// INTELLIGENCE FEED

RECON BLOG

July 22, 2026 · 7 minCVSS 9.8CRITICAL

CVE-2026-50522: SharePoint Deserialization RCE Now Actively Exploited (CISA KEV) — Detect Exposure and Evict Persistence

The unauthenticated SharePoint deserialization RCE demonstrated at Pwn2Own Berlin 2026 is now exploited in the wild and CISA KEV-listed with a July 25 deadline. CVSS 9.8 Critical (CWE-502), on-premises SharePoint Server only. The operational twist: attackers steal ASP.NET machine keys during exploitation, so patching closes the door but doesn't evict an intruder who already has the keys — patch, rotate keys, then hunt.

READ ANALYSIS →

July 22, 2026 · 6 minCVSS 8.4ANALYSIS

CVE-2026-64824: Home Assistant Backup-Restore Symlink Traversal — Find and Patch Affected Instances

Home Assistant Core's backup-restore function mishandles symlinks in tar archives: a crafted backup writes files to an arbitrary path, and on the root-running official Docker image that becomes RCE via a Python startup hook. Not the classic filename form of Zip Slip — a stateful symlink pivot that name-only validation can't catch. CVSS 9.3 (4.0) / 8.4 (3.1), CWE-22. Requires an administrator-authorized restore. Fixed in Home Assistant Core 2026.7.0.

READ ANALYSIS →

July 21, 2026 · 7 minCVSS 9.8ANALYSIS

Langflow RCE Chain (CVE-2026-9198): auto_login Auth Bypass Turns validate/code Into Unauthenticated Code Execution

IBM assigned CVE-2026-9198 (CVSS 9.8) to a specific Langflow chain: an unauthenticated caller mints a superuser token via /api/v1/auto_login (CVE-2026-9103), then runs Python via exec() at /api/v1/validate/code (CVE-2026-8481) — full RCE on default deployments. A second unauthenticated webhook bypass (CVE-2026-8505) widens the front door, and four more authenticated RCEs each carry their own prerequisites that the same bypass can help satisfy. The shape mirrors the CISA KEV-listed CVE-2026-33017. Fixed in Langflow 1.10.2.

READ ANALYSIS →

July 16, 2026 · 5 minCVSS 9.8

CVE-2026-25089: Fortinet FortiSandbox Unauthenticated OS Command Injection (CISA KEV)

Fortinet FortiSandbox contains a critical OS command injection in the web UI that lets unauthenticated attackers execute arbitrary commands. CVSS 9.8, actively exploited since mid-June, CISA KEV listed. Third FortiSandbox CVE exploited in 2026.

READ ADVISORY →

July 15, 2026 · 5 minCVSS 10.0

CVE-2026-15409: SonicWall SMA1000 SSRF Zero-Day (CVSS 10.0) — Find Exposed Appliances

SonicWall SMA1000 appliances contain a critical SSRF vulnerability in the WorkPlace portal. CVSS 10.0, actively exploited zero-day, CISA KEV listed with 3-day deadline. A second flaw enables post-auth OS command injection.

READ ADVISORY →

July 15, 2026 · 5 minCVSS 9.8

CVE-2026-58644: SharePoint Server Unauthenticated Deserialization RCE (July 2026 Patch Tuesday)

Microsoft SharePoint Server contains a deserialization vulnerability enabling unauthenticated remote code execution. CVSS 9.8 Critical, now CISA KEV-listed (actively exploited) — one of several July 2026 Patch Tuesday SharePoint flaws on the KEV catalog, alongside the sibling deserialization RCE CVE-2026-50522.

READ ADVISORY →

July 15, 2026 · 5 minCVSS 9.8

CVE-2026-56164: Microsoft SharePoint Server Authentication Bypass — Find Vulnerable Instances

Microsoft SharePoint Server contains a missing authentication vulnerability allowing unauthenticated privilege escalation. Actively exploited, CISA KEV listed with a 3-day deadline. NVD scores this 9.8 Critical while Microsoft rates it Moderate. Final security update for SharePoint 2016 and 2019.

READ ADVISORY →

July 2, 2026 · 5 minCVSS 8.8

CVE-2026-45659: SharePoint Server Authenticated Deserialization RCE (CISA KEV)

Microsoft SharePoint Server contains a deserialization vulnerability that lets authenticated attackers execute arbitrary code. CVSS 8.8, actively exploited, CISA KEV listed with a 3-day deadline. Patches available for SharePoint 2016, 2019, and Subscription Edition.

