Vulnerability Watch

What Fastjson is: Fastjson is an open-source Java library maintained by Alibaba that parses and generates JSON (a common data exchange format), used extensively in enterprise web services and APIs.

What it is: An attacker can send a specially crafted JSON request containing a malicious @type field (a directive that tells Fastjson which Java class to load) to a vulnerable application endpoint. Without any prior authentication or special privileges, this causes the server to load and execute attacker-controlled code.

Who's at risk: Developers and organisations running Java applications packaged as Spring Boot fat-JARs (self-contained executable files that bundle all dependencies) using Fastjson versions 1.2.68 through 1.2.83 with SafeMode left at its disabled default. Standard WAR deployments on Tomcat or Jetty are not affected.

CVSS: 9.0 (Critical — patch today; no fix yet exists, so apply mitigations immediately.)

Root cause: Fastjson's type-resolution path trusts an attacker-supplied @type value and converts it into a class-resource lookup. When running inside a Spring Boot fat-JAR, this lookup can traverse nested JAR paths, fetch attacker-controlled bytecode from a remote location, and then treat an @JSONType annotation in that retrieved resource as a verification signal. Because that annotation is treated as evidence the class is trustworthy, Fastjson loads and executes the class. The developer failure here is allowing attacker-controlled input to influence which code gets loaded and trusted at runtime — without any independent validation.

Attack vector: An attacker identifies a network-reachable endpoint that passes user-supplied JSON to JSON.parse, JSON.parseObject(String), or JSON.parseObject(String, Class). They submit a payload embedding a crafted @type value pointing to a nested JAR path they control. Fastjson follows that path, retrieves the attacker's bytecode, reads the @JSONType annotation as a trust signal, and loads the class — executing the attacker's code with the full privileges of the Java process. No login, no existing access, and no classpath manipulation required.

Detection strategies:

1. Look for outbound connections from your Java application process to unexpected external hosts, particularly fetching .jar files.
2. Monitor application logs for @type values referencing unusual class names, nested JAR paths, or /proc/self/fd references.
3. Watch for unexpected child processes spawned by your Java application, or new files appearing in application directories without a deployment event.

Recommended actions:

1. Inventory all Fastjson dependencies, including transitive ones pulled in by other libraries, and confirm whether versions 1.2.68–1.2.83 are present.
2. Apply the immediate mitigation: add -Dfastjson.parser.safeMode=true to your JVM startup flags, or switch to the com.alibaba:fastjson:1.2.83_noneautotype build.
3. Begin planning migration to Fastjson2, which does not share this type-resolution path and is Alibaba's stated long-term fix.

What Active Directory Certificate Services is: Microsoft's built-in system for issuing digital certificates inside a corporate Windows network — used to prove that computers and users are who they claim to be.

What it is: A low-privileged domain user can trick the certificate authority into signing a certificate that belongs to a Domain Controller. That certificate then grants attacker-level access to the entire directory. Researchers codenamed it Certighost. A working public exploit was published on 24 July, per The Hacker News.

Who's at risk: Any organisation running an Enterprise Certificate Authority on Windows Server. No administrator account required — a standard domain login is enough.

CVSS: 8.8 (High — patch this week. Do not delay.)

Root cause: The certificate authority followed attacker-supplied directions about which server to contact during a fallback enrollment step, without first verifying it was a real Domain Controller. Microsoft's July 14 patch adds that verification check.

Attack vector: The attacker creates or reuses a computer account, runs rogue SMB (Server Message Block — a Windows file-sharing protocol) and LDAP (Lightweight Directory Access Protocol — a directory lookup protocol) listeners, and relays the certificate authority's authentication challenge to the real Domain Controller. The CA returns a certificate for the Domain Controller. The attacker uses that certificate to request all account password hashes via DCSync (a technique that impersonates directory replication to pull credential secrets).

Detection strategies: Monitor for new computer account creation by standard user accounts. Alert on unexpected SMB or LDAP connections originating from non-server hosts. Check for DCSync operations performed by accounts that are not Domain Controllers.

Recommended actions:

1. Install Microsoft's July 14 cumulative update on all AD CS hosts immediately.
2. If patching is delayed, apply the chase-fallback mitigation documented in the researchers' advisory.
3. Review logs for computer account creation by non-admin users in the past 30 days.

CVE ID not confirmed in source — check the original advisory before acting.

PTC Windchill and FlexPLM are enterprise Product Lifecycle Management (PLM) platforms — software used by engineering, manufacturing, and supply chain teams to design and manage products from concept through to production. They are widely used in aerospace, defence, automotive, and medtech.

