFM Trust Model
A specific CLI option, a valid certificate, and a crafted FGFM request are enough to let one managed FortiGate impersonate any other in the eyes of its FortiManager. CVE-2026-70468, and what it says about certificate trust in a one-to-many management protocol.
-
NatJack: What a NAT-Table Hijack Means When You're the One Designing the NAT Boundary
NatJack broke a twenty-year-old assumption about who you can trust behind a shared NAT. Most of the coverage this week is either pure vulnerability research or "check your home router." This is the multi-tenant hub version of that question.
-
One CSV Upload From Root: Inside CVE-2026-20245 on Cisco Catalyst SD-WAN Manager
A rogue peering connection, a password changed and quietly changed back, then one crafted CSV file that turned an admin session into root. Mandiant's writeup of CVE-2026-20245 is the missing middle chapter between this site's UAT-8616 post and August's hardening release.
-
Declare Yourself Trusted: Inside UAT-8616's Three-Year Run Against Cisco Catalyst SD-WAN
Two maximum-severity Cisco Catalyst SD-WAN authentication bypasses, one threat actor, three years of quiet control-plane access. What CVE-2026-20182 and CVE-2026-20127 actually broke, how UAT-8616 used it, and what the fix demands beyond patching.
-
Marking Its Own Homework: Inside Cisco's August 2026 Catalyst SD-WAN Hardening Release
Three months after UAT-8616 forced Cisco's hand on SD-WAN, a different kind of disclosure: an internal security review, five CWE-grouped CVEs up to CVSS 9.9, and an admission that some of the bugs were found by AI models, not people.
-
CVE-2026-45504 Part 2: Inside the WOPI SSRF and Arbitrary File Read
A technical walkthrough of what CVE-2026-45504 actually does: a missing scheme check on an EWS ReferenceAttachment's provider URL, cited to Microsoft's advisory and HawkTrace's published research rather than reproduced as working exploit code.