Vulnerability Watch

What Rejetto HFS is: A lightweight, open-source file server that lets users share files over a network through a simple web interface.

What it is: A critical flaw in how Rejetto HFS generates and signs session cookies allows an unauthenticated attacker to forge administrator credentials and execute arbitrary code on the server.

Who's at risk: Anyone running Rejetto HFS version 3.2.0 or earlier, whether on a home network or exposed to the internet. VulnCheck observed active exploitation attempts — originating from a China Telecom IP address — hitting targets in Japan and the US as of October 2.

CVSS: 9.3 (Critical — patch today.)

Root cause: The server uses JavaScript's built-in Math.random() function — which relies on an algorithm called xorshift128+ — to generate session cookies and derive the key used to sign them. This algorithm's outputs are mathematically reversible: collect enough values and you can reconstruct the internal state and recover the signing key. Think of it like a combination lock where watching someone open it a few times lets you deduce the code.

Attack vector: An unauthenticated attacker sends a series of login requests to the server, collecting the random values returned in each response. Using those values, they reverse the algorithm to recover the signing key. They then forge a valid administrator session cookie and use it to access the server_code configuration feature, which allows remote code execution (RCE — running arbitrary commands on the target machine).

Detection strategies: Look for repeated unauthenticated login requests to your HFS instance in quick succession; unexpected changes to server configuration settings; and outbound connections from the HFS process to unfamiliar external addresses.

Recommended actions:

1. Upgrade to Rejetto HFS version 3.2.1 immediately — it is available from the official Rejetto repository.
2. If you cannot patch immediately, restrict access to the HFS interface to trusted IP addresses only.
3. Review server logs for signs of unusual login attempts or configuration changes.

Note: The CVE ID CVE-2026-104286 is the official designation confirmed by both CISA and Fortinet's advisory. The 2026 prefix is unusual for an October 2025 publication — verify against the official advisory before acting.

What FortiMail is: Fortinet's enterprise email security gateway, used by organisations to filter and manage inbound and outbound email.

What it is: A critical zero-day (a flaw being actively exploited before a patch exists) combining path traversal (a technique that tricks a server into accessing files outside its intended directory) and improper handling of null characters, allowing attackers to write arbitrary files to the underlying system.

Who's at risk: Organisations running FortiMail versions 7.2.0 through 8.0.1 with the management interface or IBE feature accessible from the web.

CVSS: 9.8 — Critical. No patch is available yet. Act today.

Root cause: The software fails to properly validate file path inputs and sanitise null byte characters in HTTP and HTTPS requests, allowing a crafted request to escape the intended file directory entirely.

Attack vector: An attacker sends a specially crafted HTTP or HTTPS request to the FortiMail management interface. The server mishandles the path, allowing the attacker to write a file — such as a web shell — to an arbitrary location, potentially achieving full remote code execution (the ability to run any command on the target machine).

Recommended actions:

1. Disable IBE feature support in FortiMail immediately, as Fortinet advises.
2. Block public access to the FortiMail management interface; restrict it to trusted IP addresses only.
3. Review Fortinet's published indicators of compromise (IoCs — specific technical signatures of an attack) to check whether exploitation has already occurred in your environment.

CISA has added this CVE to its Known Exploited Vulnerabilities catalogue and is requiring federal agencies to act within three days. Patches are expected in versions 7.4.9, 7.6.7, and 8.0.2, with no release date confirmed.

What Fireware OS is: The operating system that runs WatchGuard Firebox network security appliances, which organisations use to protect their networks from unauthorised access.

What it is: A code injection flaw in how Fireware OS handles BOVPN over TLS client configurations. BOVPN (Branch Office VPN) is a feature that creates encrypted tunnels between office locations. An attacker who controls the remote VPN server can push malicious instructions through that tunnel.

Who's at risk: Any organisation using a WatchGuard Firebox appliance configured to connect to a BOVPN over TLS server. If the remote server is compromised or attacker-controlled, your appliance is exposed.

CVSS: 9.2 (Critical — patch today.)

Root cause: The OS fails to sanitise input received from the remote VPN server during connection setup. Because that input is trusted and passed into system commands without validation, a malicious server can inject arbitrary commands. The appliance effectively executes whatever the remote end tells it to.

Attack vector: An attacker positions themselves as — or compromises — the remote VPN server your Firebox connects to. During the TLS handshake, the attacker sends crafted configuration data containing embedded commands. The Firebox processes this input without checking it, and those commands run with root privileges — full administrative control of the device.