READ ADVISORY →

June 15, 2026 · 5 minCVSS 6.5

CVE-2026-20262: Cisco Catalyst SD-WAN Manager Path Traversal (Arbitrary File Write)

Cisco Catalyst SD-WAN Manager's web UI allows authenticated attackers to traverse paths and write arbitrary files, enabling privilege escalation to root. CVSS 6.5, CISA KEV listed, limited exploitation confirmed. All deployment types affected — no workarounds.

READ ADVISORY →

June 11, 2026 · 5 minCVSS 10.0

CVE-2026-10520: Ivanti Sentry Unauthenticated OS Command Injection (RCE)

Ivanti Sentry's MICS configuration API allows unauthenticated OS command injection with root-level execution. CVSS 10.0, actively exploited, CISA KEV listed with a 3-day deadline. Public PoC available.

READ ADVISORY →

June 10, 2026 · 5 minCVSS 9.8

CVE-2026-20253: Splunk Enterprise Unauthenticated File Access via PostgreSQL Sidecar

Splunk Enterprise's PostgreSQL sidecar service lacks authentication — any network-reachable attacker can create or truncate arbitrary files. CVSS 9.8 Critical, part of a 12-advisory batch including RCE via deserialization.

READ ADVISORY →

June 9, 2026 · 5 minCVSS 5.8CRITICAL

CVE-2026-7473: Arista EOS Tunnel Decapsulation Bypass — Find Affected Switches

Arista EOS switches incorrectly accept unexpected tunnel protocols, bypassing network segmentation. Actively exploited, CISA KEV listed, no patch planned — ACL mitigation only.

READ ANALYSIS →

June 3, 2026 · 5 minCVSS 9.8

CVE-2026-44825: Apache Solr Hardcoded Credentials — Detect Exposed Instances

Apache Solr's auth setup tool silently installs four accounts with passwords identical to their usernames. CVSS 9.8 Critical, no patch released yet. Affects 12,000+ organizations.

READ ADVISORY →

May 30, 2026 · 5 minCVSS 9.1

CVE-2026-0257: Palo Alto PAN-OS GlobalProtect Authentication Bypass — Find Exposed Firewalls

An actively exploited authentication bypass in PAN-OS GlobalProtect lets unauthenticated attackers establish VPN connections. CISA KEV listed with a 3-day remediation deadline.

READ ADVISORY →

May 29, 2026 · 5 minCRITICAL

CVE-2026-9874: Critical Chrome Dawn WebGPU Use-After-Free — How to Detect Vulnerable Browsers

A critical use-after-free in Chrome's Dawn WebGPU implementation could allow remote code execution. Part of a 151-vulnerability Chrome 148 update with 22 critical flaws across Dawn, WebGL, and ANGLE.

READ ANALYSIS →

May 29, 2026 · 5 minANALYSIS

Six Windows Zero-Days, Two Platform Bans: A Defender Triage Guide

A researcher dropped six Windows zero-days since early April and got banned from GitHub and GitLab. Three exploits remain unpatched. A practical triage checklist for defenders.

READ ANALYSIS →

May 27, 2026 · 6 minCVSS 6.5

CVE-2026-48710: Finding Vulnerable Starlette and FastAPI Services on Your Network

A Host header injection in Starlette bypasses path-based auth middleware. Affects FastAPI, vLLM, LiteLLM, MCP servers, and thousands of AI infrastructure services.

READ ADVISORY →

May 27, 2026 · 5 minCVSS 10.0

CVE-2026-20223: Finding Cisco Secure Workload (Tetration) on Your Network

A maximum-severity authentication bypass in Cisco Secure Workload (CVSS 10.0) lets unauthenticated attackers gain Site Admin access via an internal REST API. Identify instances on your network using RECON.

READ ADVISORY →

May 26, 2026 · 4 minCVSS 9.1

CVE-2026-35616: How to Find FortiClient EMS Instances on Your Network

A critical zero-day in Fortinet's endpoint management server has been actively exploited since late March. Walk through identifying FortiClient EMS instances using RECON.

READ ADVISORY →