Loading story…
WaveStore Server software was found to contain several high-severity vulnerabilities related to improper path validation in scripts accessible via the WaveView client. Attackers with high privileges could exploit these flaws to execute arbitrary operating system commands or read and delete files on the server. Specifically, CVE-2025-65074 allows OS command injection through path traversal in the showerr script, while CVE-2025-65076 enables arbitrary file read and deletion via the ilog script, which runs with root privileges. All vulnerabilities affect versions prior to 6.44.44, and have been addressed in that release.
CERT Polska coordinated the disclosure of these vulnerabilities, which stem from the WaveView client’s ability to execute a restricted set of predefined commands and scripts on the connected server. The vulnerabilities are classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), and pose significant risks if exploited, including full compromise of server confidentiality and integrity. Organizations using WaveStore Server are strongly advised to update to version 6.44.44 or later to mitigate these threats.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
CERT Polska publicly disclosed the three critical WaveStore Server vulnerabilities, including CVE-2025-65074 and CVE-2025-65076, and advised updating affected systems. The disclosure stated that all versions before 6.44.44 were vulnerable.
The vendor remediated the three vulnerabilities in WaveStore Server version 6.44.44. The update addressed command execution and file read/delete issues, including one flaw that could access or delete files with root privileges.
Three critical path traversal vulnerabilities in WaveStore Server, later assigned CVE-2025-65074, CVE-2025-65075, and CVE-2025-65076, were responsibly reported to CERT Polska. The flaws affected all versions prior to 6.44.44 and enabled command execution or file read/delete via the WaveView client.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecert.pl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Attackers are actively exploiting **Wing FTP Server** vulnerability `CVE-2025-47812`, a critical remote code execution flaw affecting versions prior to **7.4.4** on Windows, Linux, and macOS. The bug stems from improper null-byte handling in the `username` parameter of the `loginok.html` web interface, allowing unauthenticated or anonymous attackers to inject malicious **Lua** code into session files and trigger execution when the application processes that data, resulting in **root** access on Linux or **NT AUTHORITY\SYSTEM** on Windows. Incident reporting shows exploitation began shortly after public disclosure, with attackers probing exposed servers, running reconnaissance commands, creating local user accounts for persistence, attempting payload delivery with `certutil`, using `cURL` for possible data exfiltration, and trying to deploy **ScreenConnect** through malicious Lua files. In one observed case, Microsoft Defender blocked a downloaded payload as **`Trojan:Win32/Ceprolad.A`**, and the affected `WFTPServer.exe` process later crashed before the host was isolated. Defenders are being urged to upgrade immediately to **7.4.4** or later and review session `.lua` files, session directories, and domain logs for signs of compromise.
Jul 24, 2026
WatchGuard disclosed two high-severity vulnerabilities in **Fireware OS** affecting Firebox appliances, including a path traversal flaw in the **Web UI** tracked as `CVE-2026-3987` and an insecure deserialization issue in the **Access Portal** tracked as `CVE-2026-4266`. The Web UI bug can let a privileged, authenticated remote attacker perform an arbitrary file write and potentially execute code in the context of an elevated system process. The Access Portal flaw can lead to arbitrary code execution as the `portald` user through insecure deserialization. The issues affect multiple Fireware OS release lines, with `CVE-2026-3987` impacting versions `12.6.1` through `12.11.8` and `2025.1` through `2026.1.2`, while `CVE-2026-4266` affects versions `12.1` through `12.11.8` and `2025.1` through `2026.1.2`. WatchGuard said the deserialization bug is not a standalone remote exploit and requires prior write access to the local filesystem, making it more relevant for post-compromise chaining. The vulnerabilities are mapped to `CWE-22` and `CWE-502`, respectively, and WatchGuard published vendor guidance including advisory `WGSA-2026-00009`; Firebox models without Access Portal support, such as the **T-15** and **T-35**, are not affected by the Access Portal issue.
Jul 3, 2026