Detection strategies: Check Fireware OS system logs for unexpected command execution or configuration changes following VPN tunnel establishment. Look for outbound connections to unfamiliar IP addresses initiated by the Firebox itself. Monitor for new administrative accounts or changed credentials on the appliance.

Recommended actions:

1. Update Fireware OS to version 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 immediately.
2. Audit all BOVPN over TLS remote server configurations and confirm each endpoint is trusted and controlled by your organisation.
3. Restrict management access to the Firebox to known, internal IP ranges only.

What Citrix NetScaler ADC and Gateway are: NetScaler ADC (Application Delivery Controller) and NetScaler Gateway are Citrix networking appliances used by organisations to manage, secure, and control access to internal applications — often sitting at the edge of a corporate network as a gateway for remote workers.

What it is: CVE-2026-88771 is a remote code execution (RCE) vulnerability — a flaw that lets an attacker run their own commands on a system they do not own. It requires no login to trigger and affects all NetScaler ADC and Gateway deployments, including default configurations.

Who's at risk: Any organisation running an unpatched NetScaler appliance exposed to the internet. Citrix confirmed active exploitation at multiple customers worldwide, as did CISA.

CVSS: 9.5 (Critical — patch today).

Root cause: The flaw exists in a code path that can be reached without authentication. Think of it like a side entrance to a building that has no lock and no guard — the main door requires a keycard, but this entrance bypasses all of that. The developer failed to enforce authentication checks before reaching the vulnerable function.

Attack vector: An attacker with network access to the appliance sends a specially crafted request. No credentials are required. The request reaches the vulnerable code and allows the attacker to execute commands with the privileges of the running service. From there, moving through the internal network to reach other systems becomes straightforward.

Detection strategies: Check NetScaler logs for unexpected read operations or API calls from unfamiliar IP addresses. Look for unusual process spawning on the appliance. Review any recent configuration changes made outside normal change windows.

Recommended actions:

1. Apply Citrix's patches immediately — this is actively exploited and CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog.
2. If patching is not immediately possible, take the appliance offline until it can be patched, as several administrators were advised to do.
3. Review Citrix's published indicators of compromise (IoCs — specific technical signs that a system has been attacked) before patching, per CISA's guidance.

What Roundcube is: Roundcube is a free, open-source webmail client used by organisations and hosting providers worldwide to give users a browser-based email interface.

What it is: A SQL injection (an attack where a hacker inserts malicious database commands into an input field, tricking the system into running them) flaw in Roundcube's virtuser_query plugin is being actively exploited in the wild, as confirmed by the Canadian Centre for Cyber Security.

Who's at risk: Any organisation running Roundcube below version 1.6.16 or 1.7.1 with the virtuser_query plugin active. Over 500,000 Roundcube servers are publicly accessible — how many remain unpatched is unknown.

CVSS: 8.1 (High — patch this week)

Root cause: The virtuser_query plugin resolves email addresses to mailbox usernames. It tries to block SQL injection using a backslash-escaping filter on the preg_replace() function. The flaw exists because specially crafted backslash sequences in attacker input defeat the filter entirely, allowing quote characters to reach the underlying SQL query unmodified. The database then executes whatever the attacker appended.

Attack vector: An unauthenticated attacker sends a crafted request to the Roundcube server that targets the virtuser_query plugin. The malicious input traverses the broken filter and injects SQL commands directly into a query sent to the database. From there, the attacker can read user emails, address books, and identity data, tamper with database records, and map out authentication and admin workflows — all without a valid login.

Detection strategies:

1. Check your mail server logs for unusual query patterns targeting the virtuser_query plugin, particularly requests containing backslash sequences in email address fields.
2. Look for unexpected database read operations on user identity and message tables outside of normal login windows.
3. Monitor for new or anomalous admin-level activity in Roundcube's database, which may indicate an attacker is mapping authentication functions.

Recommended actions:

1. Upgrade to Roundcube 1.6.16 or 1.7.1 immediately — patches have been available since late May.
2. If you cannot patch immediately, disable the virtuser_query plugin as a temporary mitigation.
3. Audit access logs for suspicious requests and restrict external access to the Roundcube admin interface.

What F5 BIG-IP APM is: A network appliance used by enterprises and government agencies to manage secure remote access and enforce access policies across web applications.

