Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
17494 vulnerabilities reference this CWE, most recent first.
CVE-2026-86182 (GCVE-0-2026-86182)
Vulnerability from cvelistv5 – Published: 2026-09-06 08:45 – Updated: 2026-09-08 13:55
VLAI
EPSS
VEX
Title
diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery
Summary
A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dm_command causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:54 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/399314 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/399314/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-86182 | third-party-advisory |
| https://vuldb.com/submit/896154 | third-party-advisory |
| https://github.com/diem-project/diem/issues/449 | exploitissue-tracking |
| https://github.com/diem-project/diem/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| diem-project | diem |
Affected:
5.1.0
Affected: 5.1.1 Affected: 5.1.2 Affected: 5.1.3 cpe:2.3:a:diem-project:diem:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86182",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:54:06.107980Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:55:02.173Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:diem-project:diem:*:*:*:*:*:*:*:*"
],
"modules": [
"dmConsole"
],
"product": "diem",
"vendor": "diem-project",
"versions": [
{
"status": "affected",
"version": "5.1.0"
},
{
"status": "affected",
"version": "5.1.1"
},
{
"status": "affected",
"version": "5.1.2"
},
{
"status": "affected",
"version": "5.1.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yingxiujie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dm_command causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T08:45:07.507Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-399314 | diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/399314"
},
{
"name": "VDB-399314 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/399314/cti"
},
{
"name": "CVE-2026-86182 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-86182"
},
{
"name": "Submit #896154 | diem-project diem 116974edfb9a5b8bd69cb13586dc62bcdbb485ad Cross-Site Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/896154"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/diem-project/diem/issues/449"
},
{
"tags": [
"product"
],
"url": "https://github.com/diem-project/diem/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-05T13:01:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-86182",
"datePublished": "2026-09-06T08:45:07.507Z",
"dateReserved": "2026-09-05T10:56:48.083Z",
"dateUpdated": "2026-09-08T13:55:02.173Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86178 (GCVE-0-2026-86178)
Vulnerability from cvelistv5 – Published: 2026-09-05 11:01 – Updated: 2026-09-24 14:21
VLAI
EPSS
VEX
Title
Pixelfed through 0.12.9 Unauthorized Story Access via API
Summary
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:20 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/Pixelfed.md | third-party-advisoryexploit |
| https://github.com/pixelfed/pixelfed/blob/v0.12.9… | technical-description |
| https://github.com/pixelfed/pixelfed/blob/v0.12.9… | technical-description |
| https://github.com/pixelfed/pixelfed/blob/v0.12.9… | technical-description |
| https://github.com/pixelfed/pixelfed | product |
| https://www.vulncheck.com/advisories/pixelfed-thr… | third-party-advisory |
Impacted products
Date Public
2026-09-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86178",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:20:50.838883Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:21:02.225Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pixelfed/pixelfed",
"product": "pixelfed",
"vendor": "pixelfed",
"versions": [
{
"lessThanOrEqual": "0.12.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pixelfed:pixelfed:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.12.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:21:18.133Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Advisory",
"tags": [
"third-party-advisory",
"exploit"
],
"url": "https://github.com/geo-chen/oss/blob/main/Pixelfed.md"
},
{
"name": "StoryComposeController react",
"tags": [
"technical-description"
],
"url": "https://github.com/pixelfed/pixelfed/blob/v0.12.9/app/Http/Controllers/StoryComposeController.php#L487-L501"
},
{
"name": "StoryComposeController comment",
"tags": [
"technical-description"
],
"url": "https://github.com/pixelfed/pixelfed/blob/v0.12.9/app/Http/Controllers/StoryComposeController.php#L566-L580"
},
{
"name": "Story react and comment routes",
"tags": [
"technical-description"
],
"url": "https://github.com/pixelfed/pixelfed/blob/v0.12.9/routes/web-api.php#L154-L155"
},
{
"tags": [
"product"
],
"url": "https://github.com/pixelfed/pixelfed"
},
{
"name": "VulnCheck Advisory: Pixelfed through 0.12.9 Unauthorized Story Access via API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pixelfed-through-0.12.9-unauthorized-story-access-via-api"
}
],
"title": "Pixelfed through 0.12.9 Unauthorized Story Access via API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86178",
"datePublished": "2026-09-05T11:01:28.748Z",
"dateReserved": "2026-09-05T10:40:41.710Z",
