Loading story…
CERT Polska disclosed two missing authorization vulnerabilities in MWDB Core that were fixed in version 2.19.0. CVE-2026-66723 affects versions 2.2.0 through before 2.19.0 and allows an unauthenticated attacker to abuse the Remote Instances proxy API to send arbitrary requests to a remote MWDB instance using the configured API key’s identity and permissions. The issue is limited to deployments where Remote Instances are enabled.
CERT Polska also reported CVE-2026-66724, affecting versions 2.0.0 through before 2.19.0, which lets any authenticated user bypass capability checks on deprecated config and blob upload endpoints by using an undocumented POST method. The flaw is limited to unauthorized addition of config and text blob objects. Both issues were classified as CWE-862: Missing Authorization, underscoring authorization control failures that could let attackers act beyond intended privileges.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
CERT Polska disclosed CVE-2026-66723 and CVE-2026-66724 on 2026-07-29 and stated both missing authorization vulnerabilities were fixed in MWDB Core version 2.19.0. The issues affected MWDB Core versions before 2.19.0, with one enabling abuse of the Remote Instances proxy API and the other bypassing capability checks on deprecated endpoints.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BMC Control-M deployments are affected by two newly disclosed vulnerabilities that expose `Control-M/Server` and related components to serious remote attacks. **CVE-2026-10539** is a critical unauthenticated command injection flaw in Control-M/Server communication commands that can let a remote attacker execute unauthorized commands and potentially fully compromise a server. The issue affects `Control-M/Server` versions `9.0.20.x` through `9.0.21.200`, and possibly earlier unsupported releases, and is rated `CVSS 4.0 9.5` / `CVSS 3.1 9.0`. A second issue, **CVE-2026-10538**, is a high-severity improper deserialization vulnerability in out-of-support `Control-M/Server` and `Control-M/Enterprise Manager` `9.0.20.x` components, particularly in messaging consumer functionality that processes user-controlled serialized data. An authenticated attacker could remotely trigger unintended server-side behavior through crafted serialized content; the flaw is rated `CVSS 4.0 8.9` / `CVSS 3.1 8.0`. Organizations running affected Control-M versions have been advised to upgrade to supported releases, apply vendor patches, harden deserialization controls, restrict access to exposed services, and monitor for suspicious command execution or messaging activity.
Jul 3, 2026
MeWare Software Development Inc.'s **PDKS** platform was disclosed with two high-severity vulnerabilities affecting versions from `V16.20200313` before `VMYR_3.5.2025117`. **CVE-2026-7399** is an insecure direct object reference (**IDOR**) issue mapped to `CWE-639` that allows authorization bypass through a user-controlled key, enabling attackers with low privileges to abuse access rights and expose or alter sensitive data. The flaw carries a CVSS v3.1 vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`, indicating network-reachable exploitation with low attack complexity and high impact on confidentiality and integrity. A second flaw, **CVE-2026-7402**, affects the same product range and stems from improper rate limiting, tracked as `CWE-799`. The vulnerability allows flooding attacks against PDKS and is rated with the CVSS v3.1 vector `AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`, reflecting high impact on integrity and availability. Both issues were referenced in advisories published through **USOM**, pointing organizations using vulnerable PDKS releases to update to a fixed version at or beyond `VMYR_3.5.2025117`.
Jun 29, 2026
Researchers disclosed multiple security flaws affecting AWS MCP components, including a local file inclusion bug in the AWS Remote MCP Server and a critical command injection issue in `aws-mcp-server`. Varonis said authenticated users could abuse AWS CLI shorthand syntax, specifically the `@=` operator passed through the `aws___call_aws` tool, to read arbitrary files from the underlying host even when `FileAccessMode=NO_ACCESS` was enabled. AWS assigned **CVE-2026-4270** to the file access restriction bypass and said the issue was fixed in `aws-api-mcp-server` version **1.3.9**; the exposure affected the public endpoint `aws-mcp.us-east-1.api.aws` as well as self-hosted or forked deployments. A separate flaw, tracked as **CVE-2026-5058** and published by Trend Micro's Zero Day Initiative as **ZDI-26-246**, allows unauthenticated remote code execution in `aws-mcp-server` because user-supplied input in the allowed-commands list is not properly validated before being used in a system call. ZDI rated the bug **CVSS 9.8** and said successful exploitation lets attackers run arbitrary code in the MCP server context; the advisory was released as a 0-day after the vendor rejected the report. The disclosures landed alongside another AWS bulletin for **CVE-2026-4269**, an improper S3 ownership verification issue in the Bedrock AgentCore Starter Toolkit, underscoring broader security concerns around MCP-related tooling and the need for immediate patching and review of derivative implementations.
Jun 29, 2026