Vulnerability Watch

What SimpleHelp is: SimpleHelp is a remote support and monitoring tool used by IT teams and managed service providers to access and manage computers remotely.

What it is: CVE-2026-48558 is an authentication bypass (a flaw that lets attackers skip the login process entirely) in SimpleHelp RMM. Attackers are actively exploiting it to install Djinn Stealer on victim machines.

Who's at risk: Any organisation running an unpatched SimpleHelp RMM server that is reachable from the internet.

CVSS: Not yet scored — treat as High until confirmed.

Root cause: The flaw exists in SimpleHelp's authentication layer, which fails to properly verify that a request comes from a legitimate, credentialed user before granting access. An attacker can craft a request that bypasses this check entirely. Think of it like a staff entrance that checks for a badge but accepts a blank card.

Attack vector: An attacker sends a specially crafted request to an exposed SimpleHelp server. The server skips credential validation and grants access. The attacker then deploys Djinn Stealer, which harvests credentials for cloud platforms, source control systems, package registries, and AI development tools across Windows, macOS, and Linux.

Detection strategies:

• Unexpected new processes or files appearing on machines managed via SimpleHelp
• Outbound connections to unfamiliar hosts from the SimpleHelp server process
• Credential alerts from cloud platforms shortly after SimpleHelp activity

Recommended actions:

1. Apply the vendor patch immediately — check the official SimpleHelp advisory
2. Restrict SimpleHelp server access to trusted IP ranges only
3. Audit logs for unauthorised access attempts against your SimpleHelp instance

CVE ID confirmed in source — see the full runZero advisory before acting.

What FatFs is: FatFs is a tiny open-source library that lets embedded devices — security cameras, drones, hardware crypto wallets, industrial controllers — read and write USB drives and SD cards using the FAT and exFAT formats found on most removable storage.

What it is: An integer overflow (a maths error where a calculation wraps around and produces a nonsense result) in the code that mounts a FAT32 volume can generate a false file size. Downstream memory operations treat that false value as real, which can corrupt the device's memory and allow an attacker to run their own code.

Who's at risk: Any device running firmware that uses FatFs to handle removable storage or firmware update files. This includes consumer IoT products, industrial equipment, drones, and crypto wallets built on platforms such as Espressif ESP-IDF, Zephyr, MicroPython, ArduPilot, and others. Physical access to a USB or SD slot is the most common trigger, though some firmware update flows can be reached without physical media at all.

CVSS: 7.6 (High) — patch this week. Do not delay.

Attack vector: An attacker crafts a malformed FAT32 storage image on a USB drive or SD card and inserts it into the target device. FatFs processes the volume header, the integer overflow fires, and the resulting false size value propagates into memory operations without further validation. On hardware lacking standard memory protections — common in embedded systems — this becomes code execution. Some firmware update pipelines that parse FAT volumes can trigger the same path remotely.

Recommended actions:

1. If you build firmware that handles FAT or exFAT media, audit which version of FatFs you bundle and apply any vendor-supplied patches immediately.
2. Check whether your platform vendor (Espressif, STMicroelectronics, Zephyr, etc.) has issued a patched SDK release and update to it.
3. Where possible, restrict physical access to USB and SD ports on deployed devices — especially kiosks, ATMs, or public-facing hardware.

What Cursor is: Cursor is an AI-powered code editor used by software developers to write, edit, and review code, with a built-in AI agent that can execute terminal commands automatically on the developer's behalf.

What it is: Researchers at Cato Networks discovered a critical flaw, part of a vulnerability set referred to as DuneSlide (the collective name given to this pair of related flaws by Cato), that allows an attacker to break out of Cursor's sandbox (the restricted environment designed to contain what the AI can touch) and execute commands directly on the underlying operating system. A companion flaw also exists but is tracked separately. Full details are in the Security Week advisory.

Who's at risk: Developers running Cursor on any operating system who have not yet updated to version 3.0.

CVSS: 9.8 — Critical. Patch today.

Root cause: Cursor's sandbox is supposed to restrict the AI agent's terminal commands to the current working directory. However, when a non-default value is assigned to the working_directory parameter, that path gets added to the system's allow list without proper validation. This means an attacker-controlled value can expand the sandbox boundary to include locations outside the project — locations the developer never intended the AI to touch.

Attack vector: An attacker embeds a malicious payload inside content that Cursor's AI agent is asked to read — for example, inside a file, a prompt, or a connected MCP server request (a type of external service integration). The injected instruction tells the AI to set its working directory to an attacker-chosen path. From there, the attacker can overwrite Cursor's own sandbox executable, meaning all subsequent commands run outside any sandbox restrictions entirely. The attacker achieves full remote code execution (the ability to run arbitrary commands on your machine) without ever needing direct access to your system.

