Loading story…
A high-severity flaw tracked as CVE-2026-43910 affects Appium Java Client versions 8.2.1 through before 10.1.1, allowing server-side request forgery and network pivoting when directConnect(true) is enabled. The issue stems from AppiumCommandExecutor.setDirectConnect() rebuilding the client server URL from untrusted NEW_SESSION response fields while only verifying that the protocol is HTTPS, which means a rogue or compromised Appium server can redirect subsequent session traffic to attacker-chosen destinations.
The vulnerability could let attackers intercept session traffic and reach internal network resources, including potential access to cloud metadata services such as IMDS for credential theft. Appium addressed the issue in version 10.1.1 through additional security checks on the overrideServerUrl API, including validation logic designed to block unsafe direct-connect targets such as 0.0.0.0, [::], and multicast addresses; organizations are advised to upgrade to 10.1.1 or disable directConnect if they cannot update immediately.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-43910 was published as a high-severity vulnerability affecting Appium Java Client versions 8.2.1 through before 10.1.1. The flaw allows network pivoting and SSRF via unvalidated directConnect redirect handling in AppiumCommandExecutor when directConnect(true) is enabled.
Appium released Java Client version 10.1.1, whose release notes say it performs additional security checks on the overrideServerUrl API. This version is identified as the fix for the affected directConnect URL handling issue.
A security-related pull request was merged into the Appium Java Client, adding DirectConnectUrlSafety validation around overrideServerUrl and tests covering disallowed addresses such as 0.0.0.0, [::], and 224.0.0.1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-58192** affects `@appium/storage-plugin` versions prior to **1.1.6**, allowing an unauthenticated remote client to delete arbitrary writable files or directories through the plugin’s `POST /storage/delete` handler. The issue stems from a path traversal weakness in which attacker-controlled input is passed into `path.join(storageRoot, name)` and then into `fs.rimraf()` without sufficient sanitization, enabling `../` sequences to escape the intended storage root and trigger recursive deletion. Appium addressed the flaw in **`@appium/storage-plugin` 1.1.6**, where the project added `fs.sanitizeName` handling for delete requests. The vulnerability has been classified under **`CWE-22`** and **`CWE-73`** and assigned the CVSS v3.1 vector **`AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N`**, reflecting remote exploitation with no authentication required and high integrity impact.
Jul 9, 2026
**ConnectWise ScreenConnect** disclosed a critical vulnerability, **CVE-2026-3564** (**CVSS 9.0**), affecting versions prior to **26.1**. The flaw stems from ScreenConnect storing unique per-instance machine keys and related cryptographic material in plaintext server configuration files, creating a path for attackers under certain conditions to extract those keys and abuse them for unauthorized access. The issue is classified as **CWE-347: Improper Verification of Cryptographic Signature**, and successful exploitation can undermine confidentiality, integrity, and availability in environments that rely on ScreenConnect for remote access. With the exposed machine keys, an attacker could forge or manipulate session authentication tokens, hijack legitimate sessions, and elevate access without user interaction. ConnectWise rated the issue as high priority, and the **Centre for Cybersecurity Belgium** urged organizations to patch immediately, monitor for suspicious activity, and treat updates as protection against future exploitation rather than proof that no prior compromise occurred. The vendor states the issue is fixed in **version 26.1**, making rapid remediation and post-patch review important for on-premises deployments.
Jul 23, 2026
Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, was found to contain multiple serious vulnerabilities that enabled unauthorized access, data exposure, and server compromise. The most prominent flaws, `CVE-2023-35078` and `CVE-2023-35081`, were patched by Ivanti in July 2023 after disclosure that attackers had exploited them against Norwegian organizations and a government agency. `CVE-2023-35078` is a critical authentication bypass affecting internet-facing API paths, while `CVE-2023-35081` is a directory traversal issue that can let an authenticated administrator write arbitrary files, including webshells; CISA added both to its Known Exploited Vulnerabilities catalog and urged immediate patching and compromise assessment. Subsequent reporting and vendor disclosures showed the exposure was broader than initially understood. Rapid7 highlighted `CVE-2023-35078` as a critical API access flaw, while Ivanti later disclosed `CVE-2023-35082`, saying additional exploitation paths meant all supported EPMM 11.10, 11.9, and 11.8 versions, along with older MobileIron Core releases, were affected depending on configuration. A joint CISA and NCSC-NO advisory said APT actors used the bugs from at least April through July 2023, leveraging compromised SOHO routers as proxies, deleting Apache logs with a malicious `mi.war` Tomcat application, conducting LDAP reconnaissance, and likely pivoting through Ivanti Sentry toward internal Exchange systems. More recent dCERT advisories indicate Ivanti EPMM continues to face multiple vulnerabilities, including issues that may allow code execution.
Jun 29, 2026