{"vulnerability": "cve-2026-9089", "sightings": [{"uuid": "19e3300e-a3ea-41e0-ab68-2499a85538af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9089", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mmevhbebbr2e", "content": "\ud83d\udfe0 CVE-2026-9089 - High (8.8)\n\nThe ConnectWise Automate\u2122 Agent does not fully verify the authenticity of components obtained d...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-9089/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-21T17:00:47.245112Z"}, {"uuid": "4419562b-5db6-4795-ac60-0b6e5113a632", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9089", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3movnvslmds2u", "content": "\u30ea\u30e2\u30fc\u30c8\u7ba1\u7406\u30c4\u30fc\u30eb\u300cConnectWise Automate\u300d\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u66f4\u65b0\n\nConnectWise\u306e\u30ea\u30e2\u30fc\u30c8\u7ba1\u7406\u30c4\u30fc\u30eb\u300cConnectWise Automate\u300d\u306b\u8106\u5f31\u6027\u304c\u5224\u660e\u3057\u305f\u3002\u540c\u793e\u306f\u8106\u5f31\u6027\u3092\u4fee\u6b63\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u63d0\u4f9b\u3057\u3066\u3044\u308b\u3002\n\n\u540c\u793e\u306f\u73fe\u5730\u6642\u95932026\u5e745\u670821\u65e5\u3001\u30aa\u30f3\u30d7\u30ec\u30df\u30b9\u74b0\u5883\u5411\u3051\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3068\u306a\u308b\u300cConnectWise Automate 2026.5\u300d\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u3082\u306e\u3002\n\n\u540c\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3067\u306f\u3001\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u3067\u30d7\u30e9\u30b0\u30a4\u30f3\u3084\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306a\u3069\u3001\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u306e\u8aad\u307f\u8fbc\u307f\u51e6\u7406\u3067\u5341\u5206\u306b\u691c\u8a3c\u3092\u884c\u3063\u3066\u3044\u306a\u3044\u8106\u5f31\u6027\u300cCVE-2026-9089\u300d\u306b\u5bfe\u51e6\u3057\u305f\u3002", "creation_timestamp": "2026-06-22T19:51:23.476343Z"}, {"uuid": "e31ccf50-cc29-4f9c-980b-c7a2dd9c0063", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9089", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpowsfqfvo2t", "content": "\ud83d\udccc CVE-2026-9089 - The ConnectWise Automate\u2122 Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This i... https://www.cyberhub.blog/cves/CVE-2026-9089", "creation_timestamp": "2026-07-02T21:07:06.675396Z"}, {"uuid": "097bd4aa-fa59-4188-92ab-bc6469b7d260", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90895", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/gnucz5ojyf4fj", "content": "CVE-2026-90895 - MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection\nCVE ID : CVE-2026-90895\n \n Published : Sept. 14, 2026, 9:40 a.m. | 12\u00a0minutes ago\n \n Description : Affected versions of MISP\u2019s interactive CLI shell implement access ...", "creation_timestamp": "2026-09-14T10:35:16.429080Z"}, {"uuid": "94432a7c-3409-441e-9a8e-7b499143b850", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90898", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvhxwzsz522f", "content": "CVE-2026-90898 - bifrost\nAnyone can send a simple request to Bifrost and cause it to start any command on the gateway machine. In versions that still use the older API endpoint, this can be done without any\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#bifrost #maximhq #CVE #infosec", "creation_timestamp": "2026-09-14T11:10:06.993471Z"}, {"uuid": "a6137e38-4602-4e3c-9ee4-a1ca58cf73e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90898", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvi35ifopn2j", "content": "\ud83d\udea8 CVE-2026-90898 \u2014 CVSS 9.8 CRITICAL\n\nBifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost st...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-90898\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-14T12:07:24.961449Z"}, {"uuid": "8dac3572-c0d3-4c38-8366-563989a40641", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90898", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6iqsxiympabzh", "content": "CVE-2026-90898 - Bifrost unauthenticated remote code execution via MCP stdio client registration\nCVE ID : CVE-2026-90898\n \n Published : Sept. 14, 2026, 11:17 a.m. | 36\u00a0minutes ago\n \n Description : Bifrost registers MCP clients through its management API. A stdio client is a co...", "creation_timestamp": "2026-09-14T12:27:21.520235Z"}, {"uuid": "2c7b23f2-4c57-46d7-8410-0202e4a5d824", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90896", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7ggnkxv2ynfgz", "content": "CVE-2026-90896 - Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII\nCVE ID : CVE-2026-90896\n \n Published : Sept. 14, 2026, 9:17 p.m. | 25\u00a0minutes ago\n \n Description : Missing Authentication for Critical Functio...", "creation_timestamp": "2026-09-14T22:05:54.661355Z"}, {"uuid": "16857d83-2610-496a-802b-83e8c3c818d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90894", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mvmtcore2t2y", "content": "Parallels Desktop kwetsbaarheid laat root-toegang toe op Macs met Apple Silicon\n\nEen ernstige beveiligingskwetsbaarheid, gedoopt tot CVE-2026-90894 of ParaShells, is ontdekt in Parallels Desktop voor Mac, specifiek in versie 26.4.0 build 57513 op Macs met Apple Silicon. Deze kwetsbaarheid s...", "creation_timestamp": "2026-09-16T09:30:28.670044Z"}, {"uuid": "eeb61461-3762-45d3-8027-45c5e1126c3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90894", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mvn6k75hbj2u", "content": "Parallels Desktop\u306e\u8106\u5f31\u6027\u3001Mac\u306e\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304c\u8ab0\u3067\u3082root\u6a29\u9650\u3092\u53d6\u5f97\u53ef\u80fd\u306b\uff08CVE-2026-90894\uff09\n\n\u65b0\u305f\u306b\u516c\u8868\u3055\u308c\u305f\u8106\u5f31\u6027\u306f\u3001CVE-2026-90894\u3068\u3057\u3066\u8ffd\u8de1\u756a\u53f7\u304c\u5272\u308a\u5f53\u3066\u3089\u308c\u300cParaShells\u300d\u3068\u540d\u4ed8\u3051\u3089\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3059\u308b\u3068\u3001Mac\u4e0a\u306e\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u3067\u3042\u308c\u3070\u8ab0\u3067\u3082\u30db\u30b9\u30c8\u30b7\u30b9\u30c6\u30e0\u306eroot\u6a29\u9650\u3092\u53d6\u5f97\u3067\u304d\u3066\u3057\u307e\u3044\u307e\u3059\u3002 ParaShells\u306ePoC\u304c\u5b9f\u884c\u3055\u308c\u308b\u69d8\u5b50\uff08\u63d0\u4f9b:", "creation_timestamp": "2026-09-16T12:51:32.558559Z"}, {"uuid": "2d570a7b-b96b-4cca-b3f7-05d635a78169", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90894", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mvn64l5tms2h", "content": "Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)\n\n\ud83d\udd17 Read more: www.helpnetsecurity.com/2026/09/16/p...\n\n#exploit #macOS #cybersecurity", "creation_timestamp": "2026-09-16T12:43:57.653469Z"}, {"uuid": "484bba65-52fe-4158-a201-109435fc2a94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90894", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mvnbmi7hps2m", "content": "Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)\n\nwww.helpnetsecurity.com/2026/09/16/p...\n\n#Kyberturvallisuus #ThreatIntel #Haavoittuvuus", "creation_timestamp": "2026-09-16T13:46:35.175901Z"}, {"uuid": "71311f41-665c-47da-aebd-7b29c9f41952", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90894", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/10072", "content": "\ud83d\uded1 A Parallels Desktop flaw lets non-admin Mac users gain root, but Intel Macs can\u2019t install the version containing the fix.\n\nTracked as CVE-2026-90894, JFrog demonstrated the flaw on Parallels Desktop 26.4.0 and reports no attacks.\n\nHow the root escalation works \u2192 https://thehackernews.com/2026/09/parallels-desktop-flaw-lets-non-admin.html", "creation_timestamp": "2026-09-16T16:00:03.893321Z"}, {"uuid": "08c8787e-84d3-4c2f-bdc8-43b31160d32f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90894", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mvnjch2wgw23", "content": "New 'ParaShells' flaw (CVE-2026-90894) in Parallels Desktop for Mac allows any local user to gain root access on the host macOS. Patched in v27.0.0 - update now! #macOS #Parallels #LPE #CyberSecurity\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-16T16:04:03.678467Z"}, {"uuid": "834e244b-1140-4dcb-8375-a7c06924960a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90894", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvnoxooz6c2n", "content": "JFrog disclosed CVE-2026-90894, a Parallels Desktop flaw on Apple ARM Macs that lets any local user escalate to root via argument injection in appliance extraction. Fixed in v27.0.0. #ParaShells #ParallelsDesktop #Alludo", "creation_timestamp": "2026-09-16T17:45:24.571369Z"}, {"uuid": "cae6fcd1-e212-4339-a022-ab3b61a071f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90894", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mvpnam4eec2d", "content": "Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)\n\nA newly disclosed vulnerability in Parallels Desktop, tracked as CVE-2026-90894 and dubbed \u201cParaShells,\u201d can allow any local user on a Mac to gain root privileges on the host system. ParaShells PoC in acti\u2026\n#hackernews #news", "creation_timestamp": "2026-09-17T12:19:55.752406Z"}, {"uuid": "3ef378d2-d532-4560-93a5-09c51898f072", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90898", "type": "seen", "source": "https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html", "content": "A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request.