Apache Security Advisories - 2026-11-11

Adobe Patch Day 2026-11-10

Apache Security Advisories - 2026-11-10

Apache HTTP Server

http_server

Improper Input Validation

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.
Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

Apache Software Foundation

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in the assign_headers() function allows unauthenticated remote attackers to execute arbitrary code.

Buffer Overflow via Environment Variables

Server Side Include (SSI) Injection

Cross Zone Scripting

Command Line Execution through SQL Injection

Object Relational Mapping Injection

SQL Injection through SOAP Parameter Tampering

Double Encoding

Subverting Environment Variable Values

Format String Injection

LDAP Injection

Client-side Injection-induced Buffer Overflow

Input Data Manipulation

Flash Injection

XSS Using MIME Type Mismatch

Exploiting Trust in Client

File Content Injection

Serialized Data with Nested Payloads

Oversized Serialized Data Payloads

Filter Failure through Buffer Overflow

XML Injection

Impair Command History Logging

Dynamic Linker Hijacking

Path Interception by PATH Environment Variable

Leveraging Race Conditions

Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions

The tool first confirms the target answers HTTP/2 and runs a deterministic probe (a body-less request with Content-Type and no Content-Length) to see whether the handler observes the synthesized Content-Length: 0. In exploit mode it opens many parallel HTTP/2 connections sending batches of crafted header-heavy streams to race the connection and worker threads on the shared stream pool, then watches for sanitizer reports or a server crash. The code stops at detecting corruption; it does not demonstrate code execution.

The tool first checks whether HTTP/2 is offered and whether the banner version falls in the affected range. It then sends concurrent benign requests as a baseline and concurrent bodyless POST requests with a full header table designed to hit the claimed race path, optionally wrapping them in WAF-evasion encodings. It reports a vulnerability verdict only if abnormal connection behavior occurs disproportionately in the trigger traffic. The code does not demonstrate memory corruption or code execution; it is a behavioral oracle that suggests a possible crash or anomaly condition.

Apache HTTP Server Security Advisory

bugzilla.redhat.com

Github Advisory

Vulnerability CVE-2026-119618: Remote code execution in Apache HTTP Server mod_http2

[CRITICAL] Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

A race condition (concurrent execution with improper synchronization) in the assign_headers() function of Apache HTTP Server's mod_http2 can lead to **remote code execution**. It affects Apache HTTP Server 2.4.55 through 2.4.70 and mod_h2 releases 2.0.8 through 2.0.42 from GitHub. The flaw is exploitable over the network without authentication or user interaction, so a successful attack could give an attacker full control of the web server, with high impact on confidentiality, integrity, and availability. Patching matters because internet-facing servers with HTTP/2 enabled are exposed to **potential system compromise**.

cloud_pak_for_data_system

cloud_pak_for_data_system_cpds

linux_kernel

kernel

Write-what-where Condition

Use After Free

In the Linux kernel, the following vulnerability has been resolved:

xfrm: esp: avoid in-place decrypt on shared skb frags

MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP
marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),
so later paths that may modify packet data can first make a private
copy. The IPv4/IPv6 datagram append paths did not set this flag when
splicing pages into UDP skbs.

That leaves an ESP-in-UDP packet made from shared pipe pages looking
like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW
fast path for uncloned skbs without a frag_list and decrypts in place
over data that is not owned privately by the skb.

Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching
TCP. Also make ESP input fall back to skb_cow_data() when the flag is
present, so ESP does not decrypt externally backed frags in place.
Private nonlinear skb frags still use the existing fast path.

This intentionally does not change ESP output. In esp_output_head(),
the path that appends the ESP trailer to existing skb tailroom without
calling skb_cow_data() is not reachable for nonlinear skbs:
skb_tailroom() returns zero when skb->data_len is nonzero, while ESP
tailen is positive. Thus ESP output will either use the separate
destination-frag path or fall back to skb_cow_data().

Linux

A vulnerability in the Linux kernel's ESP (Encapsulating Security Payload) input handling allows in-place decryption of shared socket buffer fragments that are not privately owned by the socket buffer. When IPv4/IPv6 datagram paths splice pages from a pipe directly into UDP socket buffers, they fail to mark these buffers with the SKBFL_SHARED_FRAG flag. This causes ESP input processing to incorrectly treat externally-backed fragmented packets as ordinary uncloned buffers and decrypt them in-place over data not owned by the socket buffer, potentially corrupting or exposing the shared pipe page contents.

The claimed flow, per the README, is that an unprivileged local user abuses in-place ESP/RxRPC decryption over page-cache-backed skb fragments to write into page cache and obtain root. This flow is claimed, not demonstrated, because the exploit source file contents are not included in the material provided.