What it is: CVE-2026-12569 is a critical unsafe deserialization vulnerability (a flaw where an application processes attacker-supplied data as trusted executable instructions without verifying it first). Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the vulnerable server, as reported by Bleeping Computer.

Who's at risk: Any organisation running internet-exposed Windchill or FlexPLM instances that has not applied the patches released from 17 June 2026. PTC serves over 30,000 customers globally.

CVSS: 9.3 (Critical — patch this week. This is actively being exploited.)

Root cause: The application deserializes attacker-controlled input without validating whether the resulting object is safe to process. Think of it like a mailroom that opens every parcel and assembles its contents without checking whether the instructions inside are legitimate or malicious. The server trusts the data structure entirely, allowing attackers to embed executable instructions inside a crafted request.

Attack vector: An unauthenticated attacker sends a specially crafted HTTP request to an internet-exposed Windchill or FlexPLM instance. The server deserializes the payload, executes the embedded code, and the attacker gains remote control. From there, Clop operators have been deploying JSP webshells (small server-side scripts that give persistent remote command access) to extract sensitive product design and manufacturing data.

Detection strategies: Look for unexpected JSP files in application directories. Monitor outbound connections from PLM servers to unfamiliar external IPs. Check for extortion emails arriving from support@cryptohox.com, a confirmed Clop contact address.

Recommended actions:

1. Apply PTC's security patches (available from 17 June 2026) immediately.
2. Place Windchill and FlexPLM instances behind a VPN or trusted access gateway — remove direct internet exposure.
3. If compromise is suspected, isolate the affected server, collect forensic logs, and rotate all exposed credentials before restoring service.

What Windmill is: Windmill is an open-source developer platform that lets teams build and run automated scripts, workflows, and internal tools through a web interface.

What it is: An unauthenticated path traversal flaw (where an attacker navigates outside the intended file directory by inserting ../ sequences into a file request) in Windmill's log file retrieval endpoint. No login is required to trigger it.

Who's at risk: Anyone running a Windmill instance below version 1.603.3 that is exposed to the internet. VulnCheck identified approximately 170 vulnerable systems across 24 countries. Risk is highest where the SUPERADMIN_SECRET environment variable is configured, as reading it grants full superadmin access and arbitrary code execution.

CVSS: 7.5 (High) — patch this week.

Root cause: The filename parameter passed to the get_log_file endpoint was concatenated directly into a file path with no sanitisation checks. The server trusted whatever string the user supplied and opened the corresponding file. Version 1.603.3 adds input sanitisation to block traversal sequences.

Attack vector: An attacker sends a crafted unauthenticated request to /api/w/{workspace}/jobs_u/get_log_file/{filename}, substituting the filename for a traversal string such as ../../../proc/1/environ. The server returns the contents of that file. If SUPERADMIN_SECRET is present in that environment file, the attacker uses it as a Bearer token to authenticate as superadmin and execute arbitrary code. Active exploitation has targeted /etc/passwd for credential reconnaissance.

Detection strategies:

1. Look for HTTP requests to /api/w/*/jobs_u/get_log_file/ containing ../ or %2e%2e sequences in server access logs.
2. Monitor for unexpected reads of /etc/passwd or /proc/1/environ in file access logs.
3. Alert on any Bearer token authentication from IP addresses that have not previously logged in.

Recommended actions:

1. Upgrade Windmill to version 1.603.3 or later immediately.
2. Restrict public internet access to the Windmill management interface.
3. Rotate the SUPERADMIN_SECRET value and audit recent superadmin session activity.

CVE ID confirmed in source — verify details at the official Microsoft advisory before acting.

What Microsoft SharePoint Server is: SharePoint is Microsoft's on-premises collaboration platform used by organisations to host internal websites, share documents, and manage team workflows.

What it is: A critical deserialization flaw — where a server processes attacker-supplied data as trusted instructions rather than plain input — allows an unauthenticated attacker to run arbitrary code remotely. Reported by The Hacker News.

Who's at risk: Any organisation running on-premises SharePoint Server (Subscription Edition, 2019, or 2016) that has not applied Microsoft's July 2026 Patch Tuesday update. Cloud-hosted SharePoint Online is not affected.

CVSS: 9.8 — Critical. Patch today.

Root cause: The server deserializes (converts back into executable objects) data submitted through a SharePoint sign-in endpoint without first confirming the data is safe. Think of it like a mail room that opens every package and executes whatever instructions are inside, without checking the sender. Attackers submit a crafted payload that the server converts into runnable code.