Detection strategies:

• Check application logs for unexpected changes to the working_directory parameter, particularly paths outside your active project folder.
• Monitor for modifications to the cursorsandbox executable on disk — changes to this file outside of an official update are a strong indicator of compromise.
• Look for unusual outbound network connections originating from Cursor's process, especially to unfamiliar external addresses.

Recommended actions:

1. Update Cursor to version 3.0 or later immediately — patches for this flaw were included in that release.
2. Until updated, avoid opening or ingesting files from untrusted or external sources inside Cursor.
3. Review any MCP server integrations connected to your Cursor installation and remove any you did not explicitly configure.

What Adobe ColdFusion is: ColdFusion is Adobe's web application server platform, used by organisations to build and run database-driven websites and internal business applications.

What it is: CVE-2026-48276 is an unrestricted file upload flaw. An attacker can send a file of any type to the server — including executable code — without the server checking whether it should be allowed. This leads to remote code execution (RCE), meaning the attacker can run commands on the server as if they were sitting at its keyboard.

Who's at risk: Any organisation running ColdFusion 2023 below Update 21 or ColdFusion 2025 below Update 10 with internet-accessible endpoints.

CVSS: 10.0 (Critical — patch today.)

Root cause: The server fails to validate the type of file being uploaded. Think of it as a secured door with a sign saying "no weapons," but no one actually checking bags. Any file gets through, including ones designed to execute on the server.

Attack vector: An attacker sends a crafted HTTP request containing a malicious file to a ColdFusion upload endpoint. Because the server performs no type-checking, the file is accepted and stored. The attacker then triggers its execution, gaining full control of the underlying server. No authentication is required.

Detection strategies: Review web server logs for unexpected file uploads to ColdFusion endpoints. Look for newly created files with executable extensions in upload directories. Monitor for unusual outbound connections from the ColdFusion server process.

Recommended actions:

1. Update ColdFusion 2023 to Update 21 and ColdFusion 2025 to Update 10 immediately.
2. Restrict public access to file upload endpoints at the network or firewall level.
3. Review server logs for signs of recent exploitation before patching.

CVE ID not confirmed in source — check the original advisory before acting.

What NetScaler ADC and NetScaler Gateway are: Citrix NetScaler products are network appliances used by organisations to manage, secure, and accelerate traffic flowing into their applications and services.

What it is: An external file path control flaw that allows an unauthenticated attacker to read arbitrary files from the appliance's filesystem. No login is required.

Who's at risk: Any organisation running an unpatched NetScaler appliance with the management interface (NSIP, Cluster Management IP, or SNIP with management access) exposed to untrusted networks.

CVSS: 7.7 (High) — patch this week.

Root cause: The appliance fails to properly validate or restrict user-supplied input that controls which file path is accessed during a request. Because no authentication check gates this operation, the flaw is reachable by anyone who can reach the management interface.

Attack vector: An attacker sends a crafted, unauthenticated HTTP request to the management interface, supplying a manipulated file path. The appliance processes it without validating who made the request or whether the path is permitted, and returns the contents of the targeted file. Configuration files and credentials are realistic targets.

Recommended actions:

1. Upgrade to NetScaler ADC and Gateway 14.1-72.61 or 13.1-63.18 or later immediately.
2. Restrict management interface access (NSIP/SNIP) to trusted internal networks only — never expose it to the public internet.
3. Review access logs on the management interface for unexpected file-read requests from unfamiliar sources.

What LoadMaster is: An application delivery controller and load balancer that enterprises use to manage and distribute incoming traffic across servers — it sits at the network edge, making it a high-value target.

What it is: An unauthenticated attacker can send a specially crafted request to LoadMaster's API and execute arbitrary commands as the root (highest-privilege) user. No login required.

Who's at risk: Any organisation running an affected LoadMaster version with the API enabled and network-accessible. A working proof of concept is now public as of June 29.

CVSS: 9.8 (Critical) — patch today.

Root cause: A function called escape_quotes() was meant to sanitise user input before passing it to a shell command. It allocated a memory buffer (a reserved block of storage for temporary data) without clearing it, and never wrote a null terminator (a marker character that tells the system "the string ends here"). Without that marker, the system reads past the sanitised input into adjacent memory — which an attacker can pre-load with a command injection payload (malicious commands disguised as ordinary input).