"dateUpdated": "2026-09-24T14:21:18.133Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86177 (GCVE-0-2026-86177)
Vulnerability from cvelistv5 – Published: 2026-09-05 11:01 – Updated: 2026-09-24 14:21
VLAI
EPSS
VEX
Title
Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
Summary
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 18:13 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/pterodactyl/panel/commit/913b3… | patch |
| https://github.com/geo-chen/oss/blob/main/panel.md | third-party-advisoryexploit |
| https://github.com/pterodactyl/panel/blob/v1.14.0… | technical-description |
| https://github.com/pterodactyl/panel/blob/v1.14.0… | technical-description |
| https://github.com/pterodactyl/panel/releases/tag… | release-notes |
| https://github.com/pterodactyl/panel | product |
| https://www.vulncheck.com/advisories/pterodactyl-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pterodactyl | panel |
Affected:
0 , < 1.14.1
(semver)
Unaffected: 1.14.1 (semver) cpe:2.3:a:pterodactyl:panel:*:*:*:*:*:*:*:* |
Date Public
2026-09-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86177",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:13:59.381722Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T18:14:11.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pterodactyl/panel",
"product": "panel",
"vendor": "pterodactyl",
"versions": [
{
"lessThan": "1.14.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.14.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pterodactyl:panel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.14.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:21:17.153Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pterodactyl/panel/commit/913b354aff43ff04fce95357ed68a675a1dd0fa6"
},
{
"name": "Researcher Advisory",
"tags": [
"third-party-advisory",
"exploit"
],
"url": "https://github.com/geo-chen/oss/blob/main/panel.md"
},
{
"name": "StoreTaskRequest permission and rules",
"tags": [
"technical-description"
],
"url": "https://github.com/pterodactyl/panel/blob/v1.14.0/app/Http/Requests/Api/Client/Servers/Schedules/StoreTaskRequest.php#L10-L25"
},
{
"name": "RunTaskJob action dispatch",
"tags": [
"technical-description"
],
"url": "https://github.com/pterodactyl/panel/blob/v1.14.0/app/Jobs/Schedule/RunTaskJob.php#L60-L75"
},
{
"name": "Pterodactyl Panel v1.14.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/pterodactyl/panel/releases/tag/v1.14.1"
},
{
"tags": [
"product"
],
"url": "https://github.com/pterodactyl/panel"
},
{
"name": "VulnCheck Advisory: Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pterodactyl-panel-before-1.14.1-privilege-escalation-via-schedule-tasks"
}
],
"title": "Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86177",
"datePublished": "2026-09-05T11:01:28.077Z",
"dateReserved": "2026-09-05T10:40:41.335Z",
"dateUpdated": "2026-09-24T14:21:17.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86136 (GCVE-0-2026-86136)
Vulnerability from cvelistv5 – Published: 2026-09-29 23:05 – Updated: 2026-09-30 15:28
VLAI
EPSS
VEX
Title
Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A
Summary
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 14:42 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.watchguard.com/CVE-2026-86136 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WatchGuard | Fireware OS |
Affected:
2026.0 , < 2026.3.2
(custom)
Affected: 2025.0 , < 2026.2.3 (custom) Affected: 12.0 , < 12.12.3 (custom) |
|
| WatchGuard | Fireware OS |
Affected:
12.0 , < 12.5.21
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86136",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T14:42:26.667301Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T15:28:13.707Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Default"
],
"product": "Fireware OS",
"vendor": "WatchGuard",
"versions": [
{
"lessThan": "2026.3.2",
"status": "affected",
"version": "2026.0",
"versionType": "custom"
},
{
"lessThan": "2026.2.3",
"status": "affected",
"version": "2025.0",
"versionType": "custom"
},
{
"lessThan": "12.12.3",
"status": "affected",
"version": "12.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"T15/T35"
],
"product": "Fireware OS",
"vendor": "WatchGuard",
"versions": [
{
"lessThan": "12.5.21",
"status": "affected",
"version": "12.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo exploit this vulnerability, an attacker requires network access to a management interface on the Firebox.\u003c/p\u003e"
}
],
"value": "To exploit this vulnerability, an attacker requires network access to a management interface on the Firebox."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.5.21",
"versionStartIncluding": "12.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.3.2",
"versionStartIncluding": "2026.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.2.3",
"versionStartIncluding": "2025.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.12.3",
"versionStartIncluding": "12.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "WatchGuard AI Security Research"
}
],
"descriptions": [
{
"lang": "en",
"value": "A missing authorization vulnerability in the wgagent management daemon\u0027s session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."
