CyCognito Blog

• Research

Emerging Threat: (CVE-2026-41940) cPanel & WHM Authentication Bypass via CRLF Injection

A critical pre-authentication CRLF injection vulnerability in cPanel and WHM allows unauthenticated remote attackers to inject crafted lines into pre-auth session files and promote themselves to root, granting full administrative control

• Research

Emerging Threat: (CVE-2026-3844) WordPress Breeze Cache Plugin Unauthenticated File Upload

An unauthenticated arbitrary file upload vulnerability in the Breeze Cache plugin for WordPress allows attackers to drop a PHP webshell onto the server through the plugin’s Gravatar-fetching function, leading to remote code execution on affected sites.

• Research

Emerging Threat: (CVE-2026-3854) GitHub Enterprise Server RCE via Git Push Injection

A command injection vulnerability in GitHub Enterprise Server’s git push pipeline allows any authenticated user with repository push access to execute arbitrary commands on the underlying instance using a single crafted git push.

• Research

Emerging Threat: (CVE-2026-20147) Cisco ISE Remote Code Execution

A critical command injection flaw in Cisco ISE and ISE-PIC lets an authenticated administrator run arbitrary commands as root on the appliance.

• Research

Emerging Threat: (CVE-2026-40372) ASP.NET Core Privilege Escalation via Signature Bypass

A cryptographic signature verification flaw in ASP.NET Core’s Data Protection library lets an unauthenticated attacker forge authentication cookies and other protected payloads, allowing impersonation of privileged users on Linux-hosted applications running Microsoft.AspNetCore.DataProtection 10.0.0 through 10.0.6.

• Research

Emerging Threat: (CVE-2026-29145) Apache Tomcat Authentication Bypass

An authentication bypass vulnerability in Apache Tomcat and Tomcat Native can allow unauthorized access to CLIENT_CERT-protected resources when OCSP soft-fail is disabled, bypassing the mutual TLS access control that the certificate validation policy was intended to enforce.

• Research

Emerging Threat: (CVE-2026-23869) React Server Components Denial of Service

A denial of service vulnerability in React Server Components allows an unauthenticated remote attacker to send a specially crafted HTTP request that triggers excessive CPU consumption.

• Research

Emerging Threat: (CVE-2026-1281 & CVE-2026-1340) Ivanti EPMM Unauthenticated RCE via Code Injection

Two critical pre-authentication code injection flaws in Ivanti EMM, exploited as zero-days since before their disclosure.

• Research

Emerging Threat: (CVE-2026-34197) Apache ActiveMQ Remote Code Execution via Jolokia API

A remote code execution vulnerability in Apache ActiveMQ Classic’s Jolokia JMX-HTTP bridge allows an authenticated attacker to load a malicious Spring XML configuration and execute arbitrary commands.