Monthly
Incorrect authentication-algorithm handling in Progress MOVEit Transfer's SFTP module allows a remote, authenticated low-privilege SFTP user to subvert the module's authentication logic, with assessed high confidentiality, integrity, and availability impact. Affected deployments are MOVEit Transfer before 2025.1.6 and 2026.0.0 through 2026.0.3; vendor-fixed builds are available. No public exploit was identified at time of analysis, and EPSS is low at 0.39% (32nd percentile).
Authentication bypass in F5 NGINX Ingress Controller allows unauthenticated remote attackers to access protected paths when an externalAuth policy delegating to an OAuth identity provider is configured. The flaw is due to incorrect handling of the IdP's HTTP response (CWE-303), enabling access before proper authentication completes. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), it requires no privileges or user interaction, impacts confidentiality only, and is strictly a data plane issue with no control plane exposure. No public exploit has been identified at time of analysis; only deployments using externalAuth with OAuth are affected.
Kerberos authentication service impersonation in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 lets an unauthenticated, suitably positioned network attacker impersonate trusted authentication infrastructure, potentially resulting in unauthorized access to or modification of protected data. Exploitation is conditional: it requires a deployment configured with Kerberos-backed password-based (external) authentication and an attacker holding a privileged on-path network position between the server and the Kerberos KDC, which is why CVSS rates attack complexity as high despite no required user interaction or prior authentication. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Digest mutual-authentication bypass in AsyncHttpClient (AHC) 3.0.12 allows a rogue or on-path peer to be accepted as the authenticated server: when a Digest challenge advertises qop="auth-int" as the only supported quality-of-protection, the client negotiates it but cannot compute the expected rspauth, treats that as unverifiable-but-nonfatal, and accepts a response whose rspauth value is invalid. The flaw is network-reachable, unauthenticated and requires no user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, 8.8), with the primary impact on integrity (VI:H) consistent with server impersonation rather than the data theft implied by the 'Information Disclosure' tag. It only affects applications that use AHC's Digest Realm with mutual authentication and connect to a peer offering an auth-int-only challenge; deployments where the server offers 'auth' or 'auth,auth-int' are unaffected because AHC prefers and verifies 'auth'. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-released patch is version 3.0.13.
Improper JWT/OAuth bearer-token validation in Apache Impala executors (versions 4.1.0 through 4.5.2) lets remote, unauthenticated attackers read resources exposed by an executor's internal webserver, because JWT signatures are never verified and any syntactically valid token is accepted. The exposure is conditional: it only applies where the executor webserver has been explicitly configured to accept JWT/OAuth bearer-token authentication, which is not the default, and the attacker must have network reachability to that webserver endpoint. EPSS is low (0.20%, ~9th percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the flaw is trivially exploitable once the non-default configuration is in place; the assessed impact is high confidentiality with limited integrity loss, and the vendor fix is Impala 4.5.3 or disabling JWT/OAuth on executors.
Authentication bypass in self-hosted Bitwarden Server versions 2025.6.0 through 2026.5.0 backed by Microsoft SQL Server allows a user with a provisionable SSO identity to obtain a victim-scoped access token. The stored procedure User_ReadBySsoUserOrganizationIdExternalId declares its @ExternalId parameter as NVARCHAR(50) while the column it queries stores NVARCHAR(300), so an identity-provider ExternalId whose value begins with a victim organization member's full 50-character identifier is silently truncated and matches that member's record during SSO login. Exploitation requires organization SSO login enabled on a SQL Server deployment plus knowledge or control of an IdP identifier sharing the victim's 50-character prefix (CVSS vector shows PR:L), making the attack targeted rather than broadly opportunistic; publicly available exploit code exists but there is no CISA KEV confirmation of active exploitation. The flaw is fixed in Bitwarden Server 2026.5.0, and despite the supplied 'Information Disclosure' tag its actual outcome is account takeover (CWE-303).
