Loading story…
Galaxy Software Services' Vitals ESP is affected by two high-severity vulnerabilities that could let remote attackers access sensitive functions and elevate privileges. CVE-2026-4640 is a missing authentication flaw (CWE-306) that allows unauthenticated attackers to remotely execute certain functions and obtain sensitive information, with CVSS vectors indicating network-based exploitation, low attack complexity, and no required user interaction or privileges.
A second issue, CVE-2026-4639, is an incorrect authorization vulnerability (CWE-863) that allows authenticated remote attackers to perform administrative functions and escalate privileges. TWCERT/CC published references for both flaws in English and Chinese, and the scoring for each indicates material risk to confidentiality, integrity, and availability in deployments of Vitals ESP.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Also on 2026-03-24, TWCERT/CC published English and Chinese references for the two Vitals ESP vulnerabilities and documented their CWE classifications and high-severity CVSS vectors. The disclosures identified CVE-2026-4639 as CWE-863 and CVE-2026-4640 as CWE-306.
On 2026-03-24, TWCERT/CC received CVE-2026-4640 describing a missing authentication vulnerability in Galaxy Software Services' ESP. The flaw allows unauthenticated remote attackers to execute certain functions and obtain sensitive information.
On 2026-03-24, TWCERT/CC received CVE-2026-4639 describing an incorrect authorization vulnerability in Galaxy Software Services' ESP. The flaw allows authenticated remote attackers to perform certain administrative functions and escalate privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of critical and high-severity vulnerabilities affecting a diverse set of software products were publicly disclosed in October 2025. Epsilon RH by Grupo Castilla was found to have a SQL injection vulnerability (CVE-2025-41028) that allows attackers to manipulate the database by sending crafted POST requests to the 'sEstadoUsr' parameter in the '/epsilonnetws/WSAvisos.asmx' endpoint. Lanscope Endpoint Manager (CVE-2025-61932) was reported to have an improper origin verification flaw, enabling attackers to execute arbitrary code via specially crafted packets, though remote exploitation is not possible. Galaxy Software Services Vitals ESP Forum Module (CVE-2025-31342) was discovered to allow remote authenticated users to upload dangerous files, leading to arbitrary command execution. Fsas Technologies Inc.'s ETERNUS SF (CVE-2025-62577) contains incorrect default permissions, allowing low-privileged users to obtain database credentials and potentially escalate privileges to execute OS commands as an administrator. Excellent Infotek's Document Management System (CVE-2025-11948) is vulnerable to unauthenticated arbitrary file upload, enabling attackers to deploy web shells and execute code on the server. Vvveb CMS up to version 1.0.5 is susceptible to authenticated code injection via its Code Editor, allowing attackers to modify files and achieve remote code execution. The Theme Editor plugin for WordPress (CVE-2025-9890) is vulnerable to cross-site request forgery, which can be exploited to achieve remote code execution if an administrator is tricked into clicking a malicious link. The PPOM plugin for WooCommerce (CVE-2025-11391) allows unauthenticated arbitrary file uploads, posing a severe risk to affected e-commerce sites. The Appointments plugin for WordPress (CVE-2017-20206) and the Flickr Gallery plugin (CVE-2017-20207) both suffer from unauthenticated PHP object injection vulnerabilities, which have been actively exploited to create backdoors using the WP_Theme() class. RegistrationMagic (CVE-2017-20208) is also affected by a PHP object injection flaw, allowing attackers to fetch and install remote files. Finally, BLU-IC2 and BLU-IC4 devices (CVE-2025-11925) have an API that returns an incorrect Content-Type header, potentially enabling HTML/JavaScript injection in responses. Each of these vulnerabilities presents a significant risk, with several allowing remote code execution, privilege escalation, or the installation of persistent backdoors. The affected products span web applications, content management systems, endpoint management tools, and specialized enterprise software. Security teams are advised to review the specific advisories, apply patches or mitigations where available, and monitor for signs of exploitation, as several vulnerabilities have been reported as actively exploited in the wild. The diversity and severity of these disclosures underscore the ongoing need for rigorous vulnerability management and timely response to public advisories.
Jun 29, 2026
ESPHome disclosed multiple vulnerabilities in its dashboard component that exposed authenticated users to arbitrary file access and stored cross-site scripting, with the most severe issue allowing remote attackers to read and write files under the configuration directory through the "edit configuration file" API. The path traversal flaw, tracked as **CVE-2024-27081** / `GHSA-8p25-3q46-8q2p`, affected version `2023.12.9` and could expose `esphome.json`, firmware source code, Wi-Fi credentials, fallback hotspot credentials, OTA passwords, and API encryption keys. In command-line installations, attackers could also modify Python scripts used during firmware compilation and flashing, creating a path to remote code execution on the host running the dashboard. A separate stored XSS bug, **CVE-2024-27287**, affected versions from `2023.12.9` through `2024.2.1` and stemmed from the `/edit` endpoint returning unsanitized user-controlled content as HTML. An authenticated attacker could inject JavaScript into a configuration file and trigger execution when another authenticated user opened a crafted `/edit?configuration=` link, enabling actions in the victim's session, access to sensitive data, configuration tampering, and firmware flashing on managed boards; the report also noted insufficient cookie protections that could aid session theft. ESPHome patched the file-write issue in version `2024.2.1` and the XSS issue in `2024.2.2`, and the advisories said chaining these flaws with additional weaknesses could lead to **unauthenticated remote code execution** against the machine hosting the dashboard.
Jun 29, 2026
Multiple **critical, unauthenticated remote code execution and authentication-bypass vulnerabilities** in widely deployed enterprise products were reported as **actively exploited** and, in several cases, added to CISA’s **Known Exploited Vulnerabilities (KEV)** catalog. SmarterTools *SmarterMail* is being targeted in **ransomware** activity via **CVE-2026-24423**, an unauthenticated RCE caused by missing authentication on the `ConnectToHub` API (`/api/v1/settings/sysadmin/connect-to-hub`), where an attacker-controlled server can return JSON containing a `CommandMount` value that drives arbitrary command execution; the issue affects versions prior to `v100.0.9511`. Separately, SolarWinds *Web Help Desk* is affected by **CVE-2025-40551** (CVSS 9.8), a **deserialization of untrusted data** flaw in the `AjaxProxy` component enabling remote, unauthenticated command execution; CISA added it to KEV amid in-the-wild exploitation and set an accelerated patch deadline for US federal agencies. In parallel, Fortinet environments using **FortiCloud SSO** face authentication-bypass risk from **CVE-2025-59718**, **CVE-2025-59719**, and **CVE-2026-24858**, which can allow an attacker with a FortiCloud account to log into organizations’ **FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb** if SSO is enabled; Kaspersky published **SIEM correlation rules** to detect related suspicious logins and admin actions. Samsung *MagicInfo 9 Server* (digital signage management) was also reported with a trio of severe flaws affecting versions prior to `21.1090.1`, including **CVE-2026-25202** (hardcoded credentials, CVSS 9.8) and **CVE-2026-25201** (unauthenticated arbitrary file upload leading to RCE, CVSS 8.8), creating risk of server takeover and potential network compromise; the article does not indicate KEV inclusion or confirmed exploitation for these MagicInfo issues.
Jun 29, 2026