What it is: A critical flaw in BIG-IP APM allows an attacker with no credentials whatsoever to execute arbitrary code (RCE — remote code execution, meaning the attacker can run any command they choose on the target system) remotely. F5 and CISA confirmed active exploitation, as reported by Security Week.

Who's at risk: Organisations running BIG-IP APM versions 17.1.0 to 17.1.3, 17.5.0 to 17.5.1, or 21.1.0, specifically where the system is configured as an OAuth Authorization Server (a service that issues access tokens to authenticate users and applications). Deployments using APM only as an OAuth Client or Resource Server are not affected.

CVSS: 9.8 — Critical. Patch today.

Root cause: The flaw exists in how BIG-IP APM processes traffic to a virtual server when both an APM access policy and an OAuth profile are active together. Malformed or specifically crafted requests to that configuration bypass authentication entirely, giving the attacker a direct path to code execution. The vulnerability lives on the data plane — the part of the appliance that handles live network traffic — meaning it can be triggered from outside the organisation without any internal access.

Attack vector: An unauthenticated attacker sends a specially crafted request to the virtual server running BIG-IP APM in OAuth Authorization Server mode. The appliance processes the malicious traffic without verifying who sent it, executing the attacker's payload and granting them full control of the device. No phishing, no credentials, no foothold required — just a network connection to the exposed service.

Detection strategies:

1. Review the three indicators of compromise (IoCs) published in F5's advisory and cross-reference them against your BIG-IP APM logs immediately.
2. Look for unexpected outbound connections or unusual processes spawned on the appliance following inbound OAuth-related traffic.
3. Monitor for authentication events on the virtual server that lack corresponding valid session records — a sign that someone probed the OAuth endpoint without a legitimate token.

Recommended actions:

1. Apply F5's hotfix immediately — affected versions are 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0.
2. If patching is not immediately possible, remove the OAuth Authorization Server configuration from exposed virtual servers as a temporary mitigation.
3. Check CISA's Known Exploited Vulnerabilities catalogue and follow BOD 26-04 if your organisation is a federal agency — the patch deadline is three days from the advisory.

CVE ID not confirmed in source — check the original advisory before acting.

What the Linux Kernel is: The Linux kernel is the core software layer that sits between hardware and the operating system — it manages memory, processes, and communication across virtually every Linux-based server, device, and cloud system in the world.

What it is: A flaw in the kernel's handling of TLS (Transport Layer Security — the technology that encrypts data in transit) receive-path logic allows a specially crafted zero-length record to cause improper memory handling. It is like a gate that assumes no one will ever push it from an unusual angle — and falls open when they do.

Who's at risk: Any system running a vulnerable Linux kernel version where a local user or process can interact with TLS sockets. Cloud servers, enterprise Linux hosts, and shared computing environments face the greatest exposure.

CVSS: 9.8 (Critical — patch today. Stop reading, go patch.)

Root cause: The recvmsg() function — which handles incoming data from the network — assumes that after a zero-copy decryption operation on a DATA record, no record-type change can follow. A zero-length record injected into the receive queue breaks that assumption, sending the kernel down a logic path it was never designed to handle safely. The developer failed to validate that assumption against all possible input sequences.

Attack vector: A local attacker on the same system sends a crafted sequence of TLS records that includes a zero-length entry positioned to exploit the type-check gap. The kernel mishandles the decryption step, either exposing contents of memory it should not, or crashing the process — a denial-of-service (DoS — making a system unavailable) condition. No network-level access is required; a shell account on the target machine is sufficient.

Detection strategies: Look for unexpected kernel panics or crash logs referencing TLS or recvmsg. Monitor for unusual local user processes making high volumes of TLS socket calls. On shared systems, flag any process repeatedly opening AF_TLS sockets with anomalous record patterns.

Recommended actions:

1. Apply the latest Linux kernel security update from your distribution immediately — CISA has directed federal agencies to patch within three days.
2. Restrict local shell access on multi-user systems to only those who genuinely need it.
3. Review kernel logs for signs of unexpected crashes or memory errors in the TLS receive path.

What Orkes Conductor is: Conductor is an open-source enterprise framework used by organisations to coordinate microservices, automated workflows, and AI agents — think of it as the traffic controller that tells different software components what to do and when.

What it is: A critical RCE (remote code execution — a flaw that lets an attacker run their own commands on your server) that requires no login to exploit. An attacker can send a single crafted request to the workflow API and gain full control of the server.

