Vulnerability Watch

What JetBrains TeamCity is: A continuous integration and delivery (CI/CD) server — software development teams use it to automatically build, test, and deploy their code.

What it is: CISA has flagged this vulnerability as actively exploited in the wild, per the advisory on The Hacker News. The flaw involves deserialization of untrusted data (a process where software converts incoming data back into executable objects — dangerous when the incoming data is not verified) arriving over the agent polling protocol, the channel build agents use to check in with the server.

Who's at risk: Any organisation running an on-premise TeamCity server that is reachable over a network.

CVSS: 9.8 — Critical. Patch today. Stop reading and go patch.

Root cause: The server processes incoming serialized data (packaged data sent across a network connection) from the agent polling channel without confirming whether the sender is actually a legitimate, authenticated build agent. When software trusts the shape of data rather than its verified origin, an attacker can craft a malicious payload and submit it as though it came from a trusted source.

Attack vector: An unauthenticated attacker who can reach the TeamCity server's network port sends a specially crafted serialized payload over the agent polling protocol. The server deserializes it without authentication checks, executing arbitrary operating system commands at whatever privilege level the TeamCity process runs under. No account credentials are required. A successful hit can expose stored credentials, tamper with build configurations, and compromise software pipelines that push code into production environments.

Detection strategies:

1. Look for unexpected process executions spawned by the TeamCity server process in your endpoint logs.
2. Monitor agent polling protocol traffic for connections from IP addresses outside your known build agent pool.
3. Review TeamCity audit logs for configuration changes or credential access that does not correspond to a known user session.

Recommended actions:

1. Apply the patched TeamCity release immediately — FCEB federal agencies must do so by August 8, 2026.
2. Restrict network access to the TeamCity server so only authorised build agents and administrators can reach it.
3. Review and rotate any credentials stored within TeamCity as a precaution.

What cPanel & WHM is: cPanel is the control panel software that web hosting companies use to let customers manage websites, email accounts, and databases through a browser interface. WHM (Web Host Manager) sits above it, used by hosting administrators to manage the server itself.

What it is: An authenticated cPanel user can cross the privilege boundary between their own account and the server's administrative database identity, executing arbitrary SQL (Structured Query Language — the language used to read and modify databases) with full root-level database permissions. cPanel's own advisory notes this may extend to operating-system-level compromise depending on server configuration.

Who's at risk: Any server running an unpatched version of cPanel & WHM or WP Squared where users have access to the MySQL/MariaDB database feature. Shared hosting environments — where many customers share one server — carry the highest exposure.

CVSS: 9.4 (Critical — patch today.)

Root cause: The flaw lives in cPanel's database-renaming process. When a database is renamed, the system creates a replacement, moves data, recreates permissions, and removes the old database. SQL mode is not preserved during this process, causing subsequent SQL to execute in the database's root administrative context rather than the user's restricted one. The HackerOne CNA classifies this as CWE-89 (SQL injection), though cPanel's own advisory frames it as privilege escalation — two valid descriptions of the same underlying failure.

Attack vector: An attacker with a valid cPanel account triggers the database-rename workflow. Because SQL mode drops to root context mid-operation, commands they supply run with full administrative database privileges. From there, depending on configuration, the path to operating-system access may be short.

Detection strategies: Review database audit logs for unexpected SUPER-privilege operations or schema changes from non-administrative cPanel accounts. Look for database rename events followed immediately by unusual stored procedure creation or user grants. Monitor for unexpected OS-level activity from the database process user.

Recommended actions:

1. Update to a patched build: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, or 138.1.6 for WP Squared.
2. If immediate patching is not possible, revoke the MySQL/MariaDB feature from cPanel user accounts in WHM as a temporary mitigation.
3. Audit which cPanel accounts currently have database access and restrict to those with a genuine need.

What N-able N-central is: N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) — companies that handle IT infrastructure for other businesses — to monitor, patch, and remotely access their clients' servers and devices.

What it is: This is an authentication bypass (a flaw that lets an attacker skip the login process entirely) that allows an unauthenticated user to take over admin accounts. Both on-premises and cloud-hosted versions are affected.

Who's at risk: MSPs and IT service providers running N-central below version 2026.3.1.7. Because MSPs manage systems for many clients, one compromised N-central console can expose every organisation that MSP supports.

CVSS: Not yet scored — treat as Critical until confirmed. Active exploitation is confirmed in the wild.

