Vulnerability Watch

What Splunk Enterprise is: Splunk is a platform used by IT and security teams to collect, search, and analyse machine-generated data — logs, alerts, and system events — across an organisation's infrastructure.

What it is: A critical flaw in Splunk Enterprise allows anyone who can reach the system over a network to create or overwrite files — and then escalate that access to run arbitrary code — without ever logging in. The vulnerable entry point is an internal PostgreSQL sidecar service (a background database process) that was left completely open, with no authentication (a login or credential check) required to use it.

Who's at risk: Any organisation running Splunk Enterprise versions 10.0.0–10.0.6 or 10.2.0–10.2.3. Splunk Cloud is not affected. Splunk Enterprise 10.4 is also not affected.

CVSS: 9.8 — Critical. Patch today. Stop reading, go patch.

Root cause: The PostgreSQL sidecar service exposes backup and restore endpoints that were never protected with authentication controls. Any network-reachable user can call these endpoints directly. The developer failed to restrict access to what are effectively administrative database functions — functions capable of reading, writing, and executing content on the underlying file system.

Attack vector: An attacker connects their own controlled database to Splunk's exposed backup endpoint and dumps its contents onto the Splunk file system. They then use the restore endpoint to load that dump into Splunk's local PostgreSQL instance, triggering execution of SQL (database query language) commands they wrote themselves. From there, they overwrite a Python script that Splunk runs regularly — injecting whatever code they want the server to execute. No login required at any point in this chain.

Detection strategies:

1. Look for unexpected connections to Splunk's internal PostgreSQL ports from external or unusual IP addresses.
2. Monitor for new or modified Python scripts under /opt/splunk/etc/apps/ — changes outside of normal update windows are a red flag.
3. Check backup and restore endpoint logs for calls that did not originate from your own admin team.

Recommended actions:

1. Upgrade to Splunk Enterprise 10.0.7 or 10.2.4 immediately.
2. If patching is not immediately possible, restrict network access to the PostgreSQL sidecar service ports at the firewall level.
3. Audit recent file changes on your Splunk host for any signs of unauthorised writes.

What phpBB is: phpBB is a free, open-source web forum platform still running thousands of active community discussion boards worldwide.

What it is: A flaw in phpBB's authentication logic (the system that checks whether you are who you say you are) allows an attacker to skip the login process and access any account on the forum, including administrator accounts. Researchers at Aikido discovered it on June 2 and reported it immediately. phpBB patched it four days later in version 3.3.17.

Who's at risk: Anyone running phpBB 3.3.16 or below, or the 4.x alpha 4.0.0-a2. The 4.x branch has no patch available yet.

What Ivanti Sentry is: A security gateway appliance (formerly MobileIron Sentry) that organisations use to manage and secure mobile device access to enterprise email and internal applications.

What it is: An OS command injection flaw (a weakness where attacker-controlled input is passed into operating system commands without validation) that allows full remote code execution on the device. No login required.

Who's at risk: Organisations running an unpatched Ivanti Sentry appliance with admin portal endpoints reachable from the public internet.

CVSS: 10/10 (Critical). Patch today. This is the maximum possible score.

Root cause: The software passes attacker-supplied input directly into system commands without checking what it contains. The device treats whatever is submitted as a legitimate instruction and executes it, with no authentication step in between.

Attack vector: An attacker sends a crafted HTTP request to the exposed admin portal, with malicious OS commands embedded in the payload. No credentials are needed. The server processes the request and runs the injected commands with root-level privileges, granting the attacker full control of the device from a single unauthenticated connection.

Detection strategies:

1. Unexpected outbound connections from the Sentry appliance to unfamiliar external addresses.
2. Admin portal logs showing access from unknown source IPs, particularly around or after June 10.
3. New processes running at root level on the appliance that were not present before patching.

