Loading story…
A critical authentication bypass vulnerability (CVE-2025-10159) has been identified in Sophos AP6 Series Wireless Access Points running firmware older than version 1.7.2563 (MR7). This flaw allows remote attackers to gain administrative privileges without authentication. Sophos has released a security advisory and recommends immediate firmware updates to mitigate the risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WatchGuard disclosed three vulnerabilities affecting WatchGuard AP firmware versions `1.0` through `3.4.7`, including two critical unauthenticated flaws: `CVE-2026-86102` and `CVE-2026-101891`. Both carry a CVSS v4 score of 9.3 and can allow a network-based attacker to bypass authentication or execute arbitrary operating-system commands through exposed internal API functionality. A third issue, `CVE-2026-87969` (CVSS 8.6), enables authenticated administrators to inject and execute OS commands through crafted diagnostic command-line input. WatchGuard fixed all three vulnerabilities in firmware version `3.4.8`. The company reported no known in-the-wild exploitation or public proof of concept at disclosure, but the unauthenticated network-reachable attack paths make unpatched APs high-risk. Organizations should immediately upgrade affected devices, restrict AP management and API interfaces to trusted administrative networks, and review logs and administrator credentials for signs of unauthorized access.
Sep 29, 2026
A high-severity authenticated command execution flaw in **Hikvision DS-3WAP series wireless access points**, tracked as **CVE-2026-0709** (CVSS **7.2**), was disclosed as stemming from **insufficient input validation** in device firmware. An attacker with valid credentials can send specially crafted packets containing malicious commands to trigger **arbitrary command execution**, enabling device takeover scenarios that can support traffic interception, lateral movement, or disruption of wireless services—particularly if credentials are stolen, default, or obtained via an initial foothold. Hikvision released patched firmware **`V1.1.6601 build 251223`** to address the issue across affected models running **`V1.1.6303 build250812` and earlier**, including **DS-3WAP521-SI, DS-3WAP522-SI, DS-3WAP621E-SI, DS-3WAP622E-SI, DS-3WAP623E-SI**, and (per reporting) **DS-3WAP622G-SI**. Organizations using these access points should prioritize upgrading firmware and reviewing access controls around device administration, as the exploitability hinges on possession of valid credentials and may be used as a second-stage escalation after an initial account compromise.
Jun 29, 2026
HPE released security updates for Aruba Networking AOS-CX to fix multiple vulnerabilities, including **CVE-2026-23813**, a critical flaw in the web management interface that can let a remote, unauthenticated attacker bypass authentication. In some cases, successful exploitation can also reset an administrator password and lead to full system compromise. The issue carries a **CVSS 3.1 score of 9.8** and affects several release trains, including `10.17.0001` and earlier, `10.16.1020` and earlier, `10.13.1160` and earlier, and `10.10.1170` and earlier. HPE advised customers to upgrade to fixed AOS-CX versions as soon as possible and published mitigation guidance for environments that cannot patch immediately. Recommended steps include restricting access to the management interface, disabling unnecessary HTTP(S) exposure on SVIs and routed ports, applying Control Plane ACLs for REST and HTTP management traffic, and enabling logging and continuous monitoring to detect exploitation attempts against Aruba CX switches.
Jul 24, 2026