Loading story…
A publicly disclosed vulnerability chain in Stimulsoft Server 2026.3.1 allows an unauthenticated attacker to achieve remote code execution as NT AUTHORITY\SYSTEM under the product’s default configuration. According to the advisory, the exposed /1/signup endpoint can grant an anonymous user a Supervisor account when email activation is disabled, creating an initial privilege path without valid credentials, SMTP access, or administrator involvement.
After obtaining Supervisor access, an attacker can upload a malicious .mrt report template containing embedded C# code and trigger it through /1/reporttemplates/<id>/run. The report engine is said to compile and execute the attacker-controlled script in full trust via CSharpCodeProvider, without sandboxing or isolation, causing code to run inside Stimulsoft.Server.Agent.exe with SYSTEM privileges and enabling full host compromise. The issue and proof of concept were published by the 0day Rubbish Research Team and later circulated through Full Disclosure.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The Stimulsoft Server RCE advisory was distributed through the Full Disclosure mailing list, extending public dissemination of the vulnerability details. The mailing list post described the issue as a pre-authentication SYSTEM-level RCE affecting version 2026.3.1.
The 0day Rubbish Research Team publicly disclosed a pre-authentication remote code execution vulnerability in Stimulsoft Server 2026.3.1 that can lead to NT AUTHORITY\SYSTEM code execution under default configuration. The advisory included a proof of concept and full technical analysis describing the signup-to-report-script exploit chain.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open source0day-rubbish.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Public advisories disclosed multiple critical vulnerabilities in **CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0**, including a JWT forgery flaw that enables authentication bypass across .NET Core microservices. The issue stems from fail-open JWT validation, allowing attackers to submit forged `alg=none` tokens with arbitrary role claims and gain authenticated access without valid credentials. Researchers said the weakness affects every microservice that trusts the shared identity model, creating broad exposure across the platform. The same research also detailed a **pre-authentication remote code execution chain** that can lead to command execution as `NT AUTHORITY\SYSTEM`. The chain combines the JWT bypass with a path-traversal write to a malicious events configuration and an engine restart to trigger attacker-controlled commands. The advisory said the RCE path requires reachability to **PSSAdministrator** on port `8089`; if that service is restricted to loopback with no forwarding path, a fully remote unauthenticated attacker cannot complete exploitation. Proof-of-concept code and full technical analysis were released publicly by the **0day Rubbish Research Team**.
Aug 6, 2026
Researchers disclosed a **pre-authentication remote code execution** chain affecting **SysAid On-Premise**, showing that unauthenticated attackers could reach code execution through the product’s support ticket-related functionality. The issue was publicly described by WatchTowr Labs and Summoning Team under the title **“SysOwned, Your Friendly Support Ticket,”** with **`CVE-2025-2775`** identified as a key part of the exploit chain alongside additional related flaws. The reports indicate the vulnerability chain can be triggered **without prior authentication**, making internet-exposed SysAid On-Premise deployments a high-risk target because attackers may be able to compromise servers directly through the application. Public disclosure by multiple security researchers increases the likelihood of defender scrutiny and attacker interest, particularly for organizations relying on on-premises help desk infrastructure.
Aug 1, 2026
A critical **pre-authentication remote code execution** vulnerability has been publicly disclosed in **Vicon Valerus ViconNet Gateway** version `25.200.46.0`. The flaw affects the ASP.NET Web API endpoint `POST /NVR/api/v1/upgrades/multiformat-file-Execute/start`, where attacker-controlled input is concatenated into `cmd.exe /c` and launched through `Process.Start`, allowing arbitrary command execution. Researchers said the endpoint is reachable without authentication and bypasses an authorization gate, enabling remote attackers with network access to ports `8084` or `8444` to execute code as **`NT AUTHORITY\SYSTEM`**. The advisory warns that successful exploitation can result in full compromise of the video management host, including access to recorded footage, camera credentials, and VMS configuration, as well as the ability to alter surveillance operations or destroy evidence. The issue was disclosed by the **0day Rubbish Research Team**, which published both an advisory and a proof of concept, increasing the likelihood of near-term exploitation against exposed systems.
Aug 6, 2026