Loading story…
Government cyber agencies in Belgium and Canada warned of a critical unauthenticated OS command injection vulnerability in IceWarp (tracked as CVE-2025-14500, CVSS 9.8) that can allow a remote attacker to execute arbitrary commands on affected servers. The flaw is described as CWE-78 and is tied to improper validation of user-controlled input in the X-File-Operation HTTP header, enabling code execution with high privileges (e.g., SYSTEM on Windows or root on Linux), with severe impact to confidentiality, integrity, and availability.
Both advisories urge immediate patching across impacted IceWarp product lines and versions, including IceWarp Epos Update 2, Epos Update 1, Epos (1st generation), and Deep Castle and older versions. Recommended fixed versions include upgrading to 14.2.0.12+ (Epos Update 2), 14.1.0.20+ (Epos Update 1), 14.0.0.18+ (Epos 1st gen), and 13.0.3.13+ (Deep Castle/older), alongside heightened monitoring and detection while remediation is underway.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-20, Belgium's Centre for Cybersecurity issued a warning urging organizations to patch a critical OS command injection vulnerability in IceWarp immediately. The alert amplified the need to apply IceWarp's available fixes.
On 2026-02-19, IceWarp published security advisories covering vulnerabilities across multiple IceWarp products, including at least one critical flaw. The advisories said several IceWarp Epos release lines and the Deep Castle and older line were affected up to specified version thresholds, and provided security update information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A long-lived **Redis** memory-corruption flaw dubbed **RediShell** (`CVE-2025-49844`) was reported as a *use-after-free* bug that can lead to **remote code execution** under certain conditions. Although exploitation requires authentication, research noted that tens of thousands of Redis instances have historically been exposed to the internet without authentication enabled, increasing real-world risk; the issue was discovered by **Wiz** and demonstrated at *Pwn2Own Berlin* prior to public disclosure. Separately, **IceWarp** disclosed a critical **unauthenticated RCE** (`CVE-2025-14500`) caused by **OS command injection** in handling of the `X-File-Operation` HTTP header, impacting both Windows and Linux deployments and enabling arbitrary command execution as **SYSTEM/root**. The flaw was reported in September 2025 and fixed in October 2025 across supported product lines, but **Shadowserver** reported more than **1,200** internet-facing on-prem instances still unpatched and said it is notifying affected owners to upgrade.
Jun 29, 2026
Two high-severity vulnerabilities, **CVE-2026-34794** and **CVE-2026-34791**, were disclosed in **Endian Firewall 3.3.25 and earlier**, exposing authenticated users to arbitrary operating system command execution through the `DATE` parameter in the `/cgi-bin/logs_ids.cgi` and `/cgi-bin/logs_proxy.cgi` endpoints. Both flaws were classified as **CWE-78** command injection issues and stem from incomplete regular-expression validation that lets attacker-controlled input influence a file path passed to a Perl `open()` call. The vulnerabilities carry the same **CVSS v3.1** score vector, `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, indicating network-reachable exploitation with low attack complexity and low privileges, with high impact on confidentiality, integrity, and availability. The disclosures were submitted through **VulnCheck** and reference vendor support resources from **Endian**, highlighting that organizations running affected firewall versions should review exposure of these CGI components and prioritize remediation.
Jun 29, 2026
Dell disclosed **CVE-2026-67261**, a critical OS command injection flaw in **Dell Virtual Storage Integrator (VSI) for VMware vSphere Client** that affects versions prior to **10.11.1.0**. The vulnerability is located in the **IAPI** component and can be exploited **remotely without authentication**, allowing an attacker to execute arbitrary operating system commands with **root privileges**. The issue is tracked as **CWE-78** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating a high likelihood of full compromise. Dell warned that successful exploitation could lead to complete takeover of the VSI deployment and potentially expose underlying infrastructure managed through the platform. A related advisory from **CERT-PY** highlighted the vulnerability in Dell products, reinforcing the need for defensive action. Dell has recommended that customers **upgrade to version 10.11.1.0 or later as soon as possible** to remediate the risk.
Aug 16, 2026