A local unprivileged user creates a user/network namespace and installs XFRM ESP-in-UDP states whose ESN seq_hi fields encode a root-shell ELF; by splicing /usr/bin/su page-cache pages into ESP packets, the kernel decrypts in place over those shared pages, overwriting the first 212 bytes of su with the payload. The second path uses rxrpc/rxkad in-place decryption to rewrite the root entry in /etc/passwd to an empty password with uid 0, relying on PAM nullok. Once either target is corrupted the exploit spawns su in a PTY to obtain a root shell.

The documented flow is claimed, not demonstrated: the repository README describes chaining an xfrm-ESP page-cache write with an RxRPC page-cache write to gain root via deterministic corruption of page-cache-backed data. No exploit code is present in the supplied content, so the step-level mechanics cannot be verified.

A local unprivileged user creates a user/network namespace to gain namespace-scoped network admin, installs ESP-in-UDP XFRM states over loopback, and uses splice from /usr/bin/su pages so that the kernel's in-place ESP decrypt writes attacker-controlled bytes into the page cache of the setuid binary. Once the overwrite is verified, the attacker executes the modified su to obtain a root shell.

The provided material is a GitHub web page describing a claimed two-stage Linux kernel LPE chain. No exploit code is present in the supplied content, so the flow below is claimed in the README and not demonstrated. The README asserts that unprivileged users can trigger in-place ESP/RxRPC decryption over page-cache-backed skb fragments to overwrite readable files such as setuid binaries.

The exploit creates a user+network namespace to obtain netlink XFRM privileges, installs ESP SAs whose replay state encodes shellcode words, then splices page-cache pages of /usr/bin/su (and optionally /etc/passwd via the RxRPC path) into ESP-in-UDP packets so the kernel decrypts those shared pages in place, overwriting the setuid binary's cached contents with a root-shell ELF. Once patched, running su spawns a root shell.

The script is not an exploit. It inspects the local system for conditions that would make the claimed Dirty Frag ESP and RxRPC in-place decryption paths reachable, including kernel version, module load state, blacklist entries, and unprivileged socket creation, and reports the results with remediation guidance. No vulnerable kernel path is triggered and no attacker-controlled data is written.

The demonstrator uses an unprivileged user/network namespace to create an XFRM ESP-in-UDP SA, then splices pages from a read-only root-owned file into a UDP skb via vmsplice/splice so that the kernel treats file-backed pages as writable fragments during ESP decryption, causing an in-place write into the page cache of the fixture file. A second variant does the same via an RxRPC/RXKAD handshake and writes eight cached bytes. The verified effect in the code is a marker write into lab fixtures, not privilege escalation.

A local unprivileged user creates a user+net namespace, installs XFRM ESP-in-UDP SAs whose seq_hi values encode a root-shell ELF, and uses vmsplice/splice to route /usr/bin/su page-cache pages through the ESP decrypt path so that the setuid binary's cached bytes are overwritten. Alternatively, the rxrpc/rxkad path brute-forces keys in user space and triggers in-place decrypt over /etc/passwd to blank root's password for PAM nullok. Either corruption yields a root shell via su.

An Android APK orchestrates a three-phase privilege escalation chain using embedded native binaries: (1) helper executes a memory corruption payload (dlopen'd from assets) to achieve initial root, (2) helper copies KernelSU to writable storage under root context, (3) helper invokes late-load to bind-mount and execute ksud to install the KernelSU kernel module. Retry ladder implements up to 24 attempts across three rounds with progressive timeouts to maximize hit rate within a single boot cycle.

Claimed flow only: on boot, the receiver checks an opt-in preference, mirrors a soft-reboot flag into device-protected storage, and launches ExploitRunner in the background to root the device. The actual rooting mechanism is not shown; the CVE linkage is not demonstrated in the supplied code.

The exploit sends crafted ESP-in-UDP packets over loopback whose payload is spliced from file page-cache pages, so the kernel decrypts in place and rewrites target file contents with attacker-chosen 16-byte blocks computed via per-block IV manipulation. It uses this primitive to overwrite a crash_dump64 helper, a vendor kernel module file, and a hook in libc++.so, then triggers execution of the hook to start a privileged bootstrap that loads a kernel module and a root daemon. The flow is demonstrated in the code, but the decrypt primitive's behaviour depends on the kernel being vulnerable as described in the CVE.

A local unprivileged process uses the ESP-in-UDP splice path to perform in-place decryption over shared page-cache pages, which lets it write attacker-controlled plaintext into read-only system files through CBC IV manipulation. It patches crash_dump64 with a helper, a vendor library with a kernel module, and a libc++/libbase function prologue with a trampoline that launches a root bootstrap. The bootstrap is then observed via marker files until the SU daemon starts or an error occurs.