}
],
"value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-476",
"description": "CWE-476",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T23:05:47.485Z",
"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"shortName": "WatchGuard"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.watchguard.com/CVE-2026-86136"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21"
}
],
"value": "Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21"
}
],
"title": "Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A"
}
},
"cveMetadata": {
"assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"assignerShortName": "WatchGuard",
"cveId": "CVE-2026-86136",
"datePublished": "2026-09-29T23:05:47.485Z",
"dateReserved": "2026-09-05T03:22:58.693Z",
"dateUpdated": "2026-09-30T15:28:13.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86118 (GCVE-0-2026-86118)
Vulnerability from cvelistv5 – Published: 2026-09-05 09:59 – Updated: 2026-09-24 14:21
VLAI
EPSS
VEX
Title
gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint
Summary
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:06 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/sentriz/gonic/security/advisor… | vendor-advisory |
| https://github.com/sentriz/gonic/blob/v0.21.0/ser… | technical-description |
| https://github.com/sentriz/gonic/blob/v0.21.0/ser… | technical-description |
| https://github.com/sentriz/gonic/releases/tag/v0.22.0 | release-notes |
| https://github.com/sentriz/gonic | product |
| https://www.vulncheck.com/advisories/gonic-before… | third-party-advisory |
Date Public
2026-07-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86118",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:06:32.894121Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:06:48.927Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/sentriz/gonic/security/advisories/GHSA-453r-pgfw-h3pq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/go.senan.xyz/gonic",
"product": "gonic",
"repo": "https://github.com/sentriz/gonic",
"vendor": "sentriz",
"versions": [
{
"lessThan": "0.22.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:21:05.309Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-453r-pgfw-h3pq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/sentriz/gonic/security/advisories/GHSA-453r-pgfw-h3pq"
},
{
"name": "ServeStartScan without an admin check",
"tags": [
"technical-description"
],
"url": "https://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/handlers_common.go"
},
{
"name": "/startScan registered on the plain auth chain",
"tags": [
"technical-description"
],
"url": "https://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/ctrl.go"
},
{
"name": "gonic v0.22.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/sentriz/gonic/releases/tag/v0.22.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/sentriz/gonic"
},
{
"name": "VulnCheck Advisory: gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gonic-before-0.22.0-missing-administrator-check-on-the-subsonic-startscan-endpoint"
}
],
"title": "gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86118",
"datePublished": "2026-09-05T09:59:08.059Z",
"dateReserved": "2026-09-05T01:59:21.710Z",
"dateUpdated": "2026-09-24T14:21:05.309Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86116 (GCVE-0-2026-86116)
Vulnerability from cvelistv5 – Published: 2026-09-05 09:59 – Updated: 2026-09-24 14:21
VLAI
EPSS
VEX
Title
Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
Summary
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:26 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/metabase.md | technical-description |
| https://github.com/metabase/metabase/blob/v0.62.1… | technical-description |
| https://github.com/metabase/metabase/commit/0a058… | patch |
| https://github.com/metabase/metabase/releases/tag… | release-notes |
| https://github.com/metabase/metabase | product |
| https://www.vulncheck.com/advisories/metabase-bef… | third-party-advisory |
Impacted products
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86116",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:26:29.950481Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:26:40.648Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/metabase/metabase",
"product": "metabase",
"repo": "https://github.com/metabase/metabase",
"vendor": "metabase",
"versions": [
{
"lessThan": "0.63.1",
"status": "affected",
"version": "0.57.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.63.1",
"versionStartIncluding": "0.57.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:21:03.411Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher write-up",
"tags": [
"technical-description"
],
"url": "https://github.com/geo-chen/oss/blob/main/metabase.md"
},
{
"name": "Glossary POST/PUT/DELETE with no authorization check",
"tags": [
"technical-description"
],
"url": "https://github.com/metabase/metabase/blob/v0.62.1/src/metabase/glossary/api.clj"
},
{
"name": "Restrict glossary permissions (#76275)",
"tags": [
"patch"
],
"url": "https://github.com/metabase/metabase/commit/0a0589299cfd"
},
{
"name": "metabase v0.63.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.63.1"
},
{
"tags": [
"product"
],
"url": "https://github.com/metabase/metabase"
},
{
"name": "VulnCheck Advisory: Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/metabase-before-0.63.1-missing-function-level-authorization-on-the-glossary-management-api"
}
],
"title": "Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86116",
"datePublished": "2026-09-05T09:59:06.683Z",
"dateReserved": "2026-09-05T01:59:20.944Z",
"dateUpdated": "2026-09-24T14:21:03.411Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86114 (GCVE-0-2026-86114)
Vulnerability from cvelistv5 – Published: 2026-09-05 09:59 – Updated: 2026-09-24 14:21
VLAI
EPSS
VEX
Title
Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints
Summary
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:22 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/arcane.md | technical-description |
| https://github.com/getarcaneapp/arcane/blob/v1.19… | technical-description |
