DEV Community: threataft

Splunk Patched an Unauthenticated RCE in Its Own SIEM — Here's What You Need to Know

threataft — Thu, 08 Oct 2026 05:26:16 +0000

An unauthenticated attacker with network access to a Splunk search head cluster member can execute arbitrary OS commands. No credentials. No interaction.

CVE-2026-76268 | CVSS 9.1 | Affects 10.4.x and 10.2.x only

What's vulnerable

Splunk Enterprise ships with Patroni — a PostgreSQL high-availability tool — running a REST API on search head cluster members. That API has no authentication on critical operations. Network access is enough.

Affected: 10.4.0–10.4.2 and 10.2.0–10.2.6.
Not affected: 10.0.x and 9.4.x.

Why a SIEM RCE is especially bad

A compromised Splunk deployment isn't just a breach — it's a blind spot. Attackers with command execution on a search head can:

Suppress or delete alerts
Modify detection rules and saved searches
Exfiltrate every log your org has shipped to Splunk
Pivot to other systems via Splunk's broad network access

The workaround (if you can't patch yet)

An unauthenticated attacker with network access to a Splunk search head cluster member can execute arbitrary OS commands. No credentials. No interaction.

CVE-2026-76268 | CVSS 9.1 | Affects 10.4.x and 10.2.x only

What's vulnerable

Affected: 10.4.0–10.4.2 and 10.2.0–10.2.6.
Not affected: 10.0.x and 9.4.x.

Why a SIEM RCE is especially bad

A compromised Splunk deployment isn't just a breach — it's a blind spot. Attackers with command execution on a search head can:

Suppress or delete alerts
Modify detection rules and saved searches
Exfiltrate every log your org has shipped to Splunk
Pivot to other systems via Splunk's broad network access

The workaround (if you can't patch yet)

Set disabled = true in the [postgres] stanza of $SPLUNK_HOME/etc/system/local/server.conf, then restart Splunk.

Only safe to do if you're not using Edge Processor, OpAmp, or SPL2 data pipelines. If you are — patch first, no workaround.

The rest of the disclosure

17 CVEs total across all four branches (10.4, 10.2, 10.0, 9.4):

CVE-2026-76266 (7.7) — local user runs commands as Splunk service account on Linux → loads attacker-controlled shared library → privilege escalation
CVE-2026-76270 (6.5) — SQL injection in SPL2 module filtering, 10.4 only
CVE-2026-76274 (6.5) — SSRF in Splunk App for Observability Cloud → leaks API token
CVE-2026-76286 (5.3) — SSRF in Splunk MCP Server leaks auth token to attacker-controlled host

Fixed versions: 10.4.3, 10.2.7, 10.0.10, 9.4.15

Quick checklist


bash
# Check your version
splunk version

# Apply workaround if not on 10.4/10.2 with pipelines in use
echo "[postgres]
disabled = true" >> $SPLUNK_HOME/etc/system/local/server.conf
splunk restart

 https://threataft.com/articles/splunk-mass-disclosure-cve-2026-76268-patroni-rce

Cisco Dropped 18 CVEs Yesterday — Here's What Actually Needs Your Attention

threataft — Thu, 08 Oct 2026 05:24:45 +0000

Seven critical CVEs across two product lines. None exploited yet. No workarounds exist. Here's the fast triage.

NX-OS NGOAM — 3 × CVSS 9.8 Unauthenticated RCE

CVE-2026-76485, CVE-2026-76486, CVE-2026-76501

Affects: Cisco Nexus 3000 and 9000 Series switches

The NGOAM (VXLAN OAM) feature has improper input validation on IP traffic. Crafted packets → root code execution, no auth required. Each CVE has slightly different feature prerequisites:

CVE	Requires
CVE-2026-76485	NGOAM + SRv6 OR NV Overlay
CVE-2026-76486	NGOAM + NV Overlay + at least one peer VTEP
CVE-2026-76501	NGOAM + SRv6 (Nexus 9000 only — 3000 doesn't support SRv6)

Check your exposure right now:


bash
show feature | include ngoam
show feature | include nve
show feature | include srv6

