Loading story…
Two high-severity vulnerabilities were disclosed affecting widely used infrastructure software. GoHarbor Harbor is affected by CVE-2026-4404, a hard-coded/default credential issue in version 2.15.0 and below that can let attackers authenticate to the Harbor web UI with the default administrator password if it was never changed. The published scoring indicates the flaw is network-accessible, requires no privileges or user interaction, and can lead to high confidentiality and integrity impact.
N2WS Backup & Recovery is affected by CVE-2025-32991, which impacts versions before 4.4.0 and can lead to remote code execution through a two-step attack against the product’s RESTful API. The CVSS v3.1 vector rates the issue as remotely exploitable with no required privileges or user interaction, despite high attack complexity, and assigns high impact across confidentiality, integrity, and availability. The CVE entry was updated with links to an N2WS security advisory and vendor resources.
Map this exposure pattern across your cloud, code, and identities.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE-2025-32991 record was updated to add a CVSS v3.1 vector, classify the issue as CWE-362, and include references to an N2WS security advisory update and the N2WS website.
A CVE entry for CVE-2025-32991 was received for N2WS Backup & Recovery versions before 4.4.0, describing a two-step attack against the product's RESTful API that can result in remote code execution.
Later the same day, the CVE-2026-4404 record was modified to add CVSS v3.1 scoring and CWE mappings, characterizing the flaw as network-accessible, low complexity, and requiring no privileges or user interaction.
A new CVE, CVE-2026-4404, was published for GoHarbor Harbor 2.15.0 and earlier, describing a hard-coded/default credential weakness that allows authentication to the Harbor web UI if the default administrator password was not changed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT/CC published advisory `VU#577436` for a hard-coded credentials vulnerability in **GoHarbor Harbor**, identifying a security flaw that could expose deployments using the container registry platform. The issue was classified as a vulnerability in Harbor itself, with the advisory highlighting the presence of embedded credentials that could undermine authentication controls and increase the risk of unauthorized access. Belgium's Center for Cybersecurity (CCB) later issued a public warning describing the GoHarbor Harbor issue as **critical** and urging organizations to patch immediately. The alert signals elevated concern for enterprises that rely on Harbor to store and manage container images, as unremediated systems could be at risk if attackers are able to leverage the hard-coded credentials vulnerability.
Jun 29, 2026
A series of critical and high-severity vulnerabilities have been disclosed affecting a wide range of software products, including workflow automation tools, web applications, network devices, and desktop software. Notable issues include remote code execution (RCE) flaws in *n8n*, *Lilac-Reloaded for Nagios*, *FileZilla Client*, and *AVideo*, as well as privilege escalation vulnerabilities in products like *Versa SASE Client*, *AspEmail*, and *ActFax*. Several vulnerabilities allow unauthenticated attackers to upload arbitrary files, bypass authentication, or exploit weak session management, potentially leading to full system compromise or unauthorized access to sensitive data. Many of these vulnerabilities have public exploits available, increasing the risk of active exploitation in the wild. Vendors have released patches for several of the affected products, and administrators are strongly advised to update to the latest versions or apply recommended mitigations. The vulnerabilities span a variety of attack vectors, including buffer overflows, improper input validation, insecure file upload mechanisms, and misconfigured authentication endpoints. Organizations should prioritize patching systems exposed to the internet and review access controls to limit the impact of potential exploitation. Immediate attention is warranted for products with critical CVSS scores and those with known public exploits.
Jun 29, 2026
Rapid7 disclosed a chain of two vulnerabilities in **N-able N-central** that allows a remote unauthenticated attacker to create an attacker-controlled System administrator account. `CVE-2026-86206`, a medium-severity access-control flaw, stems from inconsistent URI and `Forwarded` header parsing between Envoy, Jetty, and N-central, enabling access to local-only SOAP services. `CVE-2026-86207`, rated high severity, bypasses legacy two-factor authentication; together, the flaws permit acquisition of a pre-login session, conversion to a privileged session for built-in accounts, and creation of a new privileged user. The flaws constitute an authentication-bypass condition consistent with **CWE-305** and affect all N-central releases before **2026.3 Hotfix 3** (`2026.3.1.13`). N-able has fixed the issues in that release; organizations operating on-premises N-central should apply the update urgently and review for unexpected privileged accounts or suspicious SOAP-service access. Hosted N-central customers do not need to take action because N-able has deployed the fixes.
Sep 9, 2026