The provided script only compiles a set of claimed components into two Android shared objects (libdfroot.so and libbootstrap.so) and a freestanding splicehelper blob. The claimed exploit flow (kernel ESP in-place decrypt over shared pipe pages) is not demonstrated in the code provided.

The script takes a base DirtyFragX APK, replaces its native library with a supplied libdfroot.so, and rewrites the '/dev/df' existence check in classes.dex to a different path so the app's upstream guard does not short-circuit execution, then fixes the DEX checksum and signature. The output is an unsigned APK intended to be signed and installed. The flow is demonstrated only as APK repacking; the exploitation of CVE-2026-43284 is not demonstrated in the code.

Oracle

IBM Guardium Data Protection is affected by multiple vulnerabilities

git.kernel.org

Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 1.0)

HPSBHF04155

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

Kernel privilege escalation and disclosure Vulnerabilities in Linux in IBM Cloud Pak System[CVE-2026-46300, CVE-2026-46333, CVE-2026-43284]

Multiple vulnerabilities in the Linux kernel and expat affect IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Google Android android-2026/2026-11-01

Oracle Communications Performance Intelligence Center vulnerability in Security (Linux Kernel).

A Linux kernel flaw in the XFRM ESP input path allows in-place decryption of skb fragments that are backed by shared pipe pages. IPv4/IPv6 datagram splice (MSG_SPLICE_PAGES) did not set SKBFL_SHARED_FRAG on UDP skbs, so ESP-in-UDP packets took the no-COW fast path and modified data the skb does not privately own. A local, low-privileged attacker could exploit this to corrupt memory they do not own, with potential for **privilege escalation and full system compromise** (scope changed, high confidentiality, integrity and availability impact). Patching is important because the flaw affects a wide range of kernel versions from 4.11 onward and is also tracked in advisories for downstream vendor products (Oracle, IBM, HP, Android).

edk2

node.js

industrial_edge_hub

tia_project-server_web_administration_tool

opcenter_execution_process

opcenter_quality

simatic_wincc

teamcenter

pave360_automotive

flow_creator_configurator

opcenter_rd\&l

tia_administrator

opcenter_execution_discrete

industrial_edge_databus_configurator

opcenter_connect_electronics

xpedition_designer

process_preparation_x

xpedition_enterprise

common_configurator

simatic_sistar

simcenter_executable_digital_twin

opcenter_x

insights_hub

edge_opc_ua_server_configurator

opcenter_intelligence

innexis_architecture_native_acceleration

industrial_edge_management_cloud

simatic_profiling_tool

opcenter_execution_pharma

opcenter_connect_manufacturing_operations_management

simatic_wincc_unified_for_industrial_edge

simatic_wincc_companion

simatic_wincc_unified_siqence

hyperlynx

user_management_component

dataxess_configurator

simcenter_studio

opcenter_execution_foundation

simatic_wincc_unified_pc_runtime

simatic_wincc_runtime

industrial_edge_cloud_connector_configurator

simatic_braumat

opcenter_execution_core

data_flow_monitoring

pads_professional

comos_walkinside

ruggedcom_ape1808_firmware

istio

brotli

woff2

duckdb

7-zip-zstd

brotlicffi

.net

p7zip

clickhouse

arrow

debian_linux

envoy

Unchecked Return Value

Out-of-bounds Write

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.





Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Brotli

Google LLC

Google

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows processing of a crafted Brotli-compressed stream to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code.

The tool builds seed brotli streams with the Python brotli package, mutates metablock headers (preferentially NBLTYPES block-switch fields) and other bytes, and feeds candidates to a local Node.js zlib decoder in a child process to detect crashes. Separately, it can deliver a chosen stream to a remote HTTP endpoint with Content-Encoding br and interpret the response for crash or decoder-error signals. The code does not demonstrate memory corruption, code execution, or information disclosure on a vulnerable build.

The script builds a Brotli stream that drives the decoder into a large repeated-command loop (1<<24 commands with fixed distance extra bits), sends it to a loopback service over a framed protocol, then sends a crafted 127-byte second-stage buffer. It then checks whether the service still responds to PONG to determine whether a denial of service occurred.

The claimed flow is: start a TCP listener, generate a Brotli-compressed stream, and POST it with Content-Encoding: br to a target endpoint, expecting an HTTP 500 to indicate memory corruption and a subsequent connection to indicate RCE. This flow is claimed in the code comments and banner and is not demonstrated by the code, which does not craft a malicious stream or deliver a shell payload.

