Command Injection

2026-08-068 minCanadian Centre for Cyber Securityhigh

The Canadian Centre for Cyber Security published two advisories on 2026-08-06. The first covers Zyxel ZLD firewall path traversal and AP/Security Router command injection and improper authentication vulnerabilities across multiple product lines. The second addresses 10 CVEs in Progress MarkLogic Server requiring updates to versions 11.3.6 or 12.0.3. No specific IOCs or threat actor attribution are provided; both advisories are patch-focused.

2026-07-1710 minPalo Alto Networkscritical

A chained exploit comprising three zero-day vulnerabilities in Siemens ROX II OT switches allows an attacker to escalate from arbitrary file disclosure to full persistent root-level access. CVE-2025-40948 leverages a root-privileged xz utility to read any file on the filesystem, CVE-2025-40947 exploits unsanitized input in the feature key signature verification to achieve command injection as root, and CVE-2025-40949 enables persistent code execution by injecting commands into the root cron table via the web management task scheduler. Siemens has released firmware V2.17.1 to address all three vulnerabilities.

2026-07-158 minMandianthigh

Mandiant identifies publicly exposed serverless applications lacking authentication as a significant risk during security assessments. Attackers can exploit Local File Inclusion (LFI) or command injection vulnerabilities in custom code to read sensitive files, extract hardcoded secrets, and retrieve GCP service account bearer tokens from the metadata service. Stolen tokens enable lateral movement and potential full cloud project compromise, especially when Cloud Run services use over-privileged default service accounts. The blog provides hardening guidance including least-privilege IAM, Cloud Armor WAF policies, VPC Service Controls, and Secure SDLC practices.

CVE-2026-8037 is a pre-authentication Remote Code Execution vulnerability in Progress Kemp LoadMaster caused by an uninitialized heap buffer and missing null terminator in the escape_quotes() function. When the API is enabled, an unauthenticated attacker can send a crafted POST request to /accessv2 with JSON key/value pairs that spray command injection payloads onto the heap, then use single-quote expansion in the apiuser field to overwrite adjacent allocator metadata, causing the unescaped payload to be read and executed via system().

Within five days of exposing an Ivanti Sentry management surface to the internet, a controlled sensor recorded ten distinct operators attempting to exploit CVE-2026-10520, the CVSS 10.0 pre-authentication command-injection flaw that CISA had added to its Known Exploited Vulnerab…

2026-06-104 minCERT-EUcritical

Ivanti has disclosed two critical vulnerabilities in its Sentry products, including an OS command injection flaw (CVE-2026-10520) and an authentication bypass vulnerability (CVE-2026-10523). These vulnerabilities allow remote, unauthenticated attackers to achieve root-level remote code execution and create arbitrary administrative accounts on affected devices.

Ivanti Sentry is affected by a critical pre-authenticated OS command injection vulnerability (CVE-2026-10520) and an authentication bypass vulnerability (CVE-2026-10523). The command injection flaw allows unauthenticated attackers to achieve root-level remote code execution by sending specially crafted XML payloads to the /mics/api/v2/sentry/mics-config/handleMessage endpoint.

CVE-2026-3102 is a critical command injection vulnerability in ExifTool versions 13.49 and earlier on macOS. By embedding a malicious payload in an image's metadata and forcing ExifTool to copy it to the FileCreateDate tag using specific flags, an attacker can execute arbitrary shell commands with the privileges of the invoking user.

2026-05-194 minCisco Taloshigh

Cisco Talos disclosed a series of vulnerabilities affecting TP-Link routers, Adobe Photoshop, OpenVPN, and Norton VPN. Notably, a privilege escalation flaw in Norton VPN (CVE-2025-58074) was exploited in the wild before a patch was available, while the TP-Link flaws allow for remote code execution via command injection and buffer overflows.

2026-05-134 minAkamaihigh

Akamai has disclosed CVE-2026-34354, a local privilege escalation vulnerability in the Guardicore Platform Agent and Zero Trust Client for macOS and Linux. The vulnerability leverages an unauthenticated IPC socket and a TOCTOU flaw to make root-owned files world-writable, alongside a secondary command injection vector in a diagnostic tool.

2026-05-136 minTrail of Bitshigh

The article details two C/C++ security vulnerabilities based on code challenges. The first is a Linux command injection flaw caused by the inetntoa function's global buffer reuse and inetaton accepting trailing garbage. The second is a Windows driver Local Privilege Escalation (LPE) vulnerability stemming from missing RTLQUERYREGISTRYTYPECHECK flags during RtlQueryRegistryValues API calls. This omission allows attackers to leverage registry type confusion (e.g., using REGBINARY or REGSZ instead of REGDWORD) to overwrite kernel stack memory via writable keys in trusted system hives.

2026-05-135 minAkamaihigh

Threat actors are actively exploiting CVE-2025-29635, a command injection vulnerability in end-of-life D-Link DIR-823X routers, to deploy a Mirai botnet variant. The campaign utilizes malicious HTTP POST requests to download and execute shell scripts that fetch the final Mirai payload, while also targeting vulnerabilities in TP-Link and ZTE devices.

2026-05-136 minPalo Alto Networkshigh

Unit 42 observed active, automated exploitation attempts targeting CVE-2023-33538, a command injection vulnerability in end-of-life TP-Link routers, to deploy Mirai-like botnet malware. While the observed in-the-wild attacks were flawed and failed, technical analysis confirmed the vulnerability is exploitable if attackers authenticate using default credentials, allowing them to inject shell commands via the ssid1 parameter.

2026-05-133 minCanadian Centre for Cyber Securitycritical

A critical pre-authentication remote code execution vulnerability (CVE-2026-1731) in BeyondTrust Remote Support and Privileged Remote Access is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute arbitrary OS commands, necessitating immediate patching or isolation of self-hosted instances.