Loading story…
MeWare Software Development Inc.'s PDKS platform was disclosed with two high-severity vulnerabilities affecting versions from V16.20200313 before VMYR_3.5.2025117. CVE-2026-7399 is an insecure direct object reference (IDOR) issue mapped to CWE-639 that allows authorization bypass through a user-controlled key, enabling attackers with low privileges to abuse access rights and expose or alter sensitive data. The flaw carries a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating network-reachable exploitation with low attack complexity and high impact on confidentiality and integrity.
A second flaw, CVE-2026-7402, affects the same product range and stems from improper rate limiting, tracked as CWE-799. The vulnerability allows flooding attacks against PDKS and is rated with the CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, reflecting high impact on integrity and availability. Both issues were referenced in advisories published through USOM, pointing organizations using vulnerable PDKS releases to update to a fixed version at or beyond VMYR_3.5.2025117.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Two high-severity vulnerabilities in MeWare Software Development Inc. PDKS were publicly recorded: CVE-2026-7402 for improper rate limiting that could allow flooding, and CVE-2026-7399 for an authorization bypass via a user-controlled key. Both entries reference USOM advisories and affect PDKS versions from V16.20200313 before VMYR_3.5.2025117.
A vulnerability report for CVE-2026-7399 was received by iletisim@usom.gov.tr, describing an insecure direct object reference/authorization bypass issue in MeWare Software Development Inc. PDKS. The flaw affects versions from V16.20200313 before VMYR_3.5.2025117 and could enable privilege abuse.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple **critical, unauthenticated remote code execution and authentication-bypass vulnerabilities** in widely deployed enterprise products were reported as **actively exploited** and, in several cases, added to CISA’s **Known Exploited Vulnerabilities (KEV)** catalog. SmarterTools *SmarterMail* is being targeted in **ransomware** activity via **CVE-2026-24423**, an unauthenticated RCE caused by missing authentication on the `ConnectToHub` API (`/api/v1/settings/sysadmin/connect-to-hub`), where an attacker-controlled server can return JSON containing a `CommandMount` value that drives arbitrary command execution; the issue affects versions prior to `v100.0.9511`. Separately, SolarWinds *Web Help Desk* is affected by **CVE-2025-40551** (CVSS 9.8), a **deserialization of untrusted data** flaw in the `AjaxProxy` component enabling remote, unauthenticated command execution; CISA added it to KEV amid in-the-wild exploitation and set an accelerated patch deadline for US federal agencies. In parallel, Fortinet environments using **FortiCloud SSO** face authentication-bypass risk from **CVE-2025-59718**, **CVE-2025-59719**, and **CVE-2026-24858**, which can allow an attacker with a FortiCloud account to log into organizations’ **FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb** if SSO is enabled; Kaspersky published **SIEM correlation rules** to detect related suspicious logins and admin actions. Samsung *MagicInfo 9 Server* (digital signage management) was also reported with a trio of severe flaws affecting versions prior to `21.1090.1`, including **CVE-2026-25202** (hardcoded credentials, CVSS 9.8) and **CVE-2026-25201** (unauthenticated arbitrary file upload leading to RCE, CVSS 8.8), creating risk of server takeover and potential network compromise; the article does not indicate KEV inclusion or confirmed exploitation for these MagicInfo issues.
Jun 29, 2026
CISA published an ICS advisory for **CVE-2026-3437**, a **high-severity** memory safety issue (*CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer*) affecting **Portwell Engineering Toolkits v4.8.2**. The flaw is in the Portwell Engineering Toolkits **driver** and could allow a **local, authenticated attacker** to **read and write arbitrary memory**, enabling **privilege escalation** or **denial of service**; CISA scored it **CVSS v3.1 8.8 (High)** with a local attack vector and low complexity. The CVE record corroborates the same impact and affected version, and additionally lists a **CVSS v4.0** vector consistent with high impact to confidentiality, integrity, and availability. The vulnerability was reported to CISA by **Jason Huang** of **TXOne Networks** (Cyber Threat & Product Defense Center), and the advisory notes deployment across critical infrastructure environments (including **Energy** and **Critical Manufacturing**) with worldwide exposure.
Jun 29, 2026
Researchers disclosed three vulnerabilities affecting **Proxmox Virtual Environment (PVE)** and **Proxmox Mail Gateway (PMG)**, including a post-authentication reflected XSS in PVE’s API Inspector, a CRLF injection flaw in HTTP error handling, and a post-authentication SSRF plus arbitrary file-read issue shared across both products. The XSS bug, tracked as `CVE-2022-31358`, could let an authenticated attacker run JavaScript in a logged-in administrator’s browser and potentially abuse exposed web UI functions to execute actions on the host. The CRLF injection issue could be exploited in Chromium-based browsers to inject headers and trigger a client-side denial of service by forcing oversized cookie headers that lock users out of the web interface. The most serious finding was a bug chain in PVE and PMG that allowed low-privileged authenticated users to abuse SSRF and arbitrary file read; in PMG, attackers could also access backup archives containing the authentication private key, forge valid tickets, and escalate privileges to **`root@pam`**. MITRE assigned `CVE-2022-35507` and `CVE-2022-35508` to the latter flaws. Proxmox addressed the XSS in **`pve-http-server` 4.1-2** and patched the CRLF injection and SSRF-related issues in **`pve-http-server` 4.1-3**.
Jun 29, 2026