Root cause: This is a bypass of a previously patched flaw (CVE-2026-18556). Attackers found a new path around the fix and began exploiting it in late July 2026. The authentication layer failed to close all routes into privileged account access.

Attack vector: An attacker with network access sends a crafted request to the N-central console, bypasses authentication, and gains full admin control. From there, they can deploy scripts to managed endpoints, run remote sessions on critical servers, and register Cloudflare tunnels (persistent encrypted channels that survive even after server access is revoked) to maintain a foothold.

Detection strategies: Check N-central audit logs for admin account creation or logins from unrecognised IP addresses. Look for new Cloudflare tunnel registrations or unfamiliar services appearing on managed endpoints. Monitor for unexpected script deployments pushed through the N-central agent.

Recommended actions:

1. Upgrade to N-central version 2026.3.1.7 immediately.
2. Review indicators of compromise published by N-able and Huntress.
3. Audit admin accounts and active Cloudflare tunnels across your N-central environment.

CVE ID confirmed in source — verify details against the official SonicWall advisory before acting.

What SonicWall SMA1000 is: A hardware appliance organisations use to give remote workers secure access to internal corporate networks, sitting at the edge of the network as a gateway.

What it is: CVE-2026-15409 allows an unauthenticated attacker (someone with no account or credentials) to open a WebSocket tunnel (a persistent two-way connection channel) directly to restricted internal services. A second flaw, CVE-2026-15410 (CVSS 7.2), can then be used to escalate privileges to root, giving the attacker full control of the appliance. Ransomware group INC has been observed chaining both flaws together.

Who's at risk: Any organisation running SMA1000 appliances that have not applied the July 14 patch. Exploitation has been confirmed in the wild since at least June 22.

CVSS: 10.0 — Critical. Patch today. This is the highest possible score.

Root cause: The appliance failed to enforce authentication before allowing WebSocket connections to restricted service endpoints. Think of it like a secure building where the front desk waves anyone through without checking ID, because the system assumed only staff would know to walk up to that door.

Attack vector: An attacker sends an unauthenticated WebSocket request to the exposed endpoint. The appliance accepts the connection. From there, CVE-2026-15410 is used to elevate access to root. With root access, attackers have deployed backdoors and harvested credentials, and in some cases pivoted into internal corporate networks from the compromised appliance.

Detection strategies: Look for unexpected WebSocket connections to internal service ports originating from external IP addresses. Review SMA1000 authentication logs for access events with no corresponding valid session. Monitor for new or unrecognised files written to the appliance filesystem after June 22.

Recommended actions:

1. Apply the SonicWall patch released July 14, 2026, immediately.
2. Audit appliance logs for signs of compromise dating back to June 22.
3. Isolate any unpatched SMA1000 devices from internal networks until patching is complete.

CVE ID not confirmed in source — check the original advisory before acting.

What Coldcard is: Coldcard is a Bitcoin-only hardware wallet — a physical device that stores your private keys offline, made by Canadian company Coinkite.

What the flaw is: A 2021 firmware integration error caused wallet seed generation to use a weak software PRNG instead of the device's dedicated hardware RNG (random number generator). The software fallback produced seeds with far less entropy (unpredictability) than a secure wallet requires — roughly 40 bits on the Mk3, versus the 128 bits a standard 12-word seed should provide.

Who is at risk: Anyone whose seed was generated on an affected firmware version. Coinkite's advisory lists Mk3 versions 4.0.1 through 4.1.9 as vulnerable; Block's independent research also places Mk2 and Mk3 versions from 4.0.0 onward on the vulnerable path. Mk4 and Mk5 devices running firmware before 5.6.0, Q devices before 1.5.0Q, and Edge builds before 6.6.0X (Mk4/Mk5) or 6.6.0QX (Q) are also affected. The version running today is irrelevant — what matters is the version running when the seed was first created.

Recommended actions:

1. Install the emergency firmware released July 31 for your model.
2. If your seed was generated on an affected version, generate a brand-new seed on patched firmware and transfer all funds to the new wallet immediately.
3. Do not restore your old seed to any device or wallet — the weakness is in the seed itself, not the device.

What Adobe Campaign Classic is: Adobe Campaign Classic is enterprise marketing software used by large organisations to manage and automate mass email, SMS, and direct mail campaigns.