Recommended actions:

1. Upgrade to Ivanti Sentry 10.5.2, 10.6.2, or 10.7.1 immediately (patches released June 10).
2. Block admin portal endpoints from public internet access now, regardless of patch status.
3. Enable mTLS (mutual TLS — where both sides of a connection must verify each other's identity) if your deployment supports it.

What FortiSandbox is: FortiSandbox is a security tool made by Fortinet that analyses suspicious files and web content in an isolated environment to detect malware before it reaches a network.

What it is: A command injection flaw (meaning an attacker can slip unauthorised operating system commands into a request the server trusts) in the FortiSandbox web interface allows a completely unauthenticated attacker to run arbitrary commands on the affected system.

Who's at risk: Any organisation running an unpatched version of FortiSandbox, FortiSandbox Cloud, or FortiSandbox PaaS with the web UI exposed. No login required to trigger the flaw.

CVSS: 9.1 — Critical. Patch today.

Root cause: The web UI fails to properly neutralise special characters in HTTP request inputs — a weakness classified as CWE-78 (improper neutralisation of special elements used in OS commands). When the application passes unsanitised user input directly to the underlying operating system, an attacker can inject their own commands alongside the intended ones.

Attack vector: An attacker sends a crafted HTTP request to the FortiSandbox web interface — no credentials, no prior access, no social engineering required. The server processes the malicious input as a legitimate OS command, handing the attacker execution capability on the system. From there, they can move laterally (spreading through connected systems on the same network), exfiltrate (copy out) data, or establish persistent access.

Detection strategies: Look for unexpected outbound connections from FortiSandbox hosts, unusual process spawning in system logs, or HTTP requests containing shell metacharacters (characters like ;, |, or &&) in web server access logs.

Recommended actions:

1. Upgrade FortiSandbox to version 5.0.6 or above; FortiSandbox 4.4.x users should upgrade to 4.4.9 or above.
2. Restrict web UI access to trusted internal IP ranges only — do not expose the management interface to the public internet.
3. Review FortiSandbox logs for anomalous HTTP requests prior to patching.

What Chrome is: The world's most widely used web browser, built by Google and installed on most Windows, Mac, and Linux computers.

What it is: A zero-day (a flaw that was actively exploited before a patch existed) in Chrome's V8 JavaScript engine — the part of Chrome that runs code on web pages. The flaw is an out-of-bounds read and write weakness, meaning the browser can be tricked into reading or writing data outside the memory space it's supposed to use.

Who's at risk: Anyone running an unpatched version of Chrome on Windows, Mac, or Linux. This is the fifth Chrome zero-day patched this year.

CVSS: High — patch this week. Given active exploitation, treat this as urgent.

Root cause: The V8 engine failed to properly restrict where it could read and write in memory. When a user visits a specially crafted HTML page, the engine processes it in a way that allows an attacker to corrupt the memory heap (the region where the browser stores data while running), which can expose sensitive information or crash the process in a way the attacker controls.

Attack vector: An attacker hosts a malicious web page. The target visits it — no download, no click beyond navigation. Chrome processes the page's JavaScript, triggering the out-of-bounds operation. This gives the attacker the ability to execute arbitrary code (run their own instructions) inside Chrome's sandbox (the isolated environment Chrome uses to contain web content). Further steps would be required to break out of the sandbox entirely, but initial code execution is achievable through the browser alone.

Detection strategies: Watch for Chrome processes crashing unexpectedly or spawning unusual child processes. Endpoint logs showing Chrome making unexpected outbound connections after visiting an unfamiliar site are worth investigating. Users reporting sudden browser crashes on specific sites should be treated as a signal until patched.

Recommended actions:

1. Open Chrome → three-dot menu → Help → About Google Chrome → let it update to 149.0.7827.102 or later, then relaunch.
2. If you manage a fleet, prioritise Chrome updates across all endpoints before end of day.
3. Consider restricting access to untrusted or uncategorised web destinations until patched.

What Check Point Remote Access VPN is: A security product made by Israeli cybersecurity company Check Point that lets employees connect securely to their company's network from outside the office.