Attack vector: Security firm watchTowr has observed active exploitation following the release of a public proof-of-concept. Attackers are sending a single unauthenticated request to extract the server's machine keys. Those keys can then be used to forge trusted tokens and maintain persistent access even after a patch is applied — which is why credential rotation matters as much as patching here.

Detection strategies: Look for unauthenticated POST requests to SharePoint sign-in endpoints; unexpected machine key access in IIS logs; and any newly persisted .NET deserialization payloads in SharePoint application directories.

Recommended actions:

1. Apply Microsoft's July 2026 Patch Tuesday update immediately.
2. Rotate machine keys and credentials on any SharePoint server that may have been exposed before patching.
3. Review IIS logs for suspicious unauthenticated requests to sign-in endpoints dating back to the PoC release.

CVE ID not confirmed in source — check the original advisory before acting.

What ServiceNow is: ServiceNow is a cloud-based platform used by businesses to manage IT operations, employee workflows, and customer service processes.

What it is: CVE-2026-6875 is a sandbox escape vulnerability — meaning an attacker can break out of the restricted code environment ServiceNow uses to run user-submitted logic, then execute arbitrary code (run any command they choose) on the underlying server, all without logging in.

Who's at risk: Organisations running self-hosted ServiceNow instances that have not applied the June 2026 patches. Cloud-managed customers on supported versions should confirm their instance is current.

CVSS: 9.5 (Critical — patch today).

Root cause: The flaw exists in a pre-authentication endpoint (/assessment_thanks.do), meaning the server processes attacker-controlled input before verifying who is sending it. The sandbox meant to contain that code execution can be escaped via a documented gadget chain, giving the attacker full control of the ServiceNow instance and any connected proxy servers.

Attack vector: An attacker sends an HTTP POST request to the publicly accessible /assessment_thanks.do endpoint with a crafted payload. No credentials are needed. The sandbox escape gadget routes the request to the same code execution primitive identified in the published proof-of-concept exploit, resulting in complete instance compromise. Active exploitation has been observed in the wild.

Detection strategies: Look for unexpected POST requests to /assessment_thanks.do in your web server logs. Monitor for new or unusual processes spawned by the ServiceNow application user. Alert on any outbound connections from your ServiceNow host to unfamiliar external IP addresses.

Recommended actions:

1. Apply the June 2026 patches immediately (Brazil EA/GA, Australia Patch 2, Zurich Patch 7b/9, Yokohama Patch 12 HF1b/13).
2. Restrict external access to your ServiceNow instance at the network level where possible.
3. Review ServiceNow logs for POST activity against the affected endpoint going back to April 2026.

What NGINX is: NGINX is a web server used by a large portion of the internet to deliver websites and handle web traffic — it sits between your browser and the application behind it.

What it is: A heap buffer overflow (a flaw where a program writes more data into a reserved memory block than it can hold, corrupting adjacent memory) in NGINX's string-assembly engine. It is triggered by a specific server configuration involving regex-based map directives. Read the full advisory here.

Who's at risk: Any server running NGINX 0.9.6 through 1.31.2 with the affected regex map configuration. This includes NGINX Plus and related F5 products.

CVSS: 9.2 (Critical — patch today).

Root cause: NGINX's two-pass evaluation system measures the required buffer size in one pass, then writes data in a second. A regex evaluated between passes overwrites the shared capture state. The buffer is sized for the original value but filled with attacker-controlled data, causing the overflow.

Attack vector: A remote, unauthenticated attacker sends a crafted HTTP request. On servers where ASLR (address space layout randomisation, a memory protection mechanism) is disabled, this may enable remote code execution (RCE). One researcher argues the flaw itself can bypass ASLR on default Ubuntu 24.04 systems.

Detection strategies: Watch for unexpected NGINX worker crashes or restarts in your process logs. Unusual or malformed HTTP requests in access logs — particularly oversized or regex-heavy payloads — warrant investigation.

Recommended actions:

1. Upgrade to NGINX 1.30.4 (stable) or 1.31.3 (mainline), or NGINX Plus 37.0.3.1.
2. If patching immediately is not possible, switch affected regex maps to named captures as a temporary mitigation.
3. Monitor for unexpected worker restarts as a potential sign of active probing.

CVE ID not confirmed in source — check the original advisory before acting.

What 7-Zip is: 7-Zip is a free, widely used file compression and extraction tool for Windows that handles formats including ZIP, RAR, and XZ archives.