Attack vector: The attacker sends a JSON request to the /accessv2 endpoint, embedding a crafted apiuser value alongside dozens of extra keys each carrying the command to execute. The system sanitises the first value, keeps reading past it, and executes the attacker's commands as root. No credentials needed at any point.

Detection strategies: Look for unusual POST requests to /accessv2 with abnormally large JSON bodies or unexpected key counts. Monitor for root-level process spawning triggered by the LoadMaster process. Alert on any shell commands initiated from the LoadMaster API service.

Recommended actions:

1. Upgrade to GA v7.2.63.2 or LTSF v7.2.54.18 immediately.
2. If patching is not immediately possible, restrict API access to trusted IP ranges at the firewall.
3. Review LoadMaster API access logs for anomalous requests sent before the patch was applied.

What libssh2 is: A C library that gives software the ability to connect to SSH servers — it is embedded inside widely-used tools including curl, Git, and PHP, meaning it quietly runs inside many applications you use every day without advertising its presence.

What it is: A critical memory corruption flaw in the function that reads incoming SSH packets during a connection handshake. A malicious or compromised SSH server can trigger it with no credentials and no interaction from the user. The result is potential remote code execution (RCE — an attacker running their own commands on your machine) on the connecting client. A public proof-of-concept has been published, per The Hacker News.

Who's at risk: Any software that links libssh2 and connects to an SSH server — especially tools reaching external or untrusted servers. Many copies are bundled directly inside applications (statically linked — meaning the library is baked permanently into the application's own code), so updating your operating system's package manager may not touch them.

CVSS: 9.2 (Critical — patch today.)

Root cause: The packet-parsing code read an attacker-controlled length value from the incoming SSH packet but only rejected values below 1. No upper limit was enforced. When a very large length value is supplied, arithmetic to calculate the required buffer size wraps around to a tiny number (this is an integer overflow — when a number exceeds the maximum a fixed-size counter can hold and loops back to near zero). libssh2 then allocates a small buffer but later writes the full oversized packet into it, writing past the end of that buffer in memory — a heap out-of-bounds write (writing data beyond the boundary of an allocated memory block). The fix adds a single check rejecting any length above the permitted maximum before the arithmetic runs.

Attack vector: An attacker who controls or compromises an SSH server waits for a vulnerable client to connect. During the handshake, the server sends a crafted packet with an oversized length field. libssh2 miscalculates the buffer size, allocates too little memory, and then overwrites adjacent memory. Depending on the application and how libssh2 is embedded, this can lead to code running under that application's privileges. No user interaction is required beyond initiating the connection.

Detection strategies:

1. Unexplained crashes or memory errors in applications that make SSH connections (curl jobs, Git operations, backup agents)
2. Anomalous outbound connections following an SSH handshake to an external server
3. SSH client processes spawning unexpected child processes or making unusual network connections

Recommended actions:

1. Inventory every application and appliance that uses libssh2, including statically bundled copies — curl, Git, and PHP deployments are the most common carriers
2. Apply the patch by using distro backports where available (Debian already has a repaired build in testing) or build from source including commit 97acf3d
3. Until patched, restrict outbound SSH connections to trusted, verified servers and confirm host keys are checked before connecting

CVE ID not confirmed in source — check the original advisory before acting.

What Cisco Unified Communications Manager is: Cisco Unified Communications Manager (Unified CM) is enterprise software that manages phone calls, video conferencing, and messaging for large organisations — essentially the switchboard that ties all internal communications together.

What it is: According to a weekly roundup published by Help Net Security, a flaw in Cisco Unified CM is being actively exploited. The source does not supply the CVE ID, CVSS score, or specific patch version numbers. The full technical detail lives in the official Cisco advisory, which was not provided as a source for this issue.

Who's at risk: Organisations running Cisco Unified CM as part of their enterprise communications infrastructure. Active exploitation means attackers are not waiting — if your organisation uses this product, treat this as urgent.

CVSS: Not confirmed in available source — treat as High until the official advisory is reviewed.

Root cause: Insufficient detail is available from the source to describe the root cause with accuracy. Speculating on the flaw mechanism without a confirmed advisory would be irresponsible — check the Cisco Security Advisories portal directly.

Attack vector: Unknown from available source. The Help Net Security roundup confirms active exploitation is occurring but does not describe the attack method. Consult the official Cisco advisory for specifics.

Detection strategies:

1. Review authentication and access logs on your Unified CM servers for unexpected login attempts or privilege escalation events.
2. Monitor network traffic for unusual connections to or from Unified CM nodes, particularly outbound to unfamiliar external addresses.
3. Check whether any new admin accounts have appeared in your Unified CM configuration without a corresponding change request.