Local block-password bypass in Mitsubishi Electric GX Works3 and Motion Control Setting lets an attacker who can run the engineering software and modify part of its executable module in memory authenticate with an invalid block password, defeating the protection on control-program blocks and potentially exposing, altering, corrupting, or deleting PLC logic. The root cause is an incorrect implementation of the authentication algorithm (CWE-303), which means the password check can be subverted rather than being cryptographically sound. Exploitation is access-gated: it requires local access to an engineering workstation and the ability to manipulate the running process, with no remote or unauthenticated path, and no public exploit identified at time of analysis.
Crafted Bidirectional Forwarding Detection (BFD) control packets can force authenticated BFD sessions on Arista EOS to drop, which in turn triggers reconvergence in the routing protocols that monitor those sessions (BGP, OSPF, IS-IS, or static-route failover) and can disrupt or blackhole traffic. The root cause is CWE-303, an incorrect implementation of the authentication algorithm: a packet that should fail BFD authentication is mishandled and can terminate the session, and the published CVSS 4.0 vector scores this 9.2 with unauthenticated network access (PR:N, UI:N) and high subsequent-system availability impact. Exposure is limited to devices running EOS 4.33.0-4.33.8M, 4.34.0-4.34.7M, 4.35.0-4.35.5M, or 4.36.0-4.36.1F that have authenticated BFD sessions explicitly configured; there is no public exploit identified at time of analysis and no CISA KEV listing.
Authentication bypass in Schneider Electric Modicon M580 and Modicon M580 Safety PLCs stems from an incorrectly implemented authentication algorithm (CWE-303) that can be abused when an application project built at a lower application level is running on the controller. Remote attackers can compromise the confidentiality, integrity, and availability of the PLC, per the vendor's CVSS 4.0 base score of 9.2. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in Hitachi Energy MicroSCADA SYS600 allows any user with access to the engineering tools to elevate their privileges to Windows administrator on the underlying host machine, achieving full operating-system control. The flaw resides in the RBAC enforcement layer (CWE-303 - incorrect implementation of the authentication/authorization algorithm), meaning the mechanism that is supposed to constrain engineering-tool users to scoped permissions fails to enforce those boundaries against the Windows OS layer. Exploitation yields complete control of the host, directly threatening the availability, integrity, and confidentiality of the SCADA environment. No public exploit or CISA KEV listing has been identified at time of analysis.
Incorrect authentication-algorithm handling in Progress MOVEit Transfer's SFTP module allows a remote, authenticated low-privilege SFTP user to subvert the module's authentication logic, with assessed high confidentiality, integrity, and availability impact. Affected deployments are MOVEit Transfer before 2025.1.6 and 2026.0.0 through 2026.0.3; vendor-fixed builds are available. No public exploit was identified at time of analysis, and EPSS is low at 0.39% (32nd percentile).
Authentication bypass in F5 NGINX Ingress Controller allows unauthenticated remote attackers to access protected paths when an externalAuth policy delegating to an OAuth identity provider is configured. The flaw is due to incorrect handling of the IdP's HTTP response (CWE-303), enabling access before proper authentication completes. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), it requires no privileges or user interaction, impacts confidentiality only, and is strictly a data plane issue with no control plane exposure. No public exploit has been identified at time of analysis; only deployments using externalAuth with OAuth are affected.
Kerberos authentication service impersonation in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 lets an unauthenticated, suitably positioned network attacker impersonate trusted authentication infrastructure, potentially resulting in unauthorized access to or modification of protected data. Exploitation is conditional: it requires a deployment configured with Kerberos-backed password-based (external) authentication and an attacker holding a privileged on-path network position between the server and the Kerberos KDC, which is why CVSS rates attack complexity as high despite no required user interaction or prior authentication. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Digest mutual-authentication bypass in AsyncHttpClient (AHC) 3.0.12 allows a rogue or on-path peer to be accepted as the authenticated server: when a Digest challenge advertises qop="auth-int" as the only supported quality-of-protection, the client negotiates it but cannot compute the expected rspauth, treats that as unverifiable-but-nonfatal, and accepts a response whose rspauth value is invalid. The flaw is network-reachable, unauthenticated and requires no user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, 8.8), with the primary impact on integrity (VI:H) consistent with server impersonation rather than the data theft implied by the 'Information Disclosure' tag. It only affects applications that use AHC's Digest Realm with mutual authentication and connect to a peer offering an auth-int-only challenge; deployments where the server offers 'auth' or 'auth,auth-int' are unaffected because AHC prefers and verifies 'auth'. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor-released patch is version 3.0.13.