What it is: A flaw in how the software checks whether a user has permission to perform certain actions allows an attacker to run arbitrary code (any program the attacker chooses) on the affected server, with no interaction required from a legitimate user. The flaw carries a CVSS (Common Vulnerability Scoring System — a standardised 0–10 scale for severity) score of 10.0: Critical. Patch today.

Who's at risk: Organisations running Adobe Campaign Classic prior to version 7.4.3 build 9398 on Windows or Linux. Exposure is highest for internet-facing installations.

CVSS: 10.0 (Critical) — Patch today.

Root cause: The software fails to correctly verify whether a requesting party is authorised before executing privileged operations. When authorisation checks are absent or bypassed, the server treats an attacker's request with the same trust as a legitimate administrator's. Adobe has not disclosed the precise technical mechanism publicly.

Attack vector: An attacker sends a crafted request to an affected Campaign Classic server without needing a valid account or any victim to click anything. The server, lacking proper authorisation checks, processes the request and executes attacker-supplied code under the permissions of whatever account the server runs as.

Detection strategies: Review server-side logs for unexpected process spawning from the Campaign Classic service account. Look for outbound connections to unfamiliar hosts originating from the application process. Flag any authentication or permission-related errors that appear in bulk or in unusual sequences.

Recommended actions:

1. Upgrade Adobe Campaign Classic to v7.4.3 build 9398 on all Windows and Linux deployments immediately.
2. Restrict network access to Campaign Classic servers to known, trusted IP ranges.
3. Monitor application logs for anomalous process execution or unexpected outbound traffic.

What Chrome is: Google Chrome is the world's most widely used web browser, installed on billions of devices for everyday browsing, work, and personal use.

What it is: Google's AI security tooling discovered a flaw hiding in Chrome's code for 13 years, disclosed in full this week via Security Week. The vulnerability is an insufficient data validation error in Chrome's Navigation component that allows a sandbox escape (a breakout from the restricted zone where untrusted web content is supposed to run, isolated from your actual files and system).

Who's at risk: Anyone running Chrome below version 145, on any operating system.

CVSS: 9.8 — Critical. Patch this week.

Root cause: Chrome runs web content inside a sandboxed renderer process, a walled-off environment designed to keep untrusted code away from your system. The Navigation component failed to properly validate data passed between that renderer and the browser's core process. This meant a compromised renderer could trick the browser into reading local files it should never be able to access.

Attack vector: An attacker crafts a malicious HTML page and lures the target into visiting it. The page exploits the validation gap in the Navigation component, escaping the sandbox and gaining access to local files on the device.

Recommended actions:

1. Open Chrome, go to Settings → Help → About Google Chrome, and confirm you are on version 145 or later.
2. Enable automatic updates if they are not already on.
3. If you manage a fleet of devices, prioritise this update across all Chrome installations this week.

CVE ID confirmed in source — read the full advisory here.

What Ruby on Rails is: Ruby on Rails is a popular open-source web development framework used to build web applications. Active Storage is its built-in system for handling file uploads.

What the flaw is: A critical vulnerability in Active Storage allows an unauthenticated attacker to read files directly from the web server by uploading a crafted image. Those files can include secrets that unlock deeper access to the entire application.

Who's at risk: Any web application built on the affected Rails versions that accepts image uploads from the public and uses libvips (an image-processing library) for processing. Applications using MiniMagick (an alternative image-processing library) are not exposed through this path.

CVSS: 9.5 — Critical. Patch today.

Root cause: libvips supports certain file-loading operations that its own maintainers flag as unsafe for hostile input. Active Storage did not restrict access to these operations. It passed untrusted uploaded files directly into them. No special upload endpoint was needed — even standard variant generation triggered the vulnerable path.

Attack vector: An attacker uploads a specially crafted file (reportedly a MATLAB/HDF5 format file) through any public upload form. libvips processes it and reads internal server files. The attacker recovers SECRET_KEY_BASE (a master signing key Rails uses to verify session data). With that key, an attacker can forge authenticated session tokens, enabling RCE (remote code execution — running arbitrary commands on the server) or lateral movement (moving from one compromised system into others connected to it).

