Wapt Server
Monthly
Authentication bypass in Tranquil IT Wapt Server before 2.6.1.17813 lets a remote unauthenticated attacker send a specially crafted packet to obtain a valid session token for a targeted account, yielding full account takeover of the endpoint-deployment console. Because Wapt Server orchestrates software installation across managed endpoints, a stolen operator/admin session effectively grants control over the fleet it manages. Rated CVSS 4.0 10.0 with subsequent-system impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in Tranquil IT Wapt Server before 2.6.1.17813 lets a remote unauthenticated attacker send a specially crafted packet to obtain a valid session token for a targeted account, yielding full account takeover of the endpoint-deployment console. Because Wapt Server orchestrates software installation across managed endpoints, a stolen operator/admin session effectively grants control over the fleet it manages. Rated CVSS 4.0 10.0 with subsequent-system impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.