The exploit generates a malformed Brotli-compressed stream that triggers a buffer overflow in the decoder state machine. Two stages corrupt adjacent memory: the first grooms the heap, the second poisons it with ROP gadget chains or directly crashes the service. RCE variants redirect execution to attacker-controlled code via memory overwrites that pivot the stack and execvp a shell with stdio wired to a callback socket.

The exploit sends a chunked, Brotli-encoded POST to an Express endpoint whose decoder mishandles a crafted stream, overwriting adjacent state to pivot the stack into a ROP chain placed in decompressed data. The chain dup2s the socket onto stdin/stdout and execvp's /app/bridge, yielding an interactive shell that is verified with an echoed token. The flow is demonstrated against a local lab build with hardcoded offsets.

The README claims the tool sends a crafted Brotli-compressed request to an HTTP endpoint to trigger an out-of-bounds write in the .NET decoder, then uses heap spray and type confusion to reach code execution. Because no exploit code is present in the provided material, this entire flow is claimed in the README and not demonstrated.

The repository claims a two-tool suite: verifier.py performs a non-intrusive patch check by comparing decoder errno responses to two Brotli streams, and exploit.py claims to trigger DoS via Express body-parser, send Brotli amplification payloads, and optionally run a lab RCE chain. None of these flows are demonstrated in the supplied content, so the flow is claimed, not demonstrated.

The exploit constructs a malformed Brotli-compressed stream containing injected Node.js code that triggers an out-of-bounds write in the Brotli decoder. The OOB write corrupts an adjacent V8 ArrayBuffer callback pointer on the heap, which is then invoked during event loop processing to execute arbitrary JavaScript code (reverse shell, command execution, or file operations).

The exploit sends a single chunked, Content-Encoding: br HTTP POST (or serves one as a malicious server to a fetch() client) whose Brotli stream drives the decoder into an invalid block-type state with an unconsumed tail, causing an out-of-bounds write past the 8-byte stash buffer. The same body appends a JavaScript spray intended to be evaluated after corruption; the exec or reverse-shell payload is designed to run in the target's Node.js process. Success is inferred from a stall or reset, or confirmed by an echoed marker or listener connection.

The script validates that it is pointed at a localhost lab instance whose podman pod and cutoff timer are verified, then sends a single XML-RPC pingback.ping request to /xmlrpc.php with fixed source and target URLs. It then parses the HTTP response and reports success only if the body contains a uid/gid identity line. No Brotli-related behavior or code-execution payload is present in the code, so the flow does not demonstrate the claimed CVE.

The script health-checks a loopback service, then opens a groom connection to shape the target's heap, followed by a poison connection carrying a staged payload intended to overwrite a return address and pivot to a ROP chain. The claimed result is execution of id, reported back through a callback listener that verifies a random token. The bulk of the payload logic is in imported modules that were not supplied, so the flow is claimed rather than fully demonstrated.

Craft a malformed Brotli stream with NBLTYPESI=2 and IC block_length[1]=1; first command depletes the block to 0, triggering DecodeBlockTypeAndLength() to return BROTLI_FALSE. Streaming decoder misinterprets this as NEEDS_MORE_INPUT and saves state at COMMAND_BEGIN. On next resume, the OOB write at decode.c:2463 copies bit-reader bytes into buffer.u8[] without bounds checking, overwriting adjacent BrotliDecoderState fields (buffer_length→ringbuffer pointer, block_length[1], metadata_start_func). RCE achieved by writing system() pointer to metadata_start_func and /bin/sh to metadata_callback_opaque, then triggering metadata block callback via the heap-groomed state.

The flow is claimed, not demonstrated: this server would serve a Brotli-compressed response in timed, chunked stages to a client that decodes it, intended to drive the decoder into a corrupted state. The code shown only handles delivery and timing; the payload bytes that would cause memory corruption are absent.

The claimed flow is: a crafted Brotli-compressed HTTP body (Content-Encoding: br) is sent to a Node.js service, triggering a heap out-of-bounds write in the bundled decoder, which is then claimed to be escalated to command execution via a webhook or eval sink. This flow is claimed in the README only and is not demonstrated in any code provided.

The flow is claimed, not demonstrated against Brotli: the script builds a WordPress-plus-database lab, then runs a Python client that sends an unauthenticated request to the published WordPress port, which reaches a PHP origin server serving two staged binary payloads (one delayed, one retry with a COMMAND header). Success is determined only by whether a planted flag string appears in the client's HTTP response.

