Loading story…
Public advisories disclosed multiple critical vulnerabilities in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0, including a JWT forgery flaw that enables authentication bypass across .NET Core microservices. The issue stems from fail-open JWT validation, allowing attackers to submit forged alg=none tokens with arbitrary role claims and gain authenticated access without valid credentials. Researchers said the weakness affects every microservice that trusts the shared identity model, creating broad exposure across the platform.
The same research also detailed a pre-authentication remote code execution chain that can lead to command execution as NT AUTHORITY\SYSTEM. The chain combines the JWT bypass with a path-traversal write to a malicious events configuration and an engine restart to trigger attacker-controlled commands. The advisory said the RCE path requires reachability to PSSAdministrator on port 8089; if that service is restricted to loopback with no forwarding path, a fully remote unauthenticated attacker cannot complete exploitation. Proof-of-concept code and full technical analysis were released publicly by the 0day Rubbish Research Team.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A Full Disclosure post publicly disclosed the two CIRCUTOR PowerStudio vulnerabilities and noted that proof-of-concept code and full technical analysis had been released, including a GitHub repository. The repost highlighted the JWT forgery flaw and the pre-authentication SYSTEM RCE chain.
0day Rubbish also published an advisory for a pre-authentication remote code execution chain in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0. The chain combines the JWT bypass, a path-traversal write to a malicious events configuration, and an engine restart to achieve command execution as NT AUTHORITY\SYSTEM.
On 0day Rubbish published an advisory describing a JWT alg=none identity forgery and authentication bypass affecting CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0, with impact across the product's .NET Core microservices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open source0day-rubbish.com
Open source0day-rubbish.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Siemens disclosed **CVE-2026-56451**, a critical authentication-bypass vulnerability in **Opcenter X** caused by improper validation of the algorithm specified in a JSON Web Token (**JWT**) header. The flaw affects **all versions earlier than `V2604`** and allows an **unauthenticated remote attacker** to forge arbitrary JWTs, bypass authentication, impersonate any user including administrators, and potentially obtain full unauthorized access to the application. The issue is classified as **CWE-347** and was assigned a **CVSS v3.1 vector** of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with reporting indicating a **maximum severity score of 10.0** under both CVSS 3.1 and 4.0. Siemens identified **`V2604`** as the remediation release through its ProductCERT advisory, and no active exploitation was reported at disclosure, although the attack class is considered highly exploitable because JWT algorithm confusion techniques are well known and broadly tooled.
Jul 16, 2026
**CISA** published an ICS advisory warning that **Johnson Controls Frick Controls Quantum HD** (versions **10.22 and earlier**) contains multiple vulnerabilities that can be exploited **before authentication**, enabling **remote code execution (RCE)**, **information leakage**, and potentially **denial of service** in environments where the product is deployed (noted as worldwide, including **Food and Agriculture** critical infrastructure). CISA lists a **CVSS v3.1 base score of 9.1 (Critical)** for the issue set and attributes the root cause across several items to **insufficient input validation** in device parameters. The disclosed CVEs include **CVE-2026-21654** (**OS command injection**, CWE-78) and several **code injection** RCE issues (**CVE-2026-21656**, **CVE-2026-21657**, **CVE-2026-21658**, **CWE-94**) that could allow unexpected actions and system compromise without credentials. **CVE-2026-21659** describes **local file inclusion (LFI)** (CWE-23) leading to **unauthenticated RCE and information disclosure**, explicitly stating an attacker could execute arbitrary code and achieve **full system compromise** on affected devices. The advisory also references an additional CVE (**CVE-2026-21660**) not detailed in the other provided entries, indicating the exposure spans more than the five CVE records included here.
Jun 29, 2026
A **maximum-severity authentication bypass** was disclosed in *pac4j*’s JWT component (*pac4j-jwt*), tracked as **CVE-2026-29000**, affecting a widely used Java security engine embedded across many downstream software packages. The issue is a **logic flaw** that enables attackers to bypass authentication controls by crafting tokens/claims in a way that defeats expected verification, raising concern because exploitation can be relatively straightforward and the library’s transitive use complicates exposure tracking and patch rollout across dependent applications. Public **proof-of-concept (PoC)** code is available, and reporting indicates an attacker who can obtain a target server’s **RSA public key** (often publicly accessible) can forge a **JWE-wrapped PlainJWT** containing arbitrary `sub` and role claims to bypass signature verification and authenticate as any user, including administrators. The pac4j maintainer disclosed the defect and released patched versions shortly after private reporting; while there were no confirmed in-the-wild exploits at the time of reporting, defenders should expect downstream vendors and application owners to issue their own advisories and updates as they assess inherited risk from bundled pac4j versions.
Jun 29, 2026