Loading story…
Spacelabs Healthcare Sentinel versions 10.5.x and later, and 11.x.x before 11.6.0, are affected by **CVE-2026-0611, an unauthenticated remote code execution flaw tied to a deprecated **.NET Remoting HTTP** channel. The vulnerable service listens on port 8989` and can expose arbitrary file read and write functionality when attackers supply valid .NET URI endpoints, creating a path to compromise the application without authentication.
Researchers reported that attackers could use the file-write access to place ASPX webshells in the IIS wwwroot directory and execute code on the target system. Advisories note that port 8989 is not exposed by default in Sentinel deployments, meaning exploitation depends on the remoting service having been deliberately made network-accessible through configuration or network policy changes. The issue was credited to Victor A. Morales and Jan A. Rodriguez of GM Sectec, Corp.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
The vulnerability record for CVE-2026-0611 was received by disclosure@vulncheck.com. The flaw affects Spacelabs Healthcare Sentinel and enables unauthenticated remote code execution when the .NET Remoting HTTP channel on port 8989 is exposed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical Ivanti Sentry vulnerability, **CVE-2026-10520**, is being actively exploited to achieve unauthenticated remote code execution with **root** privileges through OS command injection. The flaw stems from improper handling of internal configuration commands exposed through an externally accessible API, allowing full compromise of affected appliances. CISA added the bug to its **Known Exploited Vulnerabilities** catalog, and FortiGuard reported **886** blocked exploitation attempts in 24 hours and **8,406** over seven days, with activity rising **82%** week over week across the technology, automotive, banking/finance/insurance, and education sectors. The vulnerability affects Ivanti Sentry versions before **10.5.2**, **10.6.2**, and **10.7.1**, and Ivanti has released those versions as fixes. Because Sentry operates as an inline gateway between mobile devices and enterprise back-end systems, successful exploitation can expose a critical network chokepoint and enable broad downstream access. Ivanti also addressed **CVE-2026-10523** in the same update, though it was not reported as exploited, and defenders are being urged to upgrade immediately and restrict management and service interfaces from untrusted networks.
Jul 10, 2026
Microsoft disclosed and patched **CVE-2026-58644**, a critical remote code execution flaw in **Microsoft SharePoint** caused by insecure deserialization of untrusted data (`CWE-502`). The vulnerability carries a **CVSS 9.8** rating and allows an **unauthorized attacker** to execute arbitrary code over the network by sending a crafted HTTP request, with **no user interaction required**. Affected products include **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Server Subscription Edition** prior to patched versions published through Microsoft's security guidance. Reporting on the release said no active exploitation had been confirmed at disclosure, but warned that exploitation is likely because SharePoint is widely deployed in enterprises; organizations were urged to prioritize patching internet-exposed SharePoint systems, review access permissions, and monitor server logs for suspicious activity.
Jul 17, 2026
**CVE-2025-26399** is a **critical insecure deserialization** flaw (CWE-502) in *SolarWinds Web Help Desk* that enables **unauthenticated remote code execution/command execution** over the network. The issue resides in the product’s **`AjaxProxy`** component, where untrusted serialized data can be processed without sufficient validation, allowing an attacker to deliver a crafted payload that results in arbitrary command execution on the host running the help desk application. Multiple reports indicate the vulnerability is **actively exploited in the wild**, prompting **CISA** to add CVE-2025-26399 to the **Known Exploited Vulnerabilities (KEV)** catalog. NetSPI notes the flaw was disclosed in 2025 and is described as a **patch bypass** related to earlier issues (**CVE-2024-28988** and **CVE-2024-28986**), and recommends immediate remediation by upgrading to **SolarWinds Web Help Desk 12.8.7 Hotfix 1 or later**; if patching is delayed, organizations should restrict network exposure of the server and increase monitoring for suspicious process execution and outbound connections.
Jun 29, 2026