Loading story…
elttam disclosed an attacker-controlled format-string vulnerability in the tac_plus TACACS+ daemon, affecting the Facebook fork F4.0.4.28-7fb and the Shrubbery code tree. A crafted AUTHEN/START request can inject data into session.port; a malformed continuation can then cause send_authen_error() to pass the attacker-influenced buffer directly to report() as a format string. The researchers demonstrated code execution on an unhardened 32-bit build by overwriting the Global Offset Table entry for free(), while warning that modern exploit mitigations raise the bar but do not eliminate the underlying vulnerability.
The attack can be conducted before authentication and is strengthened by a TCP/49 shared-secret oracle: predictable error responses allow offline guessing of weak TACACS+ pre-shared secrets without intercepted traffic or valid credentials. After recovering the secret, an attacker can generate an obfuscated exploit packet; a trusted TACACS+ client that relays attacker-controlled values could also be abused. Organizations using affected tac_plus deployments should identify exposed TCP/49 services, apply vendor fixes or mitigations, restrict TACACS+ access to trusted management networks, and rotate weak shared secrets.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The research disclosed that a truncated AUTHEN/START request causes a predictable, shared-secret-obfuscated error response, enabling reachable TCP/49 attackers to verify shared-secret guesses offline. It demonstrated recovery of the weak secret "supersecret" with a rockyou.txt-style wordlist, allowing construction of obfuscated exploit packets.
elttam published research describing an unauthenticated format-string vulnerability in tac_plus, principally affecting the Facebook F4.0.4.28-7fb fork and the Shrubbery tree. The research shows that a malicious TACACS+ AUTHEN/START port field and malformed continuation can trigger a pre-authentication memory-write primitive and demonstrates code execution in an unhardened 32-bit environment.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability tracked as **CVE-2026-32746** was disclosed in **GNU InetUtils `telnetd`** affecting version **2.7 and earlier**, enabling **pre-authentication remote code execution** through a buffer overflow in the **LINEMODE SLC handler**. The flaw stems from a missing bounds check in the `add_slc` function, which can trigger an out-of-bounds memory write during the Telnet handshake before the login prompt is shown. Security reporting said a remote unauthenticated attacker could exploit the bug to execute code as **root**, resulting in full system compromise. The issue was rated **CVSS 9.8** and public proof-of-concept exploit code was reported as available, increasing the likelihood of exploitation against exposed Telnet services. Advisories urged organizations to treat internet-accessible `telnetd` instances as high risk and apply mitigations until patches are available, including restricting access to trusted IP addresses, blocking **TCP port 23**, or disabling Telnet entirely where it is not operationally required.
Jul 24, 2026
Cisco disclosed and patched **CVE-2026-20182**, a critical `CVSS 10.0` authentication bypass flaw in **Cisco Catalyst SD-WAN Controller** and **Cisco Catalyst SD-WAN Manager** that has been exploited in the wild. The bug affects the `vdaemon` control-plane service over **DTLS/UDP 12346** and allows an unauthenticated attacker to impersonate a trusted peer, gain high-privilege administrative access, reach **NETCONF** on `TCP/830`, and manipulate SD-WAN fabric configuration. Rapid7 said the flaw stems from missing authentication checks when a peer claims to be a vHub device, enabling attackers to inject SSH keys for the `vmanage-admin` account and establish persistent access; Cisco said there are **no workarounds** and released fixed software versions for affected on-premises, cloud, managed-cloud, and FedRAMP deployments. Cisco Talos attributed the most sophisticated exploitation of `CVE-2026-20182` with high confidence to **UAT-8616**, which was observed adding SSH keys, modifying NETCONF settings, and escalating privileges to root, with infrastructure overlap noted with Operational Relay Box networks. Talos also reported broader ongoing attacks against SD-WAN environments, including widespread exploitation of previously disclosed **CVE-2026-20133**, **CVE-2026-20128**, and **CVE-2026-20122** after public proof-of-concept release, leading to deployment of JSP webshells such as **XenShell**, **Godzilla**, and **Behinder**, along with tools including Sliver, AdaptixC2, XMRig, gsocket, and credential-stealing scripts. **CISA added CVE-2026-20182 to the KEV catalog** and ordered federal agencies to remediate quickly, while Cisco and national cyber agencies urged organizations to preserve forensic evidence, review logs for unauthorized peering and `vmanage-admin` public-key logins, and patch all vulnerable control components immediately.
Aug 31, 2026
A vulnerability in the TACACS+ protocol implementation in Cisco IOS and IOS XE Software allows unauthenticated, remote attackers to view sensitive data or bypass authentication. The flaw arises from improper verification of the required TACACS+ shared secret, enabling attackers to intercept unencrypted TACACS+ messages or impersonate the TACACS+ server to accept arbitrary authentication requests. Successful exploitation could result in unauthorized access to affected devices or exposure of sensitive information. Cisco has released software updates and workarounds to address this issue.
Jun 29, 2026