Who's at risk: Any organisation running Conductor versions older than 3.30.2 with the workflow API reachable from outside their internal network.

CVSS: 9.8 (Critical — patch today).

Root cause: Conductor's INLINE task type evaluates user-supplied JavaScript or Python expressions. The evaluator runs inside a GraalVM context — a runtime environment for code — configured with all host access enabled. That setting disables the sandbox (the protective barrier that normally stops code from touching the underlying system). Attacker-supplied code escapes directly into the Java runtime and executes OS commands. The server enforces no authentication by default, so the API endpoint is entirely open.

Attack vector: An attacker sends a single unauthenticated HTTP POST request to Conductor's workflow API. The request registers a new workflow containing a hostile INLINE task with embedded malicious code. Conductor evaluates the expression, the sandbox check fails silently, and the code executes as the Conductor process — which commonly runs with root privileges. No credentials, no phishing, no foothold required. Proof-of-concept code has been public since early August, and Fortinet recorded roughly 1,300 exploitation attempts in a single 48-hour window in September, per SecurityWeek.

Detection strategies: Look for unexpected POST requests to /api/workflow endpoints in your web server logs, particularly from external IPs. Monitor for unusual process execution spawned by the Conductor service — commands like curl, wget, or shell invocations are red flags. Review running workflows for any INLINE tasks you did not create.

Recommended actions:

1. Upgrade to Orkes Conductor version 3.30.2 or later immediately.
2. Place Conductor behind a firewall and block all external access to its workflow API endpoints.
3. Enable monitoring for suspicious workflow submissions and review any system running a vulnerable version for signs of prior compromise.

What The Events Calendar is: A WordPress plugin with over 600,000 active installations that lets website administrators create and manage event listings on their sites.

What it is: An unauthenticated RCE (remote code execution — an attacker running their own commands on your server) flaw caused by insufficient input validation. An attacker can inject a crafted payload through the comment area of an event page that the server then executes.

Who's at risk: Any WordPress site running The Events Calendar below version 6.17.3.1 with comments enabled. Around 240,000 sites use versions prior to 6.17.

CVSS: 9.8 (Critical — patch today).

Root cause: The plugin processes user-supplied comment data before validating it properly. Because the injected code reaches the vulnerable function before comment moderation occurs, no login or approval is required to trigger it.

Attack vector: An attacker visits an event page on your site, submits a crafted comment containing malicious code, and the server executes it — handing over full control of the WordPress installation. No account needed.

Detection strategies: Check server logs for unexpected POST requests to event comment endpoints. Look for unfamiliar admin accounts created recently. Monitor for unusual file modifications in your WordPress directory.

Recommended actions:

1. Update The Events Calendar to version 6.17.4.1 or later immediately.
2. If you cannot update right away, disable comments on event pages.
3. Audit recently created admin accounts and review access logs for anomalous activity.

These recommendations are AI-generated based on available information at time of writing. Always verify with the official vendor advisory or CVE record before acting in a production environment.

What ScreenConnect is: ConnectWise ScreenConnect is a remote support and access tool used by IT teams to connect to and manage computers remotely.

What it is: A missing authorisation flaw allows files to be transferred and executed through an active ScreenConnect session without the host's knowledge or approval.

Who's at risk: Anyone running ScreenConnect below version 26.6.5, particularly IT support teams and managed service providers. Active exploitation has been confirmed since August 20, per SecurityWeek.

CVSS: 9.9 — Critical. Patch today.

Root cause: The software fails to properly verify whether a user has permission before allowing file transfers and execution during a remote session. Think of it like a hotel key card that opens any room on the floor rather than just your own — the system trusts the session without checking what that session is actually allowed to do.

Attack vector: Attackers used social engineering (manipulating people into trusting something malicious) to trick victims into running modified ScreenConnect clients. Once installed, the rogue client checked for active sessions and pushed four VBScript payload files to connected machines, establishing persistence and spreading further — worm-like behaviour that jumps from machine to machine without further human interaction.

Detection strategies:

1. Look for unexpected VBScript file creation or execution in system logs
2. Audit active ScreenConnect sessions for connections you did not initiate
3. Check for new scheduled tasks or startup entries added around August 20 onward

Recommended actions:

1. Upgrade ScreenConnect to version 26.6.5 immediately
2. As a temporary measure, disable the TransferFiles permission in ScreenConnect settings
3. Review session logs for signs of unauthorised file transfers since August 20