Loading story…
A critical vulnerability has been identified in the password recovery mechanism of the MAXHUB Pivot client application, tracked as CVE-2025-53704. The flaw allows remote attackers to exploit the weak password reset process, potentially enabling unauthorized account takeover. The vulnerability affects all versions of the Pivot client application prior to v1.36.2, and has been assigned a CVSS v4 base score of 8.7, indicating high severity and low attack complexity.
MAXHUB has released an update to address the issue, recommending users upgrade to version 1.36.2 or newer to mitigate the risk. CISA has also advised organizations to minimize network exposure of control system devices, place them behind firewalls, and isolate them from business networks to reduce the likelihood of exploitation. The vulnerability was reported by Malik MAKKES of Abicom Groupe OCI, and impacts organizations worldwide, particularly those in the information technology sector.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The MAXHUB Pivot weak password recovery vulnerability was publicly listed as CVE-2025-53704 in vulnerability databases and feeds. Public references linked the issue to CISA's advisory and MAXHUB remediation guidance.
CISA issued ICS advisory ICSA-25-338-02 describing CVE-2025-53704, a high-severity account takeover vulnerability in MAXHUB Pivot with CVSS v4 8.7 and CVSS v3.1 7.5. CISA said the product is deployed worldwide in the IT sector and noted there was no known public exploitation at the time of publication.
MAXHUB recommended upgrading to Pivot client version 1.36.2 or newer to fix CVE-2025-53704, a weak password recovery issue affecting all prior versions. The vulnerability is tracked as CWE-640 and is remotely exploitable.
Malik MAKKES of Abicom Groupe OCI reported a weak password recovery vulnerability in the MAXHUB Pivot client application to MAXHUB. The flaw could allow a remote attacker to reset passwords and take over accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Pimcore disclosed and fixed **CVE-2026-55207**, an account takeover flaw in the password reset workflow that can let an unauthenticated attacker hijack any administrator account and bypass **2FA**. The issue stems from insufficient validation of a user-supplied `resetPasswordUrl`: if an attacker knows a valid admin username, they can trigger a password reset that sends a legitimate recovery token to attacker-controlled infrastructure. If the targeted user clicks the emailed link, the attacker can capture the token and authenticate through the ` /pimcore-studio/api/login/token ` endpoint with full administrative privileges. The vulnerability affects Pimcore versions before **2025.4.6** and versions **2026.1.0** through before **2026.1.6**. Pimcore addressed the issue in **2025.4.6** and **2026.1.6**; the latter release notes explicitly mention **reset password URL validation** among the security-relevant changes. The flaw is tracked as **CVE-2026-55207**, mapped to **CWE-640**, and carries a high-severity **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`.
Jul 10, 2026
A critical vulnerability, tracked as CVE-2025-36386 with a CVSS score of 9.8, has been identified in the IBM Maximo Manage application within the IBM Maximo Application Suite for Cognos Analytics. This flaw allows remote attackers to bypass authentication mechanisms and gain unauthorized access to the application, posing a significant risk to organizations using affected versions. The vulnerability impacts IBM Maximo Application Suite versions 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4, enabling unauthenticated access to sensitive analytics functions. Security advisories highlight the severity of the issue, emphasizing the potential for exploitation without user interaction. IBM has acknowledged the vulnerability and is expected to release patches or mitigation guidance to address the risk. Organizations using the affected versions are urged to review their deployments and apply security updates as soon as they become available to prevent unauthorized access and potential data compromise.
Jun 29, 2026
Zoho has patched **CVE-2026-11840**, a high-severity authenticated SQL injection vulnerability in **ManageEngine Password Manager Pro** and **ManageEngine PAM360**. The flaw is described as remotely exploitable and carries a **CVSS v3.1 score of 8.8**, with potential impact on confidentiality, integrity, and availability in affected privileged access management deployments. The issue affects **Password Manager Pro** versions earlier than **build 13232** and **PAM360** versions earlier than **build 8552**. National cybersecurity bodies, including **ACN Italy** and **CERT-PY**, have highlighted the vendor remediation, and organizations running these products have been advised to upgrade to **Password Manager Pro 13232+** and **PAM360 8552+** in line with Zoho's security guidance.
Aug 13, 2026