Loading story…
Researchers disclosed Blast-RADIUS, a protocol-level weakness in RADIUS tracked as CVE-2024-3596, that allows a man-in-the-middle attacker to tamper with authentication exchanges and convert a legitimate Access-Reject or other server response into a forged Access-Accept. The issue stems from insecure practices in RADIUS defined in RFC 2865, including reliance on an MD5-based Response Authenticator and insufficient integrity protection for Access-Request packets. Public reporting and vendor advisories indicate the attack can let an adversary bypass authentication without knowing user passwords or shared secrets, creating a path to unauthorized network access and potential compromise of administrative interfaces on affected infrastructure.
The vulnerability has prompted broad industry response, with advisories and analysis from vendors and security organizations including Cloudflare, CERT/CC, Siemens, NetApp, SonicWall, and CISA-linked ICS guidance, alongside IETF work on deprecating insecure RADIUS practices. Recommended mitigations include updating affected products and enforcing the Message-Authenticator attribute on all RADIUS requests and responses, with Access-Accept and Access-Reject placing that attribute first, while organizations review deployments that still depend on legacy UDP-based RADIUS protections.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The IETF RADext working group published a draft focused on deprecating insecure practices in RADIUS in response to protocol weaknesses highlighted by BlastRADIUS. This reflects a standards-level effort to address the insecure legacy behavior in RADIUS deployments.
Public guidance and advisories were issued describing mitigations for BlastRADIUS, including firmware updates and enforcing the Message-Authenticator attribute on requests and responses. The Tenable reference also notes multiple vendor advisories and CERT/CC and CISA-linked materials covering affected products and mitigations.
Researchers disclosed BlastRADIUS, a forgery attack against the RADIUS authentication protocol tracked as CVE-2024-3596. The issue stems from weaknesses in RFC 2865 RADIUS, including MD5-based response authentication and insufficient integrity protection, enabling a man-in-the-middle attacker to turn a valid server response into a forged one.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourceblastradius.fail
Open sourcedatatracker.ietf.org
Open sourcetenable.com
Open sourceblog.cloudflare.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BeyondTrust disclosed multiple vulnerabilities affecting **Remote Support** and **Privileged Remote Access** appliances, including two critical pre-authentication authentication-bypass flaws tracked as `CVE-2026-40138` and `CVE-2026-40139`. Both issues carry **CVSS 9.2** ratings and can allow remote attackers to gain unauthorized access, including access to elevated-privilege accounts, when a specific authentication configuration is enabled. A separate pre-authentication flaw, `CVE-2026-40140`, was rated **CVSS 8.7** and can be exploited remotely to cause a denial-of-service condition in the network communication subsystem. BeyondTrust also addressed `CVE-2026-40141`, a **CVSS 8.5** vulnerability in a web application component that could let an authenticated low-privilege user access resources or data outside their intended authorization scope. The affected products are **Remote Support 25.3.2 and earlier** and **Privileged Remote Access 25.3.2 and earlier**. The Canadian Centre for Cyber Security urged administrators to review BeyondTrust’s advisory, apply vendor updates, disable the affected authentication configuration where possible, and review access controls and permissions.
Jul 9, 2026
CISA published multiple ICS advisories affecting **critical manufacturing** environments, including a **critical RADIUS forgery weakness** impacting **Hitachi Energy XMC20** and **FOX61x** when configured for **remote RADIUS authentication**. The issue (tracked as **CVE-2024-3596**, CVSS v3.1 **9.0**) stems from the RADIUS protocol’s use of an **MD5 Response Authenticator**, enabling a local attacker to perform a **chosen-prefix collision** and alter server responses (e.g., `Access-Accept`, `Access-Reject`, `Access-Challenge`), with potential confidentiality, integrity, and availability impact. Separately, CISA warned that **Ilevia EVE X1 Server** (<= **4.7.18.0**) contains multiple vulnerabilities (including **CVE-2025-34183/34184/34185/34186/34187** and **CVE-2025-34512/34513/34517/34518**) that can enable **pre-auth file disclosure** (via the `db_log` POST parameter) and **unauthenticated OS command injection** (in `/ajax/php/login.php`), potentially leading to arbitrary command execution and sensitive information exposure; at least one issue is scored **CVSS 9.8**. CISA also disclosed an **out-of-bounds write** in **o6 Automation GmbH Open62541** (**CVE-2026-1301**, CVSS **5.7**) where, with PubSub and JSON enabled, a crafted JSON message can trigger **pre-auth memory corruption** and a reliable **denial of service**.
Jun 29, 2026
Cisco disclosed multiple vulnerabilities affecting **Secure Firewall Management Center (FMC)**, **Secure Firewall Threat Defense (FTD)**, and **Adaptive Security Appliance (ASA)** software, including a **remote code execution** flaw tied to RADIUS handling in FMC and a separate **authentication bypass** issue in on-premises FMC. Additional advisories describe a **path traversal** vulnerability in FMC and FTD, expanding the risk to core firewall management and security enforcement platforms used in enterprise environments. The broader set of advisories also includes a **Snort deep inspection bypass** in FTD, a **TLS/Snort 3 denial-of-service** issue, a **SAML reflected cross-site scripting** flaw affecting ASA and FTD, a **VPN web services client-side request smuggling** vulnerability, and a **Lua code injection** bug in ASA and FTD. Taken together, the disclosures show that Cisco firewall products were exposed to weaknesses spanning **code execution, access control, traffic inspection evasion, denial of service, and web interface exploitation**, creating multiple paths for attackers to disrupt defenses or gain elevated access if affected systems remain unpatched.
Jul 12, 2026