Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate.
Audit log injection in Apache ZooKeeper 3.9.0–3.9.5 and 3.8.0–3.8.6 allows attackers to forge entries in zookeeper_audit.log when audit logging is enabled. An unauthenticated attacker can embed tab characters in a digest authentication username to inject arbitrary tab-separated key=value fields, and a client permitted to call setACL can embed tabs in a digest ACL id to make a successful setAcl event appear to record forged operations such as operation=delete and znode=/forged. The vulnerability corrupts forensic evidence and can defeat SIEM alerting, but does not permit direct modification of ZooKeeper data; no public exploit code or CISA KEV listing was identified at time of analysis, and vendor-released fixes exist in 3.9.6 and 3.8.7.
Let me synthesize the analysis for CVE-2026-79993. Key facts: - Apache ZooKeeper deleteContainer opcode (0x14/20) processed without ACL check. - Affected: 3.9.0-3.9.5, 3.8.0-3.8.6. - Fixed in 3.9.6 and 3.8.7. - Any client with plain TCP session on client port 2181, no auth, no ACL permissions, can delete any empty persistent znode (regular persistent, container, TTL nodes). - Skips session check and DELETE ACL check. - Authorization bypass / ACL enforcement bug (CWE-862 Missing Authorization presumably, or CWE-863 Incorrect Authorization). - No CVSS provided, no EPSS, no KEV, no POC. - Credit given. Let me construct fields. Product name: "Apache ZooKeeper" Summary: original synthesis. Start with impact verb + product. "Unauthorized deletion of znodes in Apache ZooKeeper 3.8.x and 3.9.x..." Technical context: ZooKeeper coordination kernel, znodes, ACLs, opcodes, container nodes, TTL nodes. CWE-862/CWE-863. The deleteContainer opcode is internal-only, used by servers to remove container nodes when they become empty. The regular DELETE path (opcode 2) enforces session check and ACL. deleteContainer path skips both. Note: description says "allowing any authenticated client" but then says "with NO authentication and NO ACL permissions". Conflicting. Actually the description contradicts itself: "allowing any authenticated client" vs "with NO authentication". Hmm. The plain TCP session means anyone with network access to port 2181 — no authentication needed. So PR:N effectively. But wait—can they delete any znode? The check is on empty persistent znodes. Actually the description says deleteContainer can delete "any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes)". So condition: znode must be empty (no children). Actually deleteContainer opcode normally deletes container nodes; here it can delete any empty persistent znode. So prerequisite: target znode must have zero children. CVSS assessment: AV:N, AC:L, PR:N (no auth n
Apache ZooKeeper quorum TLS peers running in FIPS mode can skip hostname verification, so a certificate whose SAN does not match the connected host is still accepted, letting a rogue peer join quorum traffic, participate in leader election, and enter replication flows. The flaw affects org.apache.zookeeper:zookeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5, but only in deployments where sslQuorum=true, zookeeper.fips-mode=true, and both ssl.quorum.hostnameVerification and ssl.quorum.clientHostnameVerification are enabled. Exploitation additionally requires the attacker to hold a certificate issued by a CA the cluster already trusts, making this a misissuance or CA-compromise scenario rather than a generic remote attack; no public exploit code or CISA KEV entry was identified at time of analysis, and fixes are released in 3.8.7 and 3.9.6.
Path-name disclosure in Apache ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 lets a connected client learn the names of ACL-restricted znodes by registering exists-watches on paths that do not yet exist and then reconnecting after those paths are created under restrictive ACLs. The reconnect replay handler DataTree.setWatches() delivers the watch notification with a null ACL, bypassing the ACL check that was added to WatchManager.triggerWatch() as the fix for CVE-2024-23944 (ZOOKEEPER-4799), making this an incomplete-fix bypass. Only the znode path string is exposed, not znode data, but because paths frequently embed usernames, login IDs, or tenant identifiers, Apache and the reporter rate it critical; no public exploit code or confirmed active exploitation was identified at time of analysis.
IBM Verify Identity Access containers may not apply management password change operations correctly.
IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services.
IBM Verify Identity Access is vulnerable to a buffer overflow attack.
IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.
Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156.
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156.
Incorrect boundary conditions in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 156.
Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156.
Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156.
Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Sandbox escape due to incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156.
Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156.
Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156.
Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156.
Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3.
Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3.
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3.