| https://github.com/getarcaneapp/arcane/commit/150… | patch |
| https://github.com/getarcaneapp/arcane/releases/t… | release-notes |
| https://github.com/getarcaneapp/arcane | product |
| https://www.vulncheck.com/advisories/arcane-befor… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| getarcaneapp | arcane |
Affected:
1.19.1 , < 2.0.0
(semver)
cpe:2.3:a:getarcane:arcane:*:*:*:*:*:*:*:* |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86114",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:22:01.593868Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:33:07.216Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/getarcaneapp/arcane",
"product": "arcane",
"repo": "https://github.com/getarcaneapp/arcane",
"vendor": "getarcaneapp",
"versions": [
{
"lessThan": "2.0.0",
"status": "affected",
"version": "1.19.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:getarcane:arcane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0",
"versionStartIncluding": "1.19.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:21:01.502Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher write-up",
"tags": [
"technical-description"
],
"url": "https://github.com/geo-chen/oss/blob/main/arcane.md"
},
{
"name": "Template mutations registered without RequireAdmin",
"tags": [
"technical-description"
],
"url": "https://github.com/getarcaneapp/arcane/blob/v1.19.5/backend/api/handlers/templates.go"
},
{
"name": "feat: full rbac permissions (#2724)",
"tags": [
"patch"
],
"url": "https://github.com/getarcaneapp/arcane/commit/1500646aa91f"
},
{
"name": "arcane v2.0.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/getarcaneapp/arcane/releases/tag/v2.0.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/getarcaneapp/arcane"
},
{
"name": "VulnCheck Advisory: Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/arcane-before-2.0.0-missing-administrator-authorization-on-the-compose-template-mutation-endpoints"
}
],
"title": "Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86114",
"datePublished": "2026-09-05T09:59:05.356Z",
"dateReserved": "2026-09-05T01:59:20.258Z",
"dateUpdated": "2026-09-24T14:21:01.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86091 (GCVE-0-2026-86091)
Vulnerability from cvelistv5 – Published: 2026-09-04 21:48 – Updated: 2026-09-08 17:57
VLAI
EPSS
VEX
Title
ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler
Summary
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:56 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/ntop/ntopng/security/advisorie… | vendor-advisory |
| https://github.com/ntop/ntopng/commit/7d830f31af3… | patch |
| https://github.com/ntop/ntopng | product |
| https://github.com/ntop/ntopng/blob/f41cc1beff90e… | technical-description |
| https://github.com/ntop/ntopng/blob/f41cc1beff90e… | technical-description |
| https://www.vulncheck.com/advisories/ntopng-befor… | third-party-advisory |
Impacted products
Date Public
2026-07-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86091",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:56:46.291504Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:57:14.089Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ntop/ntopng/security/advisories/GHSA-m22w-f647-vx88"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ntop/ntopng",
"product": "ntopng",
"vendor": "ntop",
"versions": [
{
"lessThan": "6.7.260717",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ntop:ntopng:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.260717",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T21:48:47.663Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-m22w-f647-vx88)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ntop/ntopng/security/advisories/GHSA-m22w-f647-vx88"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8"
},
{
"tags": [
"product"
],
"url": "https://github.com/ntop/ntopng"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/pools.lua"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/modules/pools/pools_rest_utils.lua"
},
{
"name": "VulnCheck Advisory: ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ntopng-before-6.7.260717-missing-authorization-on-the-host-pool-bulk-delete-handler"
}
],
"title": "ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86091",
"datePublished": "2026-09-04T21:48:47.663Z",
"dateReserved": "2026-09-04T20:47:22.899Z",
"dateUpdated": "2026-09-08T17:57:14.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86090 (GCVE-0-2026-86090)
Vulnerability from cvelistv5 – Published: 2026-09-04 21:48 – Updated: 2026-09-14 19:33
VLAI
EPSS
VEX
Title
ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers
Summary
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:21 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/ntop/ntopng/security/advisorie… | vendor-advisory |
| https://github.com/ntop/ntopng/commit/7d830f31af3… | patch |
| https://github.com/ntop/ntopng | product |
| https://github.com/ntop/ntopng/blob/f41cc1beff90e… | technical-description |
| https://github.com/ntop/ntopng/blob/f41cc1beff90e… | technical-description |
| https://www.vulncheck.com/advisories/ntopng-befor… | third-party-advisory |
Impacted products
Date Public
2026-07-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86090",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:21:37.129451Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:33:07.533Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ntop/ntopng",
"product": "ntopng",
"vendor": "ntop",
"versions": [
{
"lessThan": "6.7.260717",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ntop:ntopng:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.260717",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T21:48:46.991Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-m22w-f647-vx88)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ntop/ntopng/security/advisories/GHSA-m22w-f647-vx88"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8"
},
{
"tags": [
"product"
],
"url": "https://github.com/ntop/ntopng"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/endpoints.lua"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/recipients.lua"
