Loading story…
A high-severity vulnerability tracked as CVE-2026-69111 allows unauthenticated attackers to disrupt Milvus deployments by sending a crafted HTTP GET request to the management server on port 9091 and invoking the unprotected /management/stop endpoint. By supplying a role parameter, an attacker can terminate proxy, datanode, or querynode components, causing denial of service. Reports say the endpoint bypasses REST API authentication middleware, and affected versions include Milvus through 2.6.22 and 3.0.0, with some reporting indicating exposure across all versions up to v2.6.15 in default standalone Docker deployments where port 9091 is mapped to the host.
Milvus maintainers addressed broader management-plane exposure on port 9091 through a security hardening update that adds optional authentication for /management/*, /log/level, /eventlog, and pprof endpoints using the common.security.adminAuthEnabled setting and HTTP Basic Auth tied to the root account. The changes also redact sensitive configuration values, reduce secret leakage through logs and configuration APIs, and refine error handling so unauthenticated callers do not receive stack traces. A related security report noted that /log/level could also be accessed without authentication, allowing attackers to read or modify log verbosity and potentially increase sensitive data exposure.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-69111 was published for an unauthenticated denial-of-service vulnerability affecting Milvus through versions 2.6.22 and 3.0.0. The record states that the unprotected /management/stop endpoint bypasses REST API authentication middleware and recommends updating beyond 3.0.0 and securing management endpoints.
A Milvus security issue reported that /management/stop on port 9091 remained unauthenticated in v2.6.15 and could be used by any network-reachable attacker to stop proxy, datanode, or querynode components. The report also noted unauthenticated access to /log/level and said default standalone deployments exposed port 9091 to the host.
Milvus merged a security hardening change to add optional HTTP Basic authentication for management-plane endpoints on port 9091, including /management/*, /management/stop, /log/level, /eventlog, and pprof routes. The change introduced the common.security.adminAuthEnabled setting and also improved redaction of sensitive configuration values.
VulnCheck published an advisory describing an unauthenticated denial-of-service flaw in Milvus through 2.6.22 and 3.0.0. The advisory said a crafted HTTP GET request to /management/stop on port 9091 could stop proxy, datanode, or querynode components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed **`CVE-2024-0012`**, a critical authentication-bypass flaw in the **PAN-OS management web interface**, and reports tied the issue to active in-the-wild exploitation against internet-exposed firewall management interfaces. Public reporting and vendor guidance indicate the weakness could enable unauthenticated command execution in affected deployments, while **Prisma Access** and **Cloud NGFW** were not impacted. Affected versions included PAN-OS releases earlier than **10.2.12-h2**, **11.0.6-h1**, **11.1.5-h1**, and **11.2.4-h1**. Palo Alto Networks first urged customers to restrict management-interface exposure and follow hardening guidance for administrative access, then released fixes for affected branches. Incident-response reporting also cited published indicators of compromise, including attacker IP addresses and a **SHA-256** hash for a PHP webshell observed in related activity, underscoring the need to patch exposed devices and review management-plane access controls.
Sep 3, 2026
BMC Control-M deployments are affected by two newly disclosed vulnerabilities that expose `Control-M/Server` and related components to serious remote attacks. **CVE-2026-10539** is a critical unauthenticated command injection flaw in Control-M/Server communication commands that can let a remote attacker execute unauthorized commands and potentially fully compromise a server. The issue affects `Control-M/Server` versions `9.0.20.x` through `9.0.21.200`, and possibly earlier unsupported releases, and is rated `CVSS 4.0 9.5` / `CVSS 3.1 9.0`. A second issue, **CVE-2026-10538**, is a high-severity improper deserialization vulnerability in out-of-support `Control-M/Server` and `Control-M/Enterprise Manager` `9.0.20.x` components, particularly in messaging consumer functionality that processes user-controlled serialized data. An authenticated attacker could remotely trigger unintended server-side behavior through crafted serialized content; the flaw is rated `CVSS 4.0 8.9` / `CVSS 3.1 8.0`. Organizations running affected Control-M versions have been advised to upgrade to supported releases, apply vendor patches, harden deserialization controls, restrict access to exposed services, and monitor for suspicious command execution or messaging activity.
Jul 3, 2026
**CVE-2023-54391** affects Proxmox Virtual Environment 7.0 through 8.0 where `libpve-access-control` is older than 8.0.4. An unauthenticated remote attacker can send an arbitrary `tfa-challenge` value to the API login endpoint and bypass password verification, authenticating as an enabled account that has no second factor configured, potentially including `root@pam`. The flaw is rated critical in impact (CVSS vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) and places exposed management interfaces on TCP port 8006 at risk of full administrative compromise and remote code execution through the platform. Reports alleged active compromises of Internet-exposed, end-of-life Proxmox VE 7 systems; organizations should urgently remove management interfaces from public exposure, upgrade to a fixed supported release, and investigate affected hosts for unauthorized access.
Sep 3, 2026