CVE-2026-94293: AAS Edge Client — CVSS 9.8 IIoT Data Tampering, No Patch, Decommission Now

threataft — Tue, 06 Oct 2026 11:30:29 +0000

CVE-2026-94293 (CVSS 9.8) — Murrelektronik's Software AAS Edge Client exposes an unauthenticated REST API on TCP port 18000 bound to all interfaces. Any network-reachable attacker can read all AAS submodel data via GET and overwrite it via PATCH — no credentials, no user interaction, no exploit code required.
Modified data propagates to central AAS servers, extending impact downstream. CORS is unrestricted, so browser-based attacks work too.
No patch. Vendor has archived the repositories and recommends decommissioning.
The practical risk: this was a trade-fair demonstrator, so it may be running in environments where it was never formally inventoried. Check containers and edge deployments.
Full analysis → https://threataft.com/articles/aas-edge-client-cve-2026-94293

HyperShift CVE-2026-101919 — CVSS 8.8 Tenant Isolation Bypass via Kubeconfig Passthrough

threataft — Tue, 06 Oct 2026 01:55:30 +0000

An authenticated tenant with basic namespace permissions can break out to the host control plane in OpenShift clusters running Multicluster Engine with HyperShift.

CVE-2026-101919 (CVSS 3.1 8.8, Red Hat: Important) is an improper input validation flaw in the hypershift-rhel9-operator. The ReconcileCredentials function copies a user-provided kubeconfig Secret verbatim into the privileged control plane namespace:

// illustrative — simplified from source
for k, v := range sourceSecret.Data {
targetSecret.Data[k] = v
}

No exec-provider stripping, no AuthProvider validation, no InsecureSkipTLSVerify guard. A tenant embeds a malicious exec plugin in their kubeconfig → operator copies it to the control plane namespace → downstream controller (CAPK) consumes it → plugin executes with control plane privileges.

Impact:

Arbitrary code execution in the control plane namespace
Access to all control plane secrets
Lateral movement across tenant boundaries
Tenant isolation guarantee defeated

No public PoC. Patch is available.

Immediate mitigations:

Patch the HyperShift operator via your cluster update mechanism
Restrict Secret creation to trusted accounts in HyperShift-watched namespaces
Deploy admission webhook to reject kubeconfig Secrets containing exec plugins
Audit existing kubeconfig Secrets for embedded plugins

Full analysis: https://threataft.com/articles/hypershift-tenant-isolation-bypass-cve-2026-101919

Legcord (Discord Client) — 2 CVEs: XSS in Discord Page Becomes RCE + Persistent Traffic Interception

threataft — Mon, 05 Oct 2026 13:08:04 +0000

If you use Legcord as your Discord client, a script running in the Discord page can break out of the Electron sandbox entirely.

CVE-2026-105293 (CVSS 8.1) — Path Traversal to RCE
Theme IPC handlers (themes.install, themes.uninstall, themes.folder) accept identifiers without sanitizing ../ sequences. Discord-origin script passes a traversal payload → writes arbitrary files, deletes directories, or launches local executables outside the themes directory.

CVE-2026-105294 (CVSS 7.4) — Config Injection → Persistent MITM
window.legcord.settings.setConfig has no allowlist. Script sets additionalArguments to --proxy-server=attacker-host --ignore-certificate-errors. Persists to disk. Every subsequent Legcord launch routes all traffic through the attacker's proxy with TLS validation silently disabled.

Both require Discord-origin XSS first — not drive-by, but chain-dependent exploitation is realistic.

No confirmed fixed version as of publication. Upgrade past 1.3.0 and check your config for injected proxy switches.

ZITADEL Cluster: 7 CVEs, Peak CVSS 9.3 — Cross-Org Account Takeover via Passkey Enrollment

threataft — Mon, 05 Oct 2026 06:29:51 +0000

An attacker with minimal write permissions in one ZITADEL organization can take over accounts in another. CVE-2026-105209 (CVSS 9.3) lets them forge the x-zitadel-orgid header to issue passkey enrollment codes for users in any other org — then register their own authenticator.

Two more critical paths in the same cluster:

CVE-2026-105215 (9.1) — account pre-hijacking via forged IdP callback fields (no auth required)
CVE-2026-105211 (8.1) — OTP codes leaked in Login V2 server-action responses, MFA bypassed
CVE-2026-105210 (8.8) — 2FA enrollment bypass in Login V1
CVE-2026-105208 (7.7) — session hijacking via malleable IdP intent token encryption

Fix: upgrade to 4.17.3 (4.x) or 3.4.15 (3.x). Then audit cross-org passkey enrollments and rotate admin credentials.

