Loading story…
Foreman disclosed and fixed CVE-2026-1961, a high-severity remote code execution flaw in its WebSocket proxy caused by command injection. The vulnerability arises because Foreman builds shell commands using unsanitized hostname values supplied by compute resource providers such as VMware vSphere and Libvirt. A malicious or attacker-controlled compute resource server can exploit the flaw when an administrator accesses a VM VNC console, allowing code execution on the Foreman server in a normal management workflow.
The issue affects Foreman versions up to and including 3.18.0 and carries a CVSS v3.1 score of 8.0 with the vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. Foreman said successful exploitation could expose sensitive credentials and potentially compromise managed infrastructure. Patches were released in 3.18.1, 3.17.2, and 3.16.3, and the vulnerability was credited to Houssam Sahli.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Foreman publicly disclosed CVE-2026-1961 as a high-severity remote code execution vulnerability affecting versions up to and including 3.18.0. Fixes were released in Foreman 3.18.1, 3.17.2, and 3.16.3, with credit given to Houssam Sahli.
CVE-2026-1961, a command injection flaw in Foreman’s WebSocket proxy, was reported to Red Hat. The issue could allow remote code execution if a malicious compute resource server supplies unsanitized hostname values later used in shell commands.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability tracked as **CVE-2026-1961** was disclosed in Foreman’s WebSocket proxy, where unsanitized hostname values in `lib/ws_proxy.rb` are used to build shell commands. A malicious compute resource provider—such as a fake VMware vSphere or Libvirt endpoint—can exploit the flaw to trigger **remote code execution** on the Foreman server when an administrator opens a VM console. The issue affects **Foreman 3.17.0 and earlier** and likely older releases because the vulnerable code path reportedly remained unchanged since 2020. Successful exploitation can execute code as the `foreman` user, creating a path to steal database credentials and encryption keys and potentially decrypt stored infrastructure secrets for wider compromise of managed environments. The proposed fix replaces shell-interpreted command construction with safer handling using `Shellwords.escape`, array-based arguments, and `Open3.popen3`, while Red Hat said the issue was addressed in **Red Hat Satellite 6.17 for RHEL 9** and **Red Hat Satellite 6.16 for RHEL 8 and RHEL 9** through advisories `RHSA-2026:5970` and `RHSA-2026:5971`.
Aug 20, 2026
Broadcom issued **VMSA-2025-0010** to fix four vulnerabilities across VMware ESXi, vCenter Server, Workstation, Fusion, Cloud Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure, led by **CVE-2025-41225**, an authenticated command-execution flaw in **vCenter Server** with a **CVSS 8.8** score. According to the advisory, an attacker able to create or modify alarms and run script actions could exploit the bug, while additional fixes address **CVE-2025-41226** and **CVE-2025-41227** denial-of-service issues and **CVE-2025-41228**, a reflected **XSS** flaw affecting ESXi and vCenter Server. VMware said patches are available for all affected products and that **no workarounds** exist. The latest advisory follows earlier VMware warnings over serious **vCenter Server** weaknesses, including **VMSA-2024-0012**, which disclosed **CVE-2024-37079**, **CVE-2024-37080**, and **CVE-2024-37081** as memory-management and corruption flaws that could enable **remote code execution** in vCenter services. VMware said at the time it had no evidence of active exploitation, but urged customers to apply the listed patch versions because no official mitigations were provided; public GitHub material later appeared referencing **CVE-2024-37081**, underscoring continued security attention on vCenter exposure.
Jun 29, 2026
Dell disclosed **CVE-2026-67261**, a critical OS command injection flaw in **Dell Virtual Storage Integrator (VSI) for VMware vSphere Client** that affects versions prior to **10.11.1.0**. The vulnerability is located in the **IAPI** component and can be exploited **remotely without authentication**, allowing an attacker to execute arbitrary operating system commands with **root privileges**. The issue is tracked as **CWE-78** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating a high likelihood of full compromise. Dell warned that successful exploitation could lead to complete takeover of the VSI deployment and potentially expose underlying infrastructure managed through the platform. A related advisory from **CERT-PY** highlighted the vulnerability in Dell products, reinforcing the need for defensive action. Dell has recommended that customers **upgrade to version 10.11.1.0 or later as soon as possible** to remediate the risk.
Aug 16, 2026