Detection strategies:

• Unexpected or malformed file types appearing in upload logs (MATLAB, HDF5, or similar scientific formats submitted to image upload endpoints)
• Anomalous outbound network requests from your Rails worker processes, particularly curl-style callbacks to external addresses
• Unrecognised session tokens appearing in application logs after no corresponding login event

Recommended actions:

1. Upgrade Rails to 7.2.3.2, 8.0.5.1, or 8.1.3.1 immediately. Rails 7.1 and earlier are end-of-life and will not receive a backport.
2. If you cannot patch immediately and run libvips 8.13 or later, set the environment variable VIPS_BLOCK_UNTRUSTED=1 or call Vips.block_untrusted(true) via ruby-vips 2.2.1 or later.
3. Rotate all secrets readable by the application process: secret_key_base, master key, database credentials, cloud storage keys, and third-party API tokens.

CVE ID not confirmed in source — check the original advisory before acting.

What OpenWrt is: OpenWrt is an open-source operating system that replaces the factory firmware on home and small-business routers, giving users more control over their network hardware.

What it is: A stack overflow (a flaw where a program writes more data into a fixed memory area than it was designed to hold, overwriting adjacent memory) in the DHCPv6 request handler inside a component called odhcpd. An unauthenticated attacker on the network can trigger it with a single crafted network packet.

Who's at risk: Anyone running OpenWrt versions before 24.10.8 or 25.12.5 with DHCPv6 enabled — the default configuration on most deployments.

CVSS: 9.8 — Critical. Patch today.

Root cause: The odhcpd component processes incoming DHCPv6 requests into a fixed 512-byte stack buffer without adequately checking whether the incoming data fits before appending reply information. Because odhcpd runs as root, and because most embedded routers lack stack canaries (small memory guards that detect overflow attempts) or ASLR (address space layout randomisation, which randomises memory locations to hinder exploit code), an overflow reliably translates into remote code execution rather than just a crash.

Attack vector: An attacker sends a crafted DHCPv6 REQUEST to UDP port 547. No authentication is required. The malformed packet overflows the stack buffer inside odhcpd, allowing the attacker to redirect execution and run arbitrary commands as root. Public proof-of-concept code is available in the advisory.

Detection strategies: Check odhcpd logs for malformed or unexpected DHCPv6 REQUEST messages on port 547. Look for unexpected root-level processes spawned by odhcpd. Monitor for unusual outbound connections from your router immediately after DHCPv6 activity.

Recommended actions:

1. Update to OpenWrt 24.10.8 or 25.12.5 using the OpenWrt Firmware Selector.
2. If you cannot patch immediately, consider disabling DHCPv6 on interfaces not actively using IPv6.
3. Begin planning migration to the 25.12 series before the 24.10 branch reaches end of life in September 2026.

What TeamCity is: TeamCity is a continuous integration and delivery server made by JetBrains — software used by development teams to automatically build, test, and deploy code.

What it is: A critical authentication bypass that allows an unauthenticated attacker to reach internal server functionality and execute operating system commands — all without ever logging in.

Who's at risk: Any organisation running TeamCity On-Premises with an internet-facing or network-accessible server. TeamCity Cloud instances are already patched.

CVSS: 9.8 — Critical. Patch today.

Root cause: The flaw sits in the agent polling protocol, a communication channel normally used by build agents (automated workers) to check in with the TeamCity server. The server failed to properly enforce authentication checks on this channel, meaning an attacker can send requests through it as if they were a legitimate agent and reach privileged functionality they should never be able to access. Think of it like a staff entrance with a broken lock — the front desk checks every visitor, but this side door waves anyone through.

Attack vector: An attacker with HTTP or HTTPS access to the TeamCity server sends crafted requests through the agent polling endpoint, bypassing authentication entirely. Once past that check, they can issue operating system commands that run with the same permissions as the TeamCity server process itself — which in many deployments means access to stored credentials, build configurations, source code, and deployment pipelines. No user interaction and no existing account is required.

Detection strategies:

1. Review TeamCity server logs for unexpected or unauthenticated requests to agent polling endpoints, particularly from unfamiliar IP addresses.
2. Check for unexpected outbound connections from the TeamCity host, especially to unusual destinations.
3. Audit recently modified build configurations, stored credentials, or administrator accounts for changes you did not make.

Recommended actions:

1. Upgrade to TeamCity On-Premises version 2025.11.7 or 2026.1.3 immediately.
2. If upgrading now is not possible, install JetBrains' security patch plugin (available for versions 2017.1 and above) as an interim measure.
3. Place the TeamCity server behind a VPN or restrict network access so it is not reachable from the public internet.