Full breakdown: https://threataft.com/articles/zitadel-cluster-cve-2026-105209-105215-105211-105208-105206-105210-105213

CVE-2026-88779 — Citrix NetScaler SAML Memory Overflow, Actively Exploited, CISA KEV

threataft — Mon, 05 Oct 2026 01:52:18 +0000

A memory overflow in Citrix NetScaler's SAML handler is being actively exploited as a zero-day. CISA added CVE-2026-88779 to the Known Exploited Vulnerabilities catalog on October 4, 2026.

CVE-2026-88779 (CVSS 4.0: 8.7) — Unauthenticated memory overflow (CWE-119) triggered by malicious SAML requests. Crashes the appliance's authentication service, denying VPN and SSO access to the entire organization. Citrix confirms DoS; Norway's NSM initially reported potential RCE — scope remains contested.

If either returns results and you're below the fix versions, patch now.

Fixed in:

14.1-73.41 (14.1 track)
13.1-64.28 (13.1 track)
14.1-73.41 FIPS / 13.1-37.282 (FIPS/NDcPP)

Kevin Beaumont observed exploitation on honeypots running fully patched versions — the exploit may bypass the previous patch batch.

Immediate actions:

Patch to fixed version
Apply Citrix Global Deny List signatures as interim mitigation
Check for appliance crashes during the zero-day window
Run compromise assessment on any internet-exposed SAML-enabled appliance

Full analysis: https://threataft.com/articles/netscaler-saml-memory-overflow-cve-2026-88779

YesWiki 9 CVEs — CVSS 8.6 SQL Injection Can Dump Your Entire Database

threataft — Sat, 03 Oct 2026 13:32:44 +0000

Nine vulnerabilities hit YesWiki on October 2, 2026. The lead flaw is CVE-2026-104457 (CVSS 8.6) — unauthenticated SQL injection in the Bazar filtertags action. No login required. Attackers can read the entire database, including administrator password hashes, by injecting a UNION query through a crafted wiki page.

The cluster also includes three SSRF flaws (CVE-2026-104442, CVE-2026-104464, CVE-2026-104463) reaching internal hosts and cloud metadata endpoints, blind SQL injection (CVE-2026-104460), second-order SQL injection via the ACL service (CVE-2026-104456), CSRF enabling package deletion (CVE-2026-104447), and unauthenticated page overwrite (CVE-2026-104449).

All nine are fixed in YesWiki 4.6.7.

Full technical breakdown including root cause, attack chains, and mitigation checklist: https://threataft.com/articles/yeswiki-cluster-cve-2026-104442-104447-104456-104457-104449-104460-104464-104463-104458

UTMStack Cluster — 7 CVEs, Peak CVSS 9.9 Missing Auth on STOMP Command WebSocket

threataft — Sat, 03 Oct 2026 02:42:13 +0000

A single authenticated user with any role can execute arbitrary OS commands on every monitored endpoint in your UTMStack deployment. Seven CVEs dropped for the open-source SIEM platform, all fixed in 11.2.16.

The cluster:

CVE-2026-82041 (CVSS 9.9) — no role check on /command/{hostname} STOMP websocket → RCE on monitored endpoints
CVE-2026-82042 (CVSS 9.8) — Utm-Internal-Key header bypasses all auth, grants full admin API access
CVE-2026-82039 (CVSS 8.8) — SQL injection in asset group search via String.format() without parameter binding
CVE-2026-82044 (CVSS 7.7) — SSRF in PDF generation, can reach OpenSearch cluster and cloud metadata
CVE-2026-82045 (CVSS 6.5) — JPQL injection exposes credential tables including jhi_user
CVE-2026-82043 (CVSS 5.3) — account enumeration via password reset response discrepancy
CVE-2026-82040 (CVSS 5.0) — SSRF in identity provider metadata URL validation

Single fix: upgrade to UTMStack 11.2.16. Rotate INTERNAL_KEY. Audit agent command logs.

