remote code execution
3 articles with this tag
Orkes Conductor CVE-2026-58138: unauthenticated OS command execution, with attack attempts observed (update to 3.30.2 or later)
CVE-2026-58138 is a flaw in Conductor, the open-source workflow engine from the conductor-oss project that the CVE record calls Orkes Conductor. In versions 3.21.21 up to but not including 3.30.2, a remote attacker can execute operating system commands without authentication by submitting a workflow definition containing JavaScript or Python expressions to the workflow API, because the script evaluators were not sandboxed. The CVE was published on June 30, 2026 with CVSS 9.8 (v3.1) and 9.3 (v4.0). The fix is in release 3.30.2 of June 3, whose notes describe it only as restricting the JavaScript engine further. A network security vendor reported in September that its intrusion prevention service blocked 1,290 attack attempts in one day and 6,696 in seven days. These are blocked attempts, not confirmed compromises. As of October 31 the CVE is not in CISA's KEV catalog and NVD has not analysed it (status Deferred). Our conclusion: if you run Conductor yourself, move to 3.30.2 or later now, keep its API off the internet, and if an affected version was reachable, review it as possibly compromised.
Plex2Shell: four Plex Media Server CVEs exploited in the wild (update to 1.43.3.10861 or later)
Plex2Shell is the name a security researcher gave to four flaws in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Plex says that chained together they let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. All four are fixed in 1.43.3.10861, released to everyone on August 4, 2026. On October 19 (UTC) Plex wrote that the flaws are being actively and widely exploited after a public proof of concept appeared on October 16, and that compromised servers have been used to run cryptocurrency miners and proxy software. CISA added all four to its Known Exploited Vulnerabilities (KEV) catalog on October 20, with due dates of October 23 and November 3. Each CVE on its own scores only 4.3 to 7.2 (CVSS v3.1). Our conclusion: if you run Plex Media Server, check that it is on 1.43.3.10861 or later today, stop exposing port 32400 directly unless you need remote access, and if an older version was reachable from the internet, follow Plex's compromise checks and rebuild if in doubt.
SharePoint Server CVE-2026-65660: code execution by a logged-in user, exploited (install the August 2026 updates)
CVE-2026-65660 is a code injection flaw in on-premises Microsoft SharePoint Server (Subscription Edition, 2019 and Enterprise 2016). Per Microsoft, an authenticated attacker with low-level access can send a specially crafted request to execute code on the server, with no user interaction. It is rated CVSS 8.8. The fix shipped in the August 11, 2026 security updates. Microsoft first published it as a spoofing flaw and changed it to remote code execution on August 27. On September 25 Microsoft added that it had reliable evidence of observed attacks, and CISA added it to the KEV catalog the same day with a due date of September 28. A security firm reported on September 24 that attack attempts on a honeypot combined this flaw with a separate issue, reported as fixed in June 2026, that lets the request arrive without a login on sites that allow anonymous viewing. Our conclusion: if you run SharePoint Server, confirm every server is at or above the fixed build, make sure the June 2026 updates are also installed, review anonymous access, and check servers that were behind on updates for signs of compromise.