Threat Library

Siemens Mendix Runtime has a documentation gap regarding the special access-control behavior of the System.User entity, which can lead developers to misconfigure access rules and unintentionally expose sensitive user data or grant privilege escalation within deployed Mendix applications. A common misconfiguration allows anonymous users to gain access to all stored records via System.User specializations, even without explicitly configured access rights.

IBM Aspera Desktop App versions 1.0.5 through 1.0.19 contain a path traversal vulnerability that allows files transferred via Aspera to be written outside the user-selected download destination. This could enable attackers to overwrite sensitive files, plant malicious payloads in arbitrary filesystem locations, or achieve code execution depending on where files land.

A critical shell command injection vulnerability affects IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4, allowing a remote authenticated attacker to execute arbitrary code on the underlying host. Given the high CVSS score of 9.1 and the widespread use of Aspera Faspex for enterprise file transfer, successful exploitation could lead to full system compromise, data theft, or lateral movement within affected networks.

A critical vulnerability (CVE-2026-14958) in IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 allows a remote authenticated attacker to execute arbitrary code via unquoted shell interpolation. With a CVSS score of 9.1, exploitation could lead to full compromise of the file transfer server and any systems or credentials it interfaces with.

A critical pre-authentication unsafe deserialization vulnerability affects IBM WebSphere Application Server versions 9.0 and 8.5 traditional, allowing remote attackers to bypass authentication entirely and execute arbitrary code without any credentials. Given the CVSS score of 9.8 and lack of authentication requirement, this vulnerability is highly likely to be weaponized quickly once details or PoCs circulate.

IBM WebSphere Application Server versions 9.0 and 8.5 contain a critical broken access control vulnerability in the administrative console that allows privilege escalation. Exploitation could grant an attacker administrative control over the application server, enabling full compromise of hosted applications and backend services. Given the CVSS score of 9.8, this vulnerability is likely remotely exploitable with low complexity and no required privileges.

Dysphoria, an IoT botnet lineage tracked by CNCERT and XLab, has upgraded its command-and-control architecture to use blockchain-based naming services and peer-to-peer relays across infected devices, making it significantly more resilient to takedown efforts. This evolution follows a March 2026 law enforcement disruption of related JackSkid infrastructure, indicating the operators are actively hardening their C2 model against future enforcement action.

NVIDIA and 36 other organizations, including Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Palo Alto Networks, Red Hat, and the Linux Foundation, have formed the Open Secure AI Alliance to develop shared open standards and tools for securing software and AI agents. As part of this effort, the group open-sourced the NOOA framework, aimed at improving security tooling and best practices across the AI ecosystem. This is not a threat or vulnerability disclosure but an industry defensive initiative relevant to organizations deploying AI agents.

A maximum-severity OS command injection vulnerability (CVE-2026-16812, CVSS 10.0) in on-premises Arista VeloCloud Orchestrator (VCO) is being actively exploited in the wild. Successful exploitation allows unauthenticated or low-privilege attackers to achieve arbitrary code execution on the orchestrator, which centrally manages SD-WAN infrastructure across enterprise networks.

Dysphoria is a newly identified DDoS botnet that has compromised approximately 200,000 devices globally. The malware is being used both for distributed denial of service attacks and as a traffic relay/proxy network, indicating a dual-purpose criminal infrastructure. Its rapid scale suggests exploitation of weak credentials or unpatched vulnerabilities in widely deployed internet-facing devices.

Arista disclosed and patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator (VCO) deployments that has been actively exploited in the wild. Attackers can leverage the flaw to execute arbitrary commands on the orchestrator, potentially gaining control over SD-WAN management infrastructure. Organizations running on-premises VCO instances should patch immediately given confirmed exploitation.

Threat actors are actively exploiting an unpatched remote code execution vulnerability in the widely-used FastJson Java library, targeting US-based organizations. The flaw requires no authentication or user interaction, making it highly attractive for mass exploitation and initial access into enterprise networks.

CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: a sensitive information exposure flaw in Fortinet FortiOS (CVE-2025-68686) and an OS command injection vulnerability in Arista VeloCloud Orchestrator On-Prem (CVE-2026-16812). Both are confirmed to be exploited in the wild and require urgent remediation under BOD 26-04 for federal agencies, with CISA recommending all organizations prioritize patching.

CVE-2026-58662 is a critical out-of-bounds read vulnerability in Apache Thrift's C++ bindings caused by improper validation of specified quantity in input, affecting all versions before 0.24.0. Attackers can exploit this by sending crafted Thrift messages to trigger memory over-reads, potentially leading to information disclosure, service crashes, or further exploitation depending on the deployment context.

Apache Thrift's c_glib bindings prior to version 0.24.0 contain an out-of-bounds read vulnerability with a CVSS score of 9.1, indicating potential for information disclosure or denial of service. Apache Thrift is a widely used cross-language RPC framework, and this flaw could be exploited by processing malicious serialized data through affected bindings.

A critical heap-based buffer overflow has been identified in the C++ bindings of Apache Thrift, a widely used cross-language RPC framework, affecting all versions prior to 0.24.0. The vulnerability carries a CVSS score of 9.8, indicating remote exploitability with low attack complexity and potential for full system compromise. Organizations using Thrift-based services must upgrade immediately to mitigate risk of remote code execution or denial of service.

Apache Thrift's c_glib bindings before version 0.24.0 fail to properly validate that a TLS certificate's hostname matches the connected host, allowing an attacker positioned on the network path to present a mismatched but otherwise valid certificate and impersonate a trusted server. This affects any application using the c_glib Thrift client library to establish TLS-secured RPC connections, enabling man-in-the-middle attacks against Thrift-based service communication.

A critical OS command injection vulnerability (CVE-2026-16812) affects Arista VeloCloud Orchestrator On-Prem, a core SD-WAN management platform. CISA has added this to its Known Exploited Vulnerabilities catalog with an unusually short 3-day remediation window, indicating active exploitation in the wild. Successful exploitation grants attackers privileged access to the orchestrator host, threatening confidentiality, integrity, and availability of the entire managed SD-WAN fabric.

CVE-2025-68686 is a vulnerability in Fortinet FortiOS that allows a remote unauthenticated attacker to bypass a previously deployed patch addressing a symbolic link persistency mechanism used in post-exploitation scenarios. Exploitation requires prior compromise of the device at the filesystem level via another vulnerability, making this a persistence and detection-evasion enabler rather than an initial access vector. It has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

DevMan is a ransomware-as-a-service operation running a centralized web portal that lets affiliates build custom payloads, track victim status, and manage payouts. PRODAFT is tracking the broader operator infrastructure under the name Funky Mantis, indicating a structured, business-like criminal enterprise lowering the barrier to entry for ransomware deployment. The centralized tooling suggests active recruitment and scaling of affiliates, increasing the likely volume and diversity of attacks.