VulnHub

n8n, an automation platform, has addressed a serious security vulnerability that could allow authenticated users to execute operating system commands on the server. This flaw was discovered by Security Joes during their investigation of a previous fix related to CVE-2026-27577. The vulnerability affects versions 2.32.0 and earlier, specifically those prior to 2.32.1. The situation is critical as it could enable potential attackers to gain unauthorized access and control over the server, posing significant risks to any organization using n8n for their automation needs. Users are strongly urged to update to the patched versions to mitigate these risks.

Researchers have identified a significant vulnerability in Active Directory Certificate Services (AD CS), designated as CVE-2026-54121, also known as 'Certighost.' This flaw allows attackers to elevate privileges, potentially leading to a complete domain takeover. AD CS is a critical component of Microsoft Windows Server that organizations use to manage their Public Key Infrastructure (PKI). The release of a proof-of-concept exploit means that attackers may quickly learn how to exploit this vulnerability. Organizations using AD CS should be particularly vigilant as the risk of exploitation increases with the availability of this exploit.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that they are actively being exploited by attackers. The first vulnerability, CVE-2025-68686, affects Fortinet's FortiOS, allowing unauthorized access to sensitive information. The second, CVE-2026-16812, impacts Arista's VeloCloud Orchestrator, enabling command injection attacks on the on-premises operating system. These vulnerabilities pose serious risks, particularly to federal agencies, which are urged to prioritize their remediation under Binding Operational Directive 26-04. While the directive specifically targets federal civilian agencies, CISA recommends that all organizations adopt similar risk-based approaches to vulnerability management to protect against these threats.

Attackers are exploiting a serious vulnerability in Fastjson, a JSON library developed by Alibaba for Java applications, particularly those using Spring Boot. This flaw, identified as CVE-2026-16723, allows unauthorized code execution with the privileges of the Java process, posing significant risks to affected systems. The vulnerability has a high severity rating of 9.0, indicating it could lead to severe consequences if not addressed. Currently, there are no patches available to fix this issue, which increases the urgency for developers and organizations using Fastjson to take immediate protective measures. Security firms have reported that this vulnerability is being actively exploited, making it critical for users to assess their systems and implement necessary safeguards.

A recent security flaw in Bing's image processing system allowed crafted SVG files to execute commands with elevated privileges, specifically as NT AUTHORITY\SYSTEM on Windows servers and as root on Linux machines. This vulnerability was identified through testing by security researchers at XBOW, who found that the issue was not isolated to a single machine but was present across multiple hosts and network ranges within Bing’s infrastructure. Microsoft responded by issuing two critical CVEs, CVE-2026-32194 and another unnamed one, to address the vulnerabilities. This incident raises significant concerns about the security of cloud-based services and the potential for attackers to exploit similar flaws to gain unauthorized access to sensitive systems. Companies relying on these services should prioritize patching and review their security protocols to mitigate risks from this kind of vulnerability.

MZ Automation's lib60870 software, used in critical infrastructure sectors like chemical, energy, and water management, has a serious vulnerability that could lead to denial of service. Specifically, versions 2.4.0 and earlier are affected by an out-of-bounds read issue, which can crash the parsing process. This flaw has a CVSS score of 8.2, indicating high severity. Users are urged to update to version 2.4.1 or later to mitigate the risk. Organizations should also follow CISA's recommendations to secure their control systems, including limiting network exposure and using VPNs for remote access. Currently, there are no reports of this vulnerability being actively exploited in the wild.

Weintek's cMT3092X human-machine interface (HMI) has several security vulnerabilities that could allow unauthorized users to escalate their privileges or access sensitive user credentials. The affected firmware versions include those below 20210218 and EasyWeb versions prior to 2.1.20. Notably, vulnerabilities include reliance on unvalidated cookies, incorrect permission assignments, and the storage of passwords in plaintext. Weintek has issued a patch, cmt_typeB_20260316_007, which upgrades EasyWeb to version 2.3.17 to address these issues. Users are urged to apply this patch immediately to protect their systems.

A vulnerability has been identified in the Johnson Controls XAAP Android application, specifically in versions prior to 1.53. This flaw allows sensitive data to be stored in cleartext on devices, making it accessible to attackers who have physical access or can exploit another vulnerability on the device. The issue does not require network access and poses risks to users worldwide, particularly in critical manufacturing sectors. Johnson Controls advises users to upgrade to version 1.53 or later to mitigate this risk, and recommends implementing additional security measures such as restricting physical access, enabling device encryption, and using Mobile Device Management solutions to enforce security policies. Currently, there have been no reports of this vulnerability being actively exploited in the wild.

Johnson Controls has reported significant vulnerabilities in its C-CURE 9000 and Victor application server software that could allow attackers to execute arbitrary code remotely. Specifically, versions of the C-CURE 9000 and Victor applications up to v2.90_v3.0 and Victor Web versions up to v7.1 are impacted. An attacker on an adjacent network could exploit these flaws to compromise physical security controls and access sensitive information. The vulnerabilities have been assigned high to critical severity scores, highlighting the urgency for affected users to take action. Johnson Controls recommends upgrading to the latest versions and implementing various security measures to mitigate risks.

Recent vulnerabilities have been discovered in Panduit's IntraVUE software, affecting versions 3.2.1a14 and earlier. These security flaws could allow attackers to manipulate industrial control devices remotely without needing physical access or specialized tools. Notably, one vulnerability involves the storage of passwords in plaintext, which could expose sensitive credentials via the API. Users are urged to upgrade to version 3.2.1a16 or later to mitigate these risks. With potential impacts on critical infrastructure sectors including manufacturing, energy, and water systems, the urgency for organizations to update their software is high to prevent exploitation.

Attackers are exploiting a serious authentication bypass vulnerability, identified as CVE-2026-16232, in Check Point's Security Management and Multi-Domain Security Management servers. These servers are crucial as they manage policy updates for Check Point's firewall products. The flaw allows unauthenticated individuals to acquire a login token, which they can then use to access the system with full administrative rights. This could enable them to make unauthorized changes to security policies and configurations. Check Point has confirmed that this vulnerability is actively being exploited, posing significant risks to organizations using their security management products.

Check Point has issued urgent security updates to address a serious authentication bypass vulnerability in SmartConsole, identified as CVE-2026-16232, which has a CVSS score of 9.3. This flaw affects both Security Management and Multi-Domain Security Management (MDSM) systems and is currently being exploited in the wild. The vulnerability allows attackers to bypass authentication, potentially granting them unauthorized access to critical management functions. Given the severity of this flaw, it's crucial for organizations using these systems to apply the updates as soon as possible to mitigate the risk of exploitation. Users should ensure they are running the latest versions to maintain the security of their environments.

Check Point has issued security updates to fix several vulnerabilities affecting its Security Management and Multi-Domain Management (MDSM) products. Among these is a serious flaw, identified as CVE-2026-16232, which has a CVSS score of 9.3 and allows attackers to bypass authentication in the SmartConsole login process. This vulnerability is particularly concerning as it is currently being exploited in the wild, meaning malicious actors can gain full administrative access to affected systems. Companies using Check Point's management products need to apply these updates promptly to protect their environments from unauthorized access. The timely response to this patch is crucial for maintaining security integrity.