Loading story…
A critical vulnerability tracked as CVE-2026-1961 was disclosed in Foreman’s WebSocket proxy, where unsanitized hostname values in lib/ws_proxy.rb are used to build shell commands. A malicious compute resource provider—such as a fake VMware vSphere or Libvirt endpoint—can exploit the flaw to trigger remote code execution on the Foreman server when an administrator opens a VM console. The issue affects Foreman 3.17.0 and earlier and likely older releases because the vulnerable code path reportedly remained unchanged since 2020.
Successful exploitation can execute code as the foreman user, creating a path to steal database credentials and encryption keys and potentially decrypt stored infrastructure secrets for wider compromise of managed environments. The proposed fix replaces shell-interpreted command construction with safer handling using Shellwords.escape, array-based arguments, and Open3.popen3, while Red Hat said the issue was addressed in Red Hat Satellite 6.17 for RHEL 9 and Red Hat Satellite 6.16 for RHEL 8 and RHEL 9 through advisories RHSA-2026:5970 and RHSA-2026:5971.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The vulnerable ws_proxy.rb code in Foreman was reported as likely having remained unchanged since 2020, indicating the command injection issue may have affected multiple older versions in addition to 3.17.0 and earlier.
Red Hat stated the issue was addressed in Red Hat Satellite 6.17 for RHEL 9 and Red Hat Satellite 6.16 for RHEL 8 and RHEL 9. The fixes were linked to advisories RHSA-2026:5970 and RHSA-2026:5971.
Houssam Sahli reported a critical command injection vulnerability in Foreman’s WebSocket proxy implementation that can lead to remote code execution when an administrator opens a VM console connected to a malicious compute resource server. The report included proof-of-concept details and a proposed patch using safer command construction and execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Foreman disclosed and fixed **CVE-2026-1961**, a high-severity remote code execution flaw in its WebSocket proxy caused by command injection. The vulnerability arises because Foreman builds shell commands using unsanitized hostname values supplied by compute resource providers such as **VMware vSphere** and **Libvirt**. A malicious or attacker-controlled compute resource server can exploit the flaw when an administrator accesses a VM **VNC console**, allowing code execution on the Foreman server in a normal management workflow. The issue affects Foreman versions up to and including **3.18.0** and carries a **CVSS v3.1 score of 8.0** with the vector `AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`. Foreman said successful exploitation could expose sensitive credentials and potentially compromise managed infrastructure. Patches were released in **3.18.1**, **3.17.2**, and **3.16.3**, and the vulnerability was credited to **Houssam Sahli**.
Jun 29, 2026
A critical **VMware vCenter** directory traversal flaw, tracked as `CVE-2026-59310`, is being actively exploited to achieve unauthenticated remote code execution through the vCenter Syslog Server component. Broadcom disclosed the issue and released emergency patches, warning that any attacker with network access to a vulnerable system could run arbitrary code. No workaround was provided, leaving patching and exposure reduction as the primary defenses for affected vCenter deployments. Incident responders at QUIRSO reported exploitation beginning shortly after disclosure and said attackers are deploying the open-source **`reverse_ssh`** tool to establish outbound command-and-control channels and maintain persistence. The firm counted **361 victim IP addresses across 47 countries** within days, while administrators on r/sysadmin amplified warnings to patch immediately and noted that internet-exposed or poorly isolated vCenter instances remain especially vulnerable. QUIRSO said the activity may be linked to an APT actor, though it has not publicly released supporting evidence and is coordinating indicators with law enforcement.
Aug 19, 2026
Tenable fixed **CVE-2026-18667**, a critical remote code execution flaw in **Sensor Proxy** on Linux that affects version **1.4.1 and earlier**. The vulnerability is classified as **CWE-94** and can allow arbitrary code execution with elevated privileges if an operator is tricked into connecting the sensor to an attacker-controlled host. Severity details published for the flaw show broad impact to **confidentiality, integrity, and availability**, with a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`. Italy's ACN/CSIRT also warned that a remote attacker could exploit the issue on affected systems and advised organizations to apply the vendor's update, with **Sensor Proxy 1.4.2** identified as the fixed release.
Aug 16, 2026