Actively Exploited Edge-Device Auth Bypasses Dominate Week; Most Lack Patches

Remote unauthenticated attackers can bypass authentication by spoofing in Ivanti Connect Secure versions before 25.1.3.0 and execute arbitrary commands with full system compromise. This vulnerability is confirmed actively exploited (CISA KEV) and publicly available exploit code exists. Ivanti Connect Secure 22.7R2.14 and prior are explicitly not affected, and the vendor-released patch is version 25.1.3.0 or later.

BeyondTrust Remote Support appliances contain an authentication bypass (CWE-290) in internal components that fail to validate the origin of received messages, potentially allowing an attacker to perform file operations on the appliance. According to the CVSS 4.0 vector (9.3), no authentication or user interaction is required, but the vendor notes exploitation is conditional ('under the right conditions') and the independent assessment emphasizes that an attacker must reach the internal messaging path and spoof a trusted source. No public exploit code or active exploitation has been identified at time of analysis, though this is a credible high-priority issue given the high impact.

Unauthenticated remote code execution in Cisco Secure Email Gateway allows attackers to write arbitrary files and execute commands as root by sending a crafted email attachment when the AMP file reputation service is enabled. The flaw, a relative path traversal (CWE-23) in attachment handling, requires no authentication or user interaction, but only gateways with file reputation active are vulnerable. No public exploit or active exploitation has been identified at time of analysis, though the critical CVSS score of 9.8 and the configuration prerequisite make it a priority for defenders to inventory exposed appliances.

Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then execute arbitrary commands, yielding high impact to confidentiality, integrity, and availability. The attack is network-reachable with low complexity but requires victim interaction (CVSS UI:R) - the target must open or interact with attacker-supplied content such as a crafted file, shortcut, or link - which is why SSVC rates it non-automatable while still flagging total technical impact. The flaw affects Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, plus Outlook.com, and is confirmed actively exploited (CISA KEV); given the KEV listing and the assessed high-end impact, this is a genuine top-tier patching priority rather than a high-CVSS-but-low-risk case.

Authenticated attackers holding high-privilege administrative access to the PAN-OS management interface can execute arbitrary code with root privileges on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). The underlying weakness is a code-injection flaw (CWE-94) in the management plane that is network-reachable with low attack complexity, but the realistic attacker population is narrow because CVSS PR:H requires the adversary to already possess an authenticated high-privilege session, and Palo Alto's recommended practice of limiting management access to trusted internal IP addresses largely neutralizes the exposure. Cloud NGFW and Prisma Access are explicitly not impacted, and no CISA KEV entry or public exploit code is identified in the available data at time of analysis.

Remote code execution in GitLab CE/EE (all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2) allows an unauthenticated attacker to execute arbitrary code on the GitLab server by supplying a specially crafted regular expression in a CI/CD configuration that passes insufficient regex validation; the defect is tracked as CWE-190 (integer overflow) and the vendor scores it 10.0 with scope change (S:C). Publicly available exploit code exists, referenced through HackerOne reports cited in the CVE record, but there is no CISA KEV entry and no confirmed active exploitation at time of analysis. Our independent assessment retains the same impact (C:H/I:H/A:H) but raises attack complexity to AC:H, because the vendor states the regex-validation path is reached by an unauthenticated user only 'under certain conditions' that are not detailed publicly and should be confirmed with GitLab; patched instances (19.4.2, 19.3.5, 19.2.8 or later) are not affected.

OS command injection in Netgate pfSense CE 2.7.0 through 2.9.0 allows an authenticated web-interface user who holds the QinQ edit privilege to execute arbitrary commands as root. The attacker saves a crafted parent interface ('if') value and then re-edits the QinQ entry, causing that unvalidated value to be interpolated into an ifconfig shell command; publicly available exploit code exists, and no confirmed active exploitation (CISA KEV) has been reported. The principal constraint is the high privilege requirement - only operators already trusted with interface configuration can reach the vulnerable code path - and risk is further reduced where the management UI is not exposed to untrusted networks or lower-privileged users.

Remote code execution in AnyDesk before 8.0.3 allows unauthenticated attackers to execute arbitrary code as root on Linux by sending a specially crafted packet to the session protocol's stream packet handler for mode 5. The victim does not need to approve desktop control, and publicly available exploit code exists. This is a critical heap-based buffer overflow (CWE-130) with a CVSS score of 9.8, though the assessed root-level impact is specifically demonstrated on Linux and other platforms are not confirmed.