The claimed flow, which is described but not demonstrated in provided code, is that a crafted Brotli-compressed HTTP request body drives the decoder into an invalid state that produces an out-of-bounds write in a Node.js request path. Per the README, this may corrupt control flow to run a local program as the Node.js process user, or otherwise crash the service. The actual steps could not be verified because poc.py's contents are not included.

The claimed flow is a malformed Brotli stream delivered over HTTP that triggers an out-of-bounds write in the Node.js Brotli decoder, with a probabilistic ASLR-dependent path to command execution in specific lab configurations. This flow is claimed in the README and is not demonstrated in the provided content.

The claimed flow is that a crafted Brotli-compressed HTTP body sent with Content-Encoding: br triggers an out-of-bounds write in the Node.js bundled Brotli decoder, which can crash the process or be escalated to code execution against a stock server with a webhook or eval sink. This is claimed in the README and not demonstrated in any code provided.

The claimed flow is delivering a crafted Brotli stream split across two stages so that decoder state carried between BrotliDecoderDecompressStream calls is corrupted. As shown, the harness only decodes two local files in sequence and reports return codes; it does not demonstrate the claimed corruption, disclosure, or code execution.

Microsoft

Palo Alto Networks

IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js

HPSBHF04161

IBM Enterprise Build of Quarkus is affected by a vulnerability in Brotli

Multiple vulnerabilities in IBM DevOps Solution Workbench

cisco-sa-oct2026-node-js-Jj3SQ19u

IBM Maximo Application Suite - Manage Component uses nodejs and packages which are vulnerable to CVE-2026-111497

IBM Maximo Application Suite uses Nodejs 24 which is vulnerable to CVE-2026-111497

IBM Maximo Application Suite - Visual Inspection Component uses packages which are vulnerable to CVE-2026-111497

Apple

An out-of-bounds write issue was addressed with improved input validation. Processing maliciously crafted input may lead to memory corruption

A buffer overflow in the Brotli decoder (c/dec/decode.c) in Google Brotli 1.0.3 through 1.2.0 lets a remote, unauthenticated attacker send a crafted Brotli-compressed stream that corrupts adjacent decoder state memory. Impact includes sensitive memory disclosure, denial of service, and potentially arbitrary code execution, rated **critical severity (CVSS 9.8)** because it requires no authentication or user interaction. Brotli is embedded in many downstream products, including Node.js, .NET, Envoy, Istio, Apple operating systems, and Siemens industrial software, so exposure extends well beyond direct Brotli installs. Patching matters because any component that decodes untrusted compressed content over the network is a potential attack path.

chrome

Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Chrome

Use after free vulnerability in XML processing in Google Chrome prior to version 157.0.8103.50 allows remote code execution inside the sandbox when a user visits a crafted HTML page.

The script starts a local HTTP server that hosts a page with two iframes, each loading an XML document whose XSLT stylesheet triggers nested xsl:number evaluation over shared pattern-cache state. The claimed mechanism is that re-entrant evaluation causes a stale pointer to be freed again, crashing the renderer. The flow is demonstrated as a crash trigger in the code, not a verified exploit of the claimed UAF.

Google Chrome chrome-157.0.8103.50

chromereleases.googleblog.com

Apache Axis 1.x (EOL)

axis:axis

org.apache.axis:axis

axis

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.



As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.

Deserialization of inbound SOAP faults in Apache Axis 1.x allows remote class instantiation. When a SOAP Fault contains a detail/exceptionName element, Axis loads the named class and instantiates it through its String constructor before validating it as an AxisFault. This occurs during engine processing before service-level handler chains execute, bypassing authentication handlers. A suitable class on the application's classpath can be leveraged to achieve remote code execution.

The script sends a crafted SOAP Fault envelope over raw HTTP to an Axis service endpoint, naming a classpath class in <exceptionName> and supplying a String in <data>, which causes Axis to load the class (running static initializers) and invoke its String constructor before the AxisFault cast fails. Controls confirm that the same endpoint rejects unauthenticated ping requests, so a marker side effect without credentials demonstrates the auth bypass. Gadgets used are FileOutputStream (file creation) and a lab static initializer (file creation on class load).

Apache Axis Security Advisory

[CRITICAL] Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName

screenconnect

Improper Privilege Management

Missing Authorization

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

ScreenConnect

ConnectWise

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances.

Search CVEs by ID

Trending vulnerabilities

Latest security advisories

Apache Security Advisories - 2026-11-11: 1 critical vulnerabilities amid 18 CVEs

Adobe Patch Day 2026-11-10: 10 critical vulnerabilities amid 110 CVEs

Apache Security Advisories - 2026-11-10: 0 critical vulnerabilities amid 6 CVEs

Browse

Be the first to know about critical vulnerabilities