\n\nThe flaw, tracked as CVE-2026-90898 (CVSS score: 9.8), affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication is", "creation_timestamp": "2026-09-22T19:00:37.243054Z"}, {"uuid": "1708307f-826e-4d41-8ea5-f7ef401dda07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90898", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mw4w6spaqh2d", "content": "A critical unauthenticated remote code execution vulnerability (CVE-2026-90898, CVSS 9.8) affects all versions of the open-source AI gateway Bifrost before [\u2026]", "creation_timestamp": "2026-09-22T19:04:36.020997Z"}, {"uuid": "a1152856-5f8e-400b-ace6-26ed2437c927", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90898", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mw54ttfllm2p", "content": "\ud83e\udd16 CVE-2026-90898 (CVSS 9.8): unauthenticated RCE in Bifrost, open-source AI gateway for 20+ LLM providers. One HTTP request = arbitrary command execution. Affects HTTP transport < 2.1.0.\n\nhttps://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets/", "creation_timestamp": "2026-09-22T21:03:42.986624Z"}, {"uuid": "23c586ca-e59a-45ca-adc7-c4df2676bddf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90898", "type": "seen", "source": "https://bsky.app/profile/ins-aisolutions.bsky.social/post/3mw6l5gq43z24", "content": "A single unauthenticated HTTP request was enough to fully compromise an AI gateway this week.\n\nCVE-2026-90898, disclosed September 23, hit Bifrost's HTTP transport (versions before 2.1.0) with a CVSS 9.8 -- arbitrary command execution, no authentication required, as long as the management API was...", "creation_timestamp": "2026-09-23T10:52:18.377860Z"}, {"uuid": "140c03d6-be21-4231-b406-58265d22a3fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90894", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117320792499212313", "content": "CVE-2026-90894 Parallels Desktop: local root RCE via unsanitized sVmParentPath, tar injection in prl_disp_service. CVSS 7.8. Unpatched. Patch or restrict socket access now. https://www.valtersit.com/cve/CVE-2026-90894/ #CVE #infosec #Parallels", "creation_timestamp": "2026-09-23T14:20:27.773653Z"}, {"uuid": "989f243e-36fa-4998-bf3d-e3bfde75491b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90894", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mw6xczkneg25", "content": "CVE-2026-90894 Parallels Desktop: local root RCE via unsanitized sVmParentPath, tar injection in prl_disp_service. CVSS 7.8. Unpatched. Patch or restrict socket access now. https://www.valtersit.com/cve/CVE-2026-90894/ #CVE #infosec #Parallels", "creation_timestamp": "2026-09-23T14:30:09.982985Z"}, {"uuid": "19a928be-ef14-45b5-823e-dc4103cdccca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90898", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/10130", "content": "\ud83d\udea8 A single unauthenticated POST can make Bifrost run attacker-supplied commands with management auth disabled, the default setting.\n\nCVE-2026-90898 affects versions before 2.1.0, and command execution can expose stored LLM provider API keys.\n\nRead: https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html", "creation_timestamp": "2026-09-22T17:45:01.000000Z"}, {"uuid": "2d720ee8-a19d-4c48-b317-f836085cfa74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90898", "type": "seen", "source": "Telegram/6k-At-azVffZmu9NaaKszWckni_HqjNCfOaauq7mZCKYU4U", "content": "", "creation_timestamp": "2026-09-23T09:00:04.000000Z"}, {"uuid": "270e83a5-20d4-4fdb-bbf2-f734bc88942a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90898", "type": "published-proof-of-concept", "source": "Telegram/6k-At-azVffZmu9NaaKszWckni_HqjNCfOaauq7mZCKYU4U", "content": "", "creation_timestamp": "2026-09-23T09:00:04.000000Z"}, {"uuid": "68b63a37-5357-48f6-ae37-5007bbc6a189", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90898", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mwncu5thxz2i", "content": "Critical flaw in Bifrost (CVE-2026-90898) allows unauthenticated attackers to execute commands via a single HTTP request. Affects all versions before 2.1.0. CVSS 9.8. #Cybersecurity", "creation_timestamp": "2026-09-29T07:33:53.019155Z"}]}