},
{
"name": "VulnCheck Advisory: ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ntopng-before-6.7.260717-missing-authorization-on-the-notification-endpoint-and-recipient-delete-handlers"
}
],
"title": "ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86090",
"datePublished": "2026-09-04T21:48:46.991Z",
"dateReserved": "2026-09-04T20:47:17.962Z",
"dateUpdated": "2026-09-14T19:33:07.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86089 (GCVE-0-2026-86089)
Vulnerability from cvelistv5 – Published: 2026-09-16 19:35 – Updated: 2026-09-17 19:12
VLAI
EPSS
VEX
Title
Apache NiFi: Missing Process Group Authorization for Connector Migration
Summary
Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access to the Process Groups involved. The absence of Process Group authorization allowed an authenticated user with read access to a Connector to enumerate the identifiers, names, and flow registry details of version-controlled Process Groups outside the scope of granted read policies. It also allowed a user with write access to a Connector to migrate a Process Group without write access to that Process Group, copying the flow definition, referenced assets, and component state into the Connector, and leaving the source Process Group disabled and renamed. Migration excludes sensitive property values and requires the source Process Group to be stopped with empty queues, which limits the scope of exposure. Apache NiFi installations that do not implement component-level authorization policies for Process Groups are not subject to this vulnerability, because the framework enforces Connector write permissions as the security boundary. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which filters migration sources to Process Groups the requesting user is authorized to read, and requires write access to the source Process Group when submitting a migration request.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:12 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/lnpqnn61k62fkgxqd… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache NiFi |
Affected:
2.11.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-16T20:12:35.223Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/16/10"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86089",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:12:52.510723Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:12:58.905Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.nifi:nifi-web-api",
"packageURL": "pkg:maven/org.apache.nifi/nifi-web-api",
"product": "Apache NiFi",
"vendor": "Apache Software Foundation",
"versions": [
{
"status": "affected",
"version": "2.11.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ZsZsec"
},
{
"lang": "en",
"type": "finder",
"value": "Alpesh Bhagwatkar"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access to the Process Groups involved. The absence of Process Group authorization allowed an authenticated user with read access to a Connector to enumerate the identifiers, names, and flow registry details of version-controlled Process Groups outside the scope of granted read policies. It also allowed a user with write access to a Connector to migrate a Process Group without write access to that Process Group, copying the flow definition, referenced assets, and component state into the Connector, and leaving the source Process Group disabled and renamed. Migration excludes sensitive property values and requires the source Process Group to be stopped with empty queues, which limits the scope of exposure. Apache NiFi installations that do not implement component-level authorization policies for Process Groups are not subject to this vulnerability, because the framework enforces Connector write permissions as the security boundary. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which filters migration sources to Process Groups the requesting user is authorized to read, and requires write access to the source Process Group when submitting a migration request."
}
],
"value": "Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access to the Process Groups involved. The absence of Process Group authorization allowed an authenticated user with read access to a Connector to enumerate the identifiers, names, and flow registry details of version-controlled Process Groups outside the scope of granted read policies. It also allowed a user with write access to a Connector to migrate a Process Group without write access to that Process Group, copying the flow definition, referenced assets, and component state into the Connector, and leaving the source Process Group disabled and renamed. Migration excludes sensitive property values and requires the source Process Group to be stopped with empty queues, which limits the scope of exposure. Apache NiFi installations that do not implement component-level authorization policies for Process Groups are not subject to this vulnerability, because the framework enforces Connector write permissions as the security boundary. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which filters migration sources to Process Groups the requesting user is authorized to read, and requires write access to the source Process Group when submitting a migration request."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "CLEAR",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:L/U:Clear",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"text": "Low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:35:01.274Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/lnpqnn61k62fkgxqd9cftf7sr77jhrk1"
}
],
"source": {
"defect": [
"NIFI-16272"
],
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-05T12:00:00.000Z",
"value": "reported"
}
],
"title": "Apache NiFi: Missing Process Group Authorization for Connector Migration",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-86089",
"datePublished": "2026-09-16T19:35:01.274Z",
"dateReserved": "2026-09-04T20:36:08.094Z",
"dateUpdated": "2026-09-17T19:12:58.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.