Full technical breakdown on ThreatAft →

WordPress Auth Bypass Cluster — 4 CVSS 9.8, Full Site Takeover via Plugin Flaws

threataft — Fri, 02 Oct 2026 13:42:27 +0000

Four WordPress plugins dropped CVSS 9.8 authentication bypass vulnerabilities on the same day. All four let unauthenticated attackers take over administrator accounts with no credentials required.

Affected plugins:

DevKit Pro ≤ 2.3.0 — cookie-based admin takeover via revert_switch (CVE-2026-14378)
Divi Membership ≤ 2.3.0 — unauthenticated login via paypal_param GET parameter (CVE-2026-19660)
JSON API Auth ≤ 3.1.2 — cached admin session cookie served to unauthenticated requests (CVE-2026-97637)
WPMobile.App ≤ 11.82 — password-reset URLs exposed via push queue (CVE-2026-94541)

Wordfence blocked 137 attacks targeting WPMobile.App in 24 hours. Public PoC with mass-scan capability exists for DevKit Pro.

Fixed versions: DevKit Pro 2.3.1, Divi Membership 3.0.0, JSON API Auth 3.1.3, WPMobile.App 11.85.

Full technical breakdown on ThreatAft →

Ghost CMS Mass Disclosure — 6 CVEs Including CVSS 8.1 Staff Session Bypass

threataft — Fri, 02 Oct 2026 08:28:00 +0000

A Ghost staff user with valid credentials can log into any other staff account using only the target's password — bypassing 2FA entirely.

CVE-2026-103283 (CVSS 8.1) leads a cluster of six vulnerabilities in Ghost CMS disclosed October 1. Here's the full picture:

CVE-2026-103283 (8.1) — Staff session bypass. Any authenticated staff user can impersonate any other staff member with just their password. 2FA does not protect against this. Fixed in 6.57.1.

CVE-2026-103271 (7.5) — Unauthenticated gated content access via the Content API. Subscription paywalls bypassed entirely. Fixed in 6.63.0.

CVE-2026-103266 (7.1) — Stripe Checkout abuse: unauthenticated attackers can attach subscriptions to member accounts and inject XSS into newsletters. Fixed in 6.62.0.

CVE-2026-103279 (6.8) — Session cookies stay valid after a password change. Standard breach response doesn't work. Fixed in 6.34.0.

CVE-2026-103291 (6.3) — SSRF via image dimension refetching. Staff users can hit cloud metadata endpoints. Fixed in 6.51.0.

CVE-2026-103275 (2.2) — Password hash inference via Admin API bulk endpoints. Fixed in 6.58.0.

Action: Upgrade to Ghost 6.63.0, rotate staff credentials, invalidate all active sessions.

Full breakdown → https://threataft.com/articles/ghost-cluster-cve-2026-103283-103271-103266-103279-103291-103275

Mooncake Mass Disclosure — CVSS 9.8 Arbitrary Memory Read/Write in KV Cache Transfer Engine

threataft — Fri, 02 Oct 2026 03:15:40 +0000

A crafted TCP packet to Mooncake's transfer data port is enough to read and write arbitrary process memory — no authentication required.

CVE-2026-103764 (CVSS 9.8) is an untrusted pointer dereference in ServerSession::readHeader. The readHeader function trusts attacker-supplied addr and size fields in the SessionHeader, making any exposed transfer data port a direct window into process memory.

CVE-2026-103765 (CVSS 9.4) is a missing authentication flaw in the HTTP metadata server's /metadata handler. Attackers can poison segment descriptors like tcp_data_port or re-create rpc_meta entries to redirect KV cache transfers to attacker-controlled listeners.

Two more: CVE-2026-103761 (CVSS 7.5) enables unbounded memory growth via uncapped notify frames. CVE-2026-103760 (CVSS 5.9) stalls the single-threaded handshake daemon by never reading a reply.

Patch status: CVE-2026-103764 is fixed in Mooncake 0.3.13. The other three affect versions through 0.3.13.post1 — no fix confirmed yet.

Compensating control: Firewall the TCP data port, handshake RPC port, and HTTP metadata server to trusted nodes only.

Full breakdown → https://threataft.com/articles/mooncake-mass-disclosure-cve-2026-103764-103765-103761-103760