What it is: A heap-based buffer overflow (a flaw where a program writes more data than a memory region can hold, spilling into adjacent memory) exists in how 7-Zip processes XZ-compressed archive data. A specially crafted archive file can trigger this overflow and allow an attacker to run arbitrary code on the victim's machine, according to Bleeping Computer.

Who's at risk: Anyone running 7-Zip below version 26.02 on Windows who opens archive files from untrusted sources.

CVSS: Not yet scored — treat as High until confirmed.

Root cause: 7-Zip's XZ decompression routine failed to track remaining available space in the output buffer correctly. Without that check, the decoder could write beyond the buffer's boundary, corrupting adjacent memory in a way an attacker can control. The fix in version 26.02 adds a boundary check so the decoder stops before overflowing.

Attack vector: An attacker crafts a malicious XZ archive and delivers it via phishing email or a compromised download link. The victim opens the file in 7-Zip. During decompression, the malformed data triggers the buffer overflow. The attacker's code executes with the same privileges as the user who opened the file. No elevated access is needed on the attacker's side — just a convincing enough reason for the victim to open the file. Think of it like a parcel that explodes when the recipient cuts the tape.

Detection strategies: Watch for 7-Zip processes spawning unexpected child processes (particularly cmd.exe or PowerShell). Monitor for unusual outbound network connections originating from the 7-Zip process. Check for newly created scheduled tasks or registry run keys appearing immediately after archive extraction.

Recommended actions:

1. Download and install 7-Zip version 26.02 manually from 7-zip.org — there is no automatic update.
2. Until patched, avoid opening archive files received from unknown senders or unfamiliar websites.
3. If you manage endpoints, consider application control policies that alert on unexpected child processes spawned by archive utilities.

What WordPress is: WordPress is the software that powers roughly half of all websites on the internet, from personal blogs to major news outlets.

What it is: A flaw in WordPress's REST API (the interface that lets external tools communicate with a site) batch-route endpoint can be chained with a separate SQL injection (a technique where an attacker inserts malicious database commands into a field that should only accept plain data) to let a completely anonymous user run code on any affected site. No login required.

Who's at risk: Any site running WordPress 6.9.0 through 7.0.1. Sites on 6.8.x are exposed to the SQL injection component only, not the full code-execution chain. A working proof-of-concept is publicly available.

CVSS: 7.5 (High — patch this week). Note: WordPress's own advisory rates the RCE chain Critical; the formal CVE score does not fully reflect code-execution impact. Treat this as Critical and patch today.

Root cause: WordPress's WP_Query function fails to check whether the author__not_in parameter is an array before using it. When a string is passed instead, the raw value drops into the database query unfiltered. The batch endpoint separately allows sub-request arrays to fall out of sync when one sub-request errors, causing a subsequent request to run under the wrong handler and bypass the endpoint's access controls.

Attack vector: An unauthenticated attacker sends a crafted batch request to /wp-json/batch/v1. A deliberate error in one sub-request shifts the handler assignment. The attacker's input then reaches the vulnerable WP_Query parameter, executing arbitrary database commands and ultimately arbitrary code on the server.

Recommended actions:

1. Update to WordPress 6.8.6, 6.9.5, or 7.0.2 immediately. Auto-updates may not have applied if you disabled them — verify manually.
2. Check your version now at wp2shell.com, where Searchlight Cyber has published a dedicated checker.
3. Review server logs for unusual requests to /wp-json/batch/v1.

What FortiSandbox is: A Fortinet security product that analyses suspicious files and network traffic in an isolated environment to detect malware before it reaches the rest of a network.

What it is: An OS command injection vulnerability (where an attacker sends specially crafted input that the system mistakenly runs as a system-level command) that allows an unauthenticated attacker to execute arbitrary commands via malicious HTTP requests.

Who's at risk: Any organisation running an unpatched FortiSandbox deployment reachable from the internet. No login required to exploit this.

CVSS: 9.1 — Critical. Patch today.

Root cause: The software fails to properly sanitise user-supplied input before passing it to underlying system functions. Think of it like a form that accepts your name but also accidentally runs anything you type as a terminal command.

Attack vector: An attacker sends a crafted HTTP request to the FortiSandbox interface — no credentials, no user interaction needed. The system processes the malicious input as a command and executes it with elevated privileges.

Recommended actions:

1. Upgrade to FortiSandbox 4.4.9 or 5.0.6 immediately.
2. If running cloud or PaaS versions without an available patch, discontinue use until patched.
3. Restrict external access to the FortiSandbox management interface at the network level.