Loading story…
Okta released fixes for three vulnerabilities affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. The most severe, CVE-2026-85982 (CVSS 9.0), is a stored cross-site scripting flaw in the Auth0 connector administrative panel that could allow actions through an administrator’s authenticated browser session. CVE-2026-78626 (CVSS 8.1) can bypass authorization controls in Access Gateway Protected Rules, while CVE-2026-78623 (CVSS 7.7) enables SQL injection through advanced-mode datastores.
Exploitation requires particular authenticated access and configurations, but could result in administrator-session abuse, unauthorized access to protected resources, or unintended commands against backend databases. Organizations should upgrade the Auth0 AD/LDAP Connector to version 8.0.0 or later and Okta Access Gateway to 2026.9.1 or later, then review Protected Rules policies, advanced datastore queries, directory permissions, logs, and unexpected attribute changes for evidence of misuse.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Okta disclosed and released fixes for CVE-2026-85982, a CVSS 9.0 stored XSS flaw in the Auth0 AD/LDAP Connector, and CVE-2026-78626 and CVE-2026-78623, authorization-bypass and SQL-injection flaws in Okta Access Gateway. The XSS issue was remediated in auth0/ad-ldap-connector 8.0.0 or later, while both Access Gateway issues were fixed in version 2026.9.1 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SuiteCRM disclosed **CVE-2026-29189**, a high-severity insecure direct object reference (`IDOR`) flaw in its REST API V8 caused by missing ACL checks on user preferences and relationship endpoints. In versions before **7.15.1** and **8.9.3**, authenticated users could access or modify data beyond their assigned permissions, creating high confidentiality and integrity risk in deployments of the open-source CRM platform. The issue is tracked as **CWE-639** and carries a CVSS v3.1 rating reflecting low attack complexity and no user interaction requirement. Auth0 also patched **CVE-2026-34236** in the **Auth0-PHP SDK**, where insufficient entropy in cookie encryption allowed attackers to potentially brute-force encryption keys and forge session cookies. The flaw affects versions **8.0.0 through before 8.19.0** and is classified as **CWE-331**, with significant confidentiality and integrity impact for applications relying on the SDK for authentication. Auth0 fixed the issue in **8.19.0**, while SuiteCRM remediated its API authorization weakness in **7.15.1** and **8.9.3**.
Jun 29, 2026
A high-severity vulnerability tracked as **`CVE-2026-33120`** was disclosed in Microsoft SQL Server, where an untrusted pointer dereference can allow **remote code execution** by an authenticated attacker with low privileges. The flaw is rated **CVSS 8.8** and can be exploited over the network without user interaction, with potential impact across confidentiality, integrity, and availability. Successful exploitation could lead to **system-level compromise** of the database server, enabling database theft, credential dumping, lateral movement, and possible tenant-isolation escape in shared or multi-tenant deployments. A separate disclosure, **`CVE-2026-40155`**, affects the **Auth0 Next.js SDK** and stems from a race condition in the DPoP proxy fetcher that can expose one user’s session identifiers, access tokens, or API response data to another concurrent authenticated user. The issue is rated **CVSS 5.4** and is considered harder to exploit because it depends on precise timing, DPoP challenges, and concurrent requests reaching the application tier. Its impact is focused on **data confidentiality**, with low integrity impact, no availability impact, a low EPSS score, and no listing in CISA’s Known Exploited Vulnerabilities catalog.
Jun 29, 2026
Multiple vendors issued fixes for **high-impact vulnerabilities** that could enable privilege escalation, tenant-wide compromise, security feature bypass, or remote code execution. OpenStack patched **CVE-2026-22797** in *keystonemiddleware* affecting deployments using `external_oauth2_token`, where failure to sanitize incoming identity headers allows authenticated users to forge headers (e.g., `X-Is-Admin-Project`, `X-Roles`, `X-User-Id`) to **escalate privileges or impersonate other users**; fixes were released across supported branches and the issue was reported by a Red Hat researcher. Microsoft patched **CVE-2026-20965** in *Windows Admin Center*’s Azure SSO (fixed in Azure Extension **v0.70.00**), where improper token validation could let an attacker with local admin on a WAC-enabled Azure VM/Arc machine combine a stolen `WAC.CheckAccess` token with a forged PoP token to enable **lateral movement and tenant-wide access** under certain conditions. Separately, Microsoft addressed **CVE-2026-20824** in *Windows Remote Assistance*, an **Important** security feature bypass that can allow attackers to evade **Mark of the Web (MOTW)** protections via social engineering. Progress Software also released patches for **CVE-2025-13444** and **CVE-2025-13447** (CVSS 8.4) affecting *LoadMaster* and *MOVEit WAF*, where crafted UI/API requests can trigger **command injection leading to remote code execution**; the vendor stated it had no evidence of in-the-wild exploitation at the time of release.
Jun 29, 2026