privilege escalation
2 articles with this tag
CVE-2026-123218 — IBM Aspera Faspex 5 authorization bypass lets an attacker gain administrator privileges: explainer and fix (fixed in 5.0.19 PL1, listed in KEV)
Incorrect authorization (CWE-863) in IBM Aspera Faspex 5.0.0 through 5.0.19. IBM's bulletin says a crafted message can bypass authorization and give full administrator privileges. Fixed in 5.0.19 PL1; IBM lists no workaround. IBM's CVSS is 9.8 (no privileges required), but CISA's KEV description says an authenticated user, so the preconditions are described inconsistently. Added to KEV on 9 November (due 12 November). This site's view: whichever description is right, patch affected versions first, then review administrator accounts and configuration changes.
CVE-2026-71362 — Unauthenticated privilege escalation in Adobe Commerce and Magento (explainer and fix)
Incorrect authorization in Adobe Commerce / Magento Open Source (CWE-863, CVSS 9.1, no authentication). The fixed '2026-aug' releases have been out since 11 August, but CISA confirmed exploitation and added it to KEV on 24 September. This site's view: stores that deferred it because the bulletin said 'priority 2, no known exploits' are the most exposed. Patching is step one; checking whether you were entered while unpatched is part of the job.