What it is: This flaw allows an unauthenticated remote attacker — meaning someone with no login credentials at all — to bypass the authentication process entirely and establish a VPN (virtual private network — an encrypted tunnel into a private network) connection. It only affects deployments using the deprecated (outdated and no longer recommended) IKEv1 key exchange protocol.

Who's at risk: Organisations running Check Point Remote Access VPN, Mobile Access, or Spark firewall deployments that still use the legacy IKEv1 protocol and do not require a machine certificate for connections. Personal users are not directly affected — this targets corporate infrastructure.

CVSS: Not yet published at time of writing — treat as Critical based on confirmed active exploitation.

Root cause: The flaw exists because the system failed to properly enforce authentication checks when a connection request arrived via the legacy IKEv1 protocol. IKEv1 is an older standard for negotiating encrypted connections that lacks the stricter validation controls present in its successor, IKEv2. By targeting this deprecated pathway, attackers could slip through without presenting valid credentials.

Attack vector: An attacker identifies a Check Point gateway still accepting IKEv1 connections — a configuration that is common in older enterprise deployments. They send a specially crafted connection request that exploits the authentication bypass, gaining VPN access to the network without credentials. From there, post-compromise activity consistent with the Qilin ransomware (ransomware — malicious software that encrypts your files and demands payment to restore them) operation has already been observed in at least one confirmed case. Attacks began in early May and surged in early June.

Detection strategies:

1. Review VPN authentication logs for successful connections from unrecognised IP addresses, particularly those that completed via IKEv1 without a machine certificate.
2. Monitor for unusual lateral movement (the technique of moving through a network after initial access, accessing systems beyond the original entry point) or access to sensitive internal systems shortly after a new VPN session is established.
3. Check Point has released updated IPS signatures — confirm these are downloaded and active on your gateway.

Recommended actions:

1. Apply Check Point's security update immediately. Patch notes are available in the official advisory.
2. If patching is not immediately possible: remove support for the legacy remote access client, restrict VPN authentication to IKEv2 only, and set machine certificate authentication as mandatory.
3. Enable IPS and download the latest signatures from Check Point's update feed.

What Cisco Catalyst SD-WAN Manager is: A network management platform that lets organisations centrally control and monitor their wide-area network (the system connecting offices, branches, and cloud services together).

What it is: A high-severity authentication bypass (a flaw that lets an attacker skip the login process entirely) in Cisco's SD-WAN Manager. According to The Hacker News, attackers are already exploiting this in the wild. There is no patch available yet.

Who's at risk: Organisations running Cisco Catalyst SD-WAN Manager on-premises or via Cisco's cloud deployment. Home users are not directly exposed — this targets corporate network infrastructure.

CVSS: 7.8 — High. Patch this week. Since no patch exists yet, apply mitigations today.

Root cause: The flaw exists in how the software validates (checks) incoming authentication requests. A gap in the validation logic allows a specially crafted request to bypass credential checks entirely, granting access without a valid username or password.

Attack vector: An attacker sends a malformed authentication request to the SD-WAN Manager interface. The software, instead of rejecting it, processes it as legitimate. The attacker gains administrative access to the management plane (the control layer of the network) without needing any credentials. From there, they can reroute traffic, install backdoors (hidden access points), or pivot laterally (move through the network from one system to others) across the organisation's entire connected infrastructure.

Detection strategies:

1. Review SD-WAN Manager authentication logs for login events with no corresponding credential entry.
2. Look for unexpected administrative sessions originating from external or unfamiliar IP addresses.
3. Monitor for configuration changes made outside of normal change management windows.

Recommended actions:

1. Apply Cisco's published mitigations immediately — restrict access to the SD-WAN Manager interface to trusted IP addresses only.
2. Place the management interface behind a VPN (a private, encrypted network tunnel) if not already done.
3. Enable detailed audit logging and alert on any new admin session creation.