Loading story…
Tenable fixed CVE-2026-18667, a critical remote code execution flaw in Sensor Proxy on Linux that affects version 1.4.1 and earlier. The vulnerability is classified as CWE-94 and can allow arbitrary code execution with elevated privileges if an operator is tricked into connecting the sensor to an attacker-controlled host.
Severity details published for the flaw show broad impact to confidentiality, integrity, and availability, with a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Italy's ACN/CSIRT also warned that a remote attacker could exploit the issue on affected systems and advised organizations to apply the vendor's update, with Sensor Proxy 1.4.2 identified as the fixed release.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Tenable reported that CVE-2026-18667 was newly received by vulnreport@tenable.com. The flaw affects Sensor Proxy on Linux and can lead to remote code execution with elevated privileges if an operator connects the sensor to an attacker-controlled host.
A critical remote code execution vulnerability affecting Tenable Sensor Proxy 1.4.1 and earlier was resolved in version 1.4.2. Guidance from the vendor and ACN recommends updating according to Tenable's security bulletin.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
csirt.bj
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourceacn.gov.it
Open sourcecvefeed.io
Open sourcetenable.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tenable disclosed a critical path traversal vulnerability, tracked as **`CVE-2026-15265`**, affecting **Tenable/Nessus Agent** on **Linux, Windows, and macOS**. The flaw allows a privileged attacker to write arbitrary files outside the intended plugin directory, creating a path to **remote code execution**. The issue affects **version 11.2.0** and **11.1.3 and earlier**, and has been classified under **`CWE-22`** and **`CWE-347`** with high impact to confidentiality, integrity, and availability. Tenable released fixes in **versions 11.2.1 and 11.1.4**, and the **Canadian Centre for Cyber Security** issued advisory **AV26-705** urging organizations to review Tenable’s guidance and apply updates. CISA enrichment cited in vulnerability tracking data indicates **no known exploitation** so far, but assessed the technical impact as total, reinforcing the need for rapid patching across exposed agent deployments.
Jul 16, 2026
A critical vulnerability tracked as **CVE-2026-1961** was disclosed in Foreman’s WebSocket proxy, where unsanitized hostname values in `lib/ws_proxy.rb` are used to build shell commands. A malicious compute resource provider—such as a fake VMware vSphere or Libvirt endpoint—can exploit the flaw to trigger **remote code execution** on the Foreman server when an administrator opens a VM console. The issue affects **Foreman 3.17.0 and earlier** and likely older releases because the vulnerable code path reportedly remained unchanged since 2020. Successful exploitation can execute code as the `foreman` user, creating a path to steal database credentials and encryption keys and potentially decrypt stored infrastructure secrets for wider compromise of managed environments. The proposed fix replaces shell-interpreted command construction with safer handling using `Shellwords.escape`, array-based arguments, and `Open3.popen3`, while Red Hat said the issue was addressed in **Red Hat Satellite 6.17 for RHEL 9** and **Red Hat Satellite 6.16 for RHEL 8 and RHEL 9** through advisories `RHSA-2026:5970` and `RHSA-2026:5971`.
Aug 20, 2026
BeyondTrust disclosed and fixed **CVE-2026-1731**, a critical unauthenticated remote code execution flaw affecting **Remote Support 25.3.1 and earlier** and **Privileged Remote Access 24.3.4 and earlier**. The vulnerability allows a remote attacker to send crafted client requests and execute system commands on the target appliance as the **site user**, creating a path to full system compromise, data theft, and service disruption. CSIRT.SK reported the issue carries a **CVSS score of 9.9**. BeyondTrust said cloud instances were updated automatically, while organizations running on-premises deployments were told to upgrade to **Remote Support 25.3.2** and **Privileged Remote Access 25.1.1**, or apply the vendor patches **`BT26-02-RS`** and **`BT26-02-PRA`**. The advisory identifies the flaw as a high-priority risk for enterprises using BeyondTrust remote access and support platforms because exploitation requires no authentication and can result in command execution on exposed systems.
Jul 24, 2026