Actively Exploited Edge Appliances Dominate; Six KEV, Many Unpatched

Unauthenticated command execution in Citrix NetScaler ADC (before 14.1-73.37, before 13.1-64.23, and the corresponding FIPS and NDcPP builds) and NetScaler Gateway (before 14.1-73.37 and before 13.1-64.23) lets a network-reachable attacker with no credentials and no user interaction run arbitrary commands on the appliance. Both our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and the vendor's CVSS 4.0 score of 9.5 agree on high confidentiality, integrity, and availability impact, with the CVSS 4.0 AT:P flag indicating that a specific attack precondition must hold before the flawed input-validation path is reachable. No public exploit code has been identified at time of analysis, but this is a genuine top-priority vulnerability rather than a high-CVSS/low-real-risk case, because the only other barrier is having a vulnerable, network-exposed ADC or Gateway instance, and exposure is highest where the management or VPN virtual server is internet-facing.

Citrix NetScaler ADC and NetScaler Gateway deployments running builds prior to 14.1-73.37 or 13.1-64.23 (including the corresponding FIPS and NDcPP builds 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP) can be driven by an unauthenticated remote attacker to achieve remote code execution or cause a denial-of-service condition. Per the available CVSS 4.0 vector the attack is network-reachable with no privileges or user interaction required, but Attack Complexity is High, meaning the attacker must first satisfy a specific, non-default precondition or timing/state condition rather than issuing a single trivial request. The vendor assigns a 9.5 base score with high impact to both the vulnerable appliance and subsequent systems; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and the underlying weakness class was not disclosed (CWE: N/A).

Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory traversal with a malicious file upload to place and execute arbitrary scripts, resulting in full loss of confidentiality, integrity, and availability on the management server (vendor-assigned CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is network-exploitable with no authentication and no user interaction, so the decisive real-world factor is exposure: these servers are normally confined to internal administrative networks, and risk rises sharply if the affected upload endpoint is reachable from an untrusted network. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and affected version ranges are not enumerated in the available data.

Remote code execution affects F5 BIG-IP systems that terminate traffic on a virtual server configured with both an APM (Access Policy Manager) access policy and an OAuth profile, where crafted malicious traffic can trigger a heap-based buffer overflow in the data plane. The flaw is remotely reachable, unauthenticated and low complexity per the vendor's CVSS 4.0 base score of 9.3, and the independent assessment confirms full confidentiality, integrity and availability impact (C:H/I:H/A:H) with no control-plane exposure; Appliance mode does not mitigate it. Exploitability is sharply limited by configuration - instances without APM or without an OAuth profile bound to a virtual server are not affected - and no public exploit code was identified at time of analysis, though the combination of unauthenticated RCE and a widely deployed enterprise appliance makes prompt hotfix deployment the priority.

Unauthenticated remote attackers can reach privileged internal functionality on customer-hosted (on-prem) Arista VeloCloud Orchestrator deployments, potentially compromising the confidentiality, integrity, and availability of the orchestrator itself and the data it manages. The vulnerable code path is exposed pre-authentication (PR:N) with no user interaction required, though the vendor's CVSS 4.0 vector and our independent assessment both assign high attack complexity (AC:H), indicating exploitation depends on specific conditions or non-trivial request crafting rather than a single trivial call. Arista-managed Hosted and Dedicated VCO instances have already been patched and are not at risk; only customer-run on-prem VCO appliances remain exposed, and no public exploit code has been identified at time of analysis.

Unauthenticated remote attackers can manipulate WordPress core's get_page_template() page-template resolution so that it includes a chosen, readable local .php file residing outside the active theme directories; where the required server and active-theme preconditions are both satisfied, that include escalates to remote code execution. The issue carries a CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack complexity reflecting the need for a suitable readable PHP file and matching environment conditions rather than any authentication or user-interaction barrier. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; on hardened or non-matching configurations the impact degrades to local file inclusion and information disclosure.

OS command injection in the MediaWiki ExternalData extension before version 3.7 allows remote attackers to execute arbitrary operating-system commands on the wiki server. The flaw is reachable over the network with no authentication required per the CVSS vector (PR:N) and low attack complexity, and because the injected command runs in the web server's process context, the vendor's CVSS 4.0 score and our independent re-score both rate it at the maximum severity (10.0), extending impact to subsequent systems (S:C/C:H/I:H/A:H). Exploitation is conditional: the wiki must actually have ExternalData installed (it is an optional extension) and must have a program/command-executing external data source explicitly configured, and invocation may require page-edit rights on wikis that restrict editing; no public exploit code has been identified at time of analysis, but a vendor patch is available in ExternalData 3.7.

Unauthenticated remote code execution in Rejetto HFS2 (HTTP File Server) through version 2.4.0 lets an attacker execute arbitrary commands on the underlying host by hiding server-side template syntax inside the filename of a multipart file upload. The crafted filename closes the template quoting context and injects an exec macro, which bypasses the dispatcher's authorization check, so no credentials or user interaction are required (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 10.0). Publicly available exploit code exists and an advisory with a proof-of-concept walkthrough is referenced by VulnCheck, but no KEV entry was provided, so this is not confirmed as actively exploited; the practical limiting factor is whether the multipart upload endpoint is reachable from the attacker's network.