Loading story…
A newly disclosed vulnerability, CVE-2026-53510, allows remote code execution in the savonrb Savon Ruby SOAP client when it parses attacker-controlled WSDL files. The flaw is in Savon::Model.all_operations, where WSDL operation names are interpolated into Ruby source and executed with module_eval, letting malicious WSDL content run arbitrary code in the application process. The issue affects Savon versions 0.9.8 through 2.17.1 and has been classified as CWE-94 with a high-impact CVSS:3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Exploitation is possible when an attacker can influence the WSDL a client consumes, including through user-supplied WSDL URLs, unencrypted HTTP retrieval, or local file-write scenarios that alter the referenced definition. Savon version 2.17.2 fixes the issue by replacing module_eval-based dynamic method generation with define_method and symbolized method names, while a documented workaround is to manually define permitted operations instead of relying on automatic evaluation. CISA's SSVC assessment indicates no known exploitation and notes the flaw is not automatable, though successful compromise could result in full confidentiality, integrity, and availability impact.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE record was modified to add a CISA SSVC assessment stating there was no known exploitation, the issue was not automatable, and the technical impact was total. The SSVC entry used version 2.0.3 and carried a timestamp of 2026-07-31T20:04:14.383083Z.
GitHub Security Advisories received the new CVE record for CVE-2026-53510, covering remote code execution in the savonrb Savon Ruby SOAP client. The flaw stems from attacker-controlled WSDL operation names being interpolated into Ruby source and evaluated.
Savon addressed a Ruby code execution vulnerability in dynamic WSDL operation handling by replacing module_eval-based method generation with a safer implementation in version 2.17.2. The fix affects versions from 0.9.8 up to, but not including, 2.17.2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two critical authentication bypass vulnerabilities have been identified in the *ruby-saml* library, tracked as CVE-2025-66567 and CVE-2025-66568. Both flaws affect versions up to and including 1.12.4 and allow attackers to execute Signature Wrapping attacks, potentially bypassing SAML authentication. CVE-2025-66568 is caused by Libxml2 canonicalization errors, where invalid XML input may result in an empty string during canonicalization, leading to improper Digest/Signature validation. CVE-2025-66567 arises from differences in XML parsing between ReXML and Nokogiri, resulting in inconsistent document structures and an incomplete fix for a previous vulnerability (CVE-2025-25292). Both vulnerabilities are remotely exploitable and have been rated as critical with a CVSS score of 9.3. The issues have been addressed in *ruby-saml* version 1.18.0, and users are strongly advised to update to this version to mitigate the risk of authentication bypass. These vulnerabilities could allow attackers to impersonate users or gain unauthorized access to systems relying on SAML authentication via the affected library. No affected products have been specifically listed, but any application using vulnerable versions of *ruby-saml* is at risk. Security advisories and technical details have been published to inform the community and facilitate remediation.
Jun 29, 2026
Security researchers have disclosed a critical vulnerability in the .NET Framework's `SoapHttpClientProtocol` class, which is widely used in enterprise applications to handle SOAP messages. The flaw allows attackers to manipulate the target URL, enabling remote code execution (RCE) by redirecting SOAP requests to unintended destinations, such as local files or other protocols. Despite the severity and broad impact, Microsoft has reportedly declined to issue a fix, leaving numerous vendor and in-house solutions potentially exposed to exploitation. The vulnerability has been demonstrated against several high-profile products, including Barracuda Service Center RMM (patched as CVE-2025-34392), Ivanti Endpoint Manager, Umbraco 8 CMS, Microsoft PowerShell, and Microsoft SQL Server Integration Services. Researchers warn that the list of affected products is likely much larger due to the prevalence of the vulnerable class in .NET-based codebases. The issue was presented at Black Hat Europe 2025, and while some vendors have issued patches, many applications remain at risk due to the underlying framework flaw and Microsoft's decision not to address it directly.
Jun 29, 2026
**CVE-2025-26399** is a **critical insecure deserialization** flaw (CWE-502) in *SolarWinds Web Help Desk* that enables **unauthenticated remote code execution/command execution** over the network. The issue resides in the product’s **`AjaxProxy`** component, where untrusted serialized data can be processed without sufficient validation, allowing an attacker to deliver a crafted payload that results in arbitrary command execution on the host running the help desk application. Multiple reports indicate the vulnerability is **actively exploited in the wild**, prompting **CISA** to add CVE-2025-26399 to the **Known Exploited Vulnerabilities (KEV)** catalog. NetSPI notes the flaw was disclosed in 2025 and is described as a **patch bypass** related to earlier issues (**CVE-2024-28988** and **CVE-2024-28986**), and recommends immediate remediation by upgrading to **SolarWinds Web Help Desk 12.8.7 Hotfix 1 or later**; if patching is delayed, organizations should restrict network exposure of the server and increase monitoring for suspicious process execution and outbound connections.
Jun 29, 2026