Improper JWT/OAuth bearer-token validation in Apache Impala executors (versions 4.1.0 through 4.5.2) lets remote, unauthenticated attackers read resources exposed by an executor's internal webserver, because JWT signatures are never verified and any syntactically valid token is accepted. The exposure is conditional: it only applies where the executor webserver has been explicitly configured to accept JWT/OAuth bearer-token authentication, which is not the default, and the attacker must have network reachability to that webserver endpoint. EPSS is low (0.20%, ~9th percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the flaw is trivially exploitable once the non-default configuration is in place; the assessed impact is high confidentiality with limited integrity loss, and the vendor fix is Impala 4.5.3 or disabling JWT/OAuth on executors.
Authentication bypass in self-hosted Bitwarden Server versions 2025.6.0 through 2026.5.0 backed by Microsoft SQL Server allows a user with a provisionable SSO identity to obtain a victim-scoped access token. The stored procedure User_ReadBySsoUserOrganizationIdExternalId declares its @ExternalId parameter as NVARCHAR(50) while the column it queries stores NVARCHAR(300), so an identity-provider ExternalId whose value begins with a victim organization member's full 50-character identifier is silently truncated and matches that member's record during SSO login. Exploitation requires organization SSO login enabled on a SQL Server deployment plus knowledge or control of an IdP identifier sharing the victim's 50-character prefix (CVSS vector shows PR:L), making the attack targeted rather than broadly opportunistic; publicly available exploit code exists but there is no CISA KEV confirmation of active exploitation. The flaw is fixed in Bitwarden Server 2026.5.0, and despite the supplied 'Information Disclosure' tag its actual outcome is account takeover (CWE-303).
Local block-password bypass in Mitsubishi Electric GX Works3 and Motion Control Setting lets an attacker who can run the engineering software and modify part of its executable module in memory authenticate with an invalid block password, defeating the protection on control-program blocks and potentially exposing, altering, corrupting, or deleting PLC logic. The root cause is an incorrect implementation of the authentication algorithm (CWE-303), which means the password check can be subverted rather than being cryptographically sound. Exploitation is access-gated: it requires local access to an engineering workstation and the ability to manipulate the running process, with no remote or unauthenticated path, and no public exploit identified at time of analysis.
Crafted Bidirectional Forwarding Detection (BFD) control packets can force authenticated BFD sessions on Arista EOS to drop, which in turn triggers reconvergence in the routing protocols that monitor those sessions (BGP, OSPF, IS-IS, or static-route failover) and can disrupt or blackhole traffic. The root cause is CWE-303, an incorrect implementation of the authentication algorithm: a packet that should fail BFD authentication is mishandled and can terminate the session, and the published CVSS 4.0 vector scores this 9.2 with unauthenticated network access (PR:N, UI:N) and high subsequent-system availability impact. Exposure is limited to devices running EOS 4.33.0-4.33.8M, 4.34.0-4.34.7M, 4.35.0-4.35.5M, or 4.36.0-4.36.1F that have authenticated BFD sessions explicitly configured; there is no public exploit identified at time of analysis and no CISA KEV listing.
Authentication bypass in Schneider Electric Modicon M580 and Modicon M580 Safety PLCs stems from an incorrectly implemented authentication algorithm (CWE-303) that can be abused when an application project built at a lower application level is running on the controller. Remote attackers can compromise the confidentiality, integrity, and availability of the PLC, per the vendor's CVSS 4.0 base score of 9.2. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in Hitachi Energy MicroSCADA SYS600 allows any user with access to the engineering tools to elevate their privileges to Windows administrator on the underlying host machine, achieving full operating-system control. The flaw resides in the RBAC enforcement layer (CWE-303 - incorrect implementation of the authentication/authorization algorithm), meaning the mechanism that is supposed to constrain engineering-tool users to scoped permissions fails to enforce those boundaries against the Windows OS layer. Exploitation yields complete control of the host, directly threatening the availability, integrity, and confidentiality of the SCADA environment. No public exploit or CISA KEV listing has been identified at time of analysis.