Loading story…
Black Duck disclosed CVE-2026-8338, an authentication and authorization bypass in Coverity Connect caused by a flaw in Spring Security handling on certain API endpoints. The vulnerability allows an unauthenticated attacker to send a specially crafted HTTP request and bypass access controls, potentially exposing data stored within Coverity without valid credentials.
The issue affects Coverity Connect versions from 2023.6.0 up to, but not including, 2026.6.0, with the advisory specifically noting versions between 2023.6.0 and 2026.3.0. The flaw is tracked as CWE-288 and has been assigned a CVSS v4.0 vector, with Black Duck publishing a product security advisory for impacted customers to review remediation guidance and upgrade paths.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Black Duck published a product security advisory for CVE-2026-8338 covering affected Coverity Connect versions and the authentication and authorization bypass issue. The advisory is linked from the vulnerability record as the vendor security advisory.
The vulnerability CVE-2026-8338, an authentication and authorization bypass in Black Duck Coverity Connect, was received by disclosure@synopsys.com. The issue allows an unauthenticated attacker to send a crafted HTTP request to bypass protections on certain API endpoints and access data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
IBM has disclosed a critical authentication bypass vulnerability in its API Connect platform, tracked as CVE-2025-13915 and rated 9.8 on the CVSS scale. The flaw allows unauthenticated remote attackers to bypass authentication mechanisms and gain unauthorized access to applications managed by API Connect. Affected versions include 10.0.8.0 through 10.0.8.5 and 10.0.11.0, with IBM urging customers to apply the provided fixes immediately or, if unable, to disable self-service sign-up on the Developer Portal to reduce exposure. The vulnerability impacts organizations across various sectors, including banking, healthcare, and telecommunications, that rely on API Connect for API management in cloud, on-premises, or hybrid environments. IBM has released detailed instructions for patching the vulnerability in VMware, OCP, and Kubernetes environments, and strongly recommends upgrading to the latest release to mitigate risk. While there is currently no evidence of exploitation in the wild, the severity and ease of exploitation make prompt remediation critical. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has previously highlighted IBM vulnerabilities as actively exploited, underscoring the importance of addressing this issue swiftly to prevent potential attacks.
Jun 29, 2026
BeyondTrust disclosed multiple vulnerabilities affecting **Remote Support** and **Privileged Remote Access** appliances, including two critical pre-authentication authentication-bypass flaws tracked as `CVE-2026-40138` and `CVE-2026-40139`. Both issues carry **CVSS 9.2** ratings and can allow remote attackers to gain unauthorized access, including access to elevated-privilege accounts, when a specific authentication configuration is enabled. A separate pre-authentication flaw, `CVE-2026-40140`, was rated **CVSS 8.7** and can be exploited remotely to cause a denial-of-service condition in the network communication subsystem. BeyondTrust also addressed `CVE-2026-40141`, a **CVSS 8.5** vulnerability in a web application component that could let an authenticated low-privilege user access resources or data outside their intended authorization scope. The affected products are **Remote Support 25.3.2 and earlier** and **Privileged Remote Access 25.3.2 and earlier**. The Canadian Centre for Cyber Security urged administrators to review BeyondTrust’s advisory, apply vendor updates, disable the affected authentication configuration where possible, and review access controls and permissions.
Jul 9, 2026
F5 disclosed a critical flaw in the **BIG-IP iControl REST** interface, tracked as **`CVE-2022-1388`**, that allows attackers to bypass authentication and achieve unauthenticated remote code execution on exposed administrative interfaces. The issue affects the interaction between Apache and the iControl REST service, where crafted requests abusing headers such as **`X-F5-Auth-Token`** and **`Connection`** can reach privileged command-execution functionality without valid credentials. The vulnerability carries a **CVSS 9.8** rating and impacts multiple BIG-IP versions, prompting F5 to publish patches and mitigation guidance. Technical analysis showed the bug stems from request-handling logic that lets specially formed traffic evade normal authentication checks and invoke sensitive endpoints. Security reporting also indicated the flaw was being **actively exploited in the wild**, with thousands of potentially vulnerable internet-exposed BIG-IP systems observed, increasing the risk to organizations using the platform for application delivery and security services. Defenders were urged to patch affected devices quickly or apply F5’s recommended mitigations to restrict exposure of the management interface.
Aug 6, 2026