Loading story…
Misskey disclosed CVE-2026-28431, a vulnerability affecting all servers running versions 8.45.0 and later, but prior to 2026.3.1, where insufficient authorization checks combined with inadequate input validation can allow an attacker to access data they should not be able to access. The issue occurs regardless of whether federation is enabled, and the vendor warns it could result in a significant data breach; the highest-scored advisory associated with the CVE is rated CVSS v4 9.2.
There is no known workaround; administrators are advised to upgrade to Misskey 2026.3.1 to remediate. Misskey also noted it is intentionally limiting technical details to reduce risk to unpatched servers, and indicated the CVE aggregates multiple related advisories (including GHSA-r33c-qg3g-v9cr as the highest-severity item, plus additional lower-severity authorization/permission-check advisories) that are all fixed in 2026.3.1.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE entry for CVE-2026-28431 was updated with CVSS v4 vector information, CWE classification, and a reference to the GitHub Security Advisory. The record reiterated that the issue affects Misskey versions before 2026.3.1 and is fixed in that release.
A GitHub Security Advisory disclosed that Misskey versions 8.45.0 through before 2026.3.1 were vulnerable to unauthorized data access, with technical details withheld to reduce risk to unpatched servers. The umbrella CVE was identified as CVE-2026-28431, with the highest listed severity scored at CVSS v4 9.2.
Misskey addressed the authorization and input validation issues covered under CVE-2026-28431 in release 2026.3.1. The advisory states there is no workaround and urges administrators to update immediately.
A vulnerability involving insufficient authorization checks and improper input validation affected Misskey servers starting with version 8.45.0. The flaw could allow unauthorized access to data regardless of whether federation was enabled.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple **critical, unauthenticated remote code execution and authentication-bypass vulnerabilities** in widely deployed enterprise products were reported as **actively exploited** and, in several cases, added to CISA’s **Known Exploited Vulnerabilities (KEV)** catalog. SmarterTools *SmarterMail* is being targeted in **ransomware** activity via **CVE-2026-24423**, an unauthenticated RCE caused by missing authentication on the `ConnectToHub` API (`/api/v1/settings/sysadmin/connect-to-hub`), where an attacker-controlled server can return JSON containing a `CommandMount` value that drives arbitrary command execution; the issue affects versions prior to `v100.0.9511`. Separately, SolarWinds *Web Help Desk* is affected by **CVE-2025-40551** (CVSS 9.8), a **deserialization of untrusted data** flaw in the `AjaxProxy` component enabling remote, unauthenticated command execution; CISA added it to KEV amid in-the-wild exploitation and set an accelerated patch deadline for US federal agencies. In parallel, Fortinet environments using **FortiCloud SSO** face authentication-bypass risk from **CVE-2025-59718**, **CVE-2025-59719**, and **CVE-2026-24858**, which can allow an attacker with a FortiCloud account to log into organizations’ **FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb** if SSO is enabled; Kaspersky published **SIEM correlation rules** to detect related suspicious logins and admin actions. Samsung *MagicInfo 9 Server* (digital signage management) was also reported with a trio of severe flaws affecting versions prior to `21.1090.1`, including **CVE-2026-25202** (hardcoded credentials, CVSS 9.8) and **CVE-2026-25201** (unauthenticated arbitrary file upload leading to RCE, CVSS 8.8), creating risk of server takeover and potential network compromise; the article does not indicate KEV inclusion or confirmed exploitation for these MagicInfo issues.
Jun 29, 2026
Check Point released fixes for **CVE-2026-18574**, a critical authentication-bypass flaw in **Security Management Server** and **Multi-Domain Security Management Server (MDS)** that can let an unauthenticated remote attacker with network access to management services execute arbitrary commands. The vulnerability carries a **CVSS 4.0 score of 9.3** and is classified as **`CWE-288`**, with impact that can extend to full compromise of the security management environment. Check Point said it discovered the issue internally and reported no evidence of active exploitation, while noting that **Smart-1 Cloud** customers are already protected. Supported affected versions include **R81.20, R82, and R82.10**, with older affected releases from **R80 through R81.10** now end-of-support; fixes were issued through **Jumbo Hotfix Accumulator** updates. The company urged customers to apply patches, restrict **Trusted Clients**, limit management access to trusted administrator systems, avoid exposing management interfaces to untrusted networks or the public internet, and monitor for unauthorized activity.
Aug 8, 2026
BMC Control-M deployments are affected by two newly disclosed vulnerabilities that expose `Control-M/Server` and related components to serious remote attacks. **CVE-2026-10539** is a critical unauthenticated command injection flaw in Control-M/Server communication commands that can let a remote attacker execute unauthorized commands and potentially fully compromise a server. The issue affects `Control-M/Server` versions `9.0.20.x` through `9.0.21.200`, and possibly earlier unsupported releases, and is rated `CVSS 4.0 9.5` / `CVSS 3.1 9.0`. A second issue, **CVE-2026-10538**, is a high-severity improper deserialization vulnerability in out-of-support `Control-M/Server` and `Control-M/Enterprise Manager` `9.0.20.x` components, particularly in messaging consumer functionality that processes user-controlled serialized data. An authenticated attacker could remotely trigger unintended server-side behavior through crafted serialized content; the flaw is rated `CVSS 4.0 8.9` / `CVSS 3.1 8.0`. Organizations running affected Control-M versions have been advised to upgrade to supported releases, apply vendor patches, harden deserialization controls, restrict access to exposed services, and monitor for suspicious command execution or messaging activity.
Jul 3, 2026