Recommended actions:

1. Visit the Cisco Security Advisories portal and search for the latest Unified Communications Manager advisory to obtain the confirmed CVE ID, CVSS score, and patch version.
2. Apply the vendor-recommended patch immediately given confirmed active exploitation.
3. Restrict administrative access to Unified CM to trusted internal IP ranges while patching is underway.

What Amazon Q Developer is: Amazon Q Developer is an AI-powered coding assistant, built as a Visual Studio Code extension, that offers code suggestions, automated refactoring, and the ability to connect to external tools and services.

What it is: A high-severity flaw in how the extension handled Model Context Protocol (MCP) servers — local processes an AI assistant can spawn to reach databases, APIs, or build tools. The extension would automatically read and act on an MCP configuration file found inside an open workspace, without asking the user for permission first.

Who's at risk: Any developer who opens a repository containing a malicious .amazonq/mcp.json file in an unpatched version of the extension. No special privileges are needed on the attacker's side — just getting a developer to open the repo.

CVSS: 8.5 (High — patch this week.)

Root cause: The extension trusted configuration files found in an open workspace without first confirming the user wanted to run what those files defined. Treating a file dropped into a folder as an instruction to execute, rather than as untrusted input to review, is the entire flaw.

Attack vector: An attacker plants a .amazonq/mcp.json file inside a public or shared repository. When a developer opens that repository in VS Code with Amazon Q Developer installed, the extension reads the file and launches the MCP server it defines — as a local process that inherits the developer's full environment, including AWS keys and other cloud credentials loaded in that session. From git clone to cloud compromise takes a single workspace open, no further clicks required.

Detection strategies:

1. Review any repository opened recently for an unexpected .amazonq/mcp.json file, especially one not committed by a known contributor.
2. Audit AWS CloudTrail logs for API calls made shortly after a developer's IDE session began, particularly from credentials tied to a workstation rather than a service role.
3. Check Amazon Q Developer's extension version against AWS's patched release — anything before May 12, 2026 is exposed.

Recommended actions:

1. Update the Amazon Q Developer extension to the patched version immediately.
2. Rotate any AWS credentials that were active in a VS Code session where an untrusted repository was opened.
3. Treat any repository-supplied configuration file as untrusted input — review it before opening the workspace in an editor with AI-assistant integrations enabled.

What PTC Windchill is: Windchill is enterprise software used by manufacturers — in industries like automotive, aerospace, and defence — to manage the full lifecycle of a product, from design files and engineering specs through to compliance records. Think of it as the document nervous system of a factory floor.

What it is: This flaw is an improper input validation vulnerability, meaning the software fails to check whether data sent to it is safe before acting on it. A remote attacker with no login credentials can send a specially crafted request to the server and execute arbitrary code — essentially run any command they choose.

Who's at risk: Any organisation running an unpatched version of Windchill or FlexPLM that is reachable from the internet, or from an internal network an attacker has already accessed. Industrial and manufacturing companies are the primary targets here.

CVSS: Not publicly confirmed at time of writing — treat as Critical until scored. CISA has added it to its Known Exploited Vulnerabilities catalogue and set a federal patch deadline of 28 June 2026.

Root cause: The application does not adequately validate the structure or content of incoming requests before processing them. When input validation (the process of checking that data matches what the application expects) is skipped or insufficient, an attacker can craft requests that the server interprets as legitimate instructions. The server then executes whatever the attacker embedded in that request.

Attack vector: An unauthenticated attacker sends a malformed HTTP request to the Windchill server. Because the application does not verify the input properly, it processes the request and executes code supplied by the attacker. Confirmed attacks have used this to deploy persistent JSP webshells — small scripts planted on the server that let the attacker issue commands and pull data long after the initial intrusion. Data exfiltration (removing data from the system without authorisation) has also been observed.

Detection strategies: Look for unfamiliar .jsp files created recently in web-accessible directories on your Windchill server. Monitor for unusual outbound connections originating from the Windchill application process. Review web server access logs for malformed or oversized requests targeting Windchill endpoints, particularly from external IP addresses.

Recommended actions:

1. Apply PTC's patches immediately — releases began 17 June 2026. Check the official PTC advisory for version-specific guidance.
2. If patching is not immediately possible, restrict external network access to Windchill servers and place them behind a firewall or VPN.
3. Review PTC's published indicators of compromise and run them against your logs now, before completing the patch.