Hírolvasó

A Meta tájékoztatása szerint mintegy 20 ezer Instagram-fiók eshetett áldozatul egy közelmúltbeli támadásnak, amely során a támadók egy mesterséges intelligenciával ellátott fiók-helyreállítási eszközt használtak ki.

Overview

Microsoft-signed UEFI bootloaders of the open-source shim project, primarily from version 0.9 and earlier, were identified as vulnerable to Secure Boot bypass. To mitigate this risk, the affected bootloaders will be added to the Microsoft UEFI Forbidden Signature Database (DBX). Once the DBX update is applied, these bootloaders will no longer be trusted for execution during the boot process.

An attacker could exploit these vulnerable shim bootloaders using a Bring Your Own Vulnerable Driver (BYOVD)-style technique to execute arbitrary code during the early boot phase, prior to operating system initialization, thereby bypassing Secure Boot protections.

Description

The Unified Extensible Firmware Interface (UEFI) standard defines the modern firmware architecture used to initialize hardware and transfer control to the operating system during system startup. On systems with Secure Boot enabled, UEFI applications and drivers must be cryptographically signed and verified before execution. Trust for these signatures is established through several firmware-managed databases, including the authorized signature database (DB), which commonly contains the "Microsoft Corporation UEFI CA 2011" certificate. This Microsoft certificate is widely used to sign third-party boot components intended to run under Secure Boot.

The open-source UEFI shim project is a small, signed bootloader that Microsoft signed using the "Microsoft Corporation UEFI CA 2011" certificate. Shim acts as a bridge between the motherboard's UEFI firmware and the operating system (typically a Linux distribution). Its purpose is to allow Linux distributions to boot with Secure Boot enabled without requiring every individual distribution's key to be built into the motherboard's NVRAM settings. In doing so, shim allows Linux distributions and other third parties to establish their own trust model through the use of Machine Owner Keys (MOKs), enabling additional bootloaders, kernels, and related components to execute within the Secure Boot chain. The shim project also introduced Secure Boot Advanced Targeting (SBAT), which provides a version-based revocation mechanism for boot components and simplifies future security updates and revocations.

Over time, multiple security vulnerabilities were identified and corrected in the upstream shim project. However, a number of vendors had previously forked or customized older versions of shim for their own products and boot environments. In many cases, these vendor-specific bootloaders were not updated after vulnerabilities in the upstream project became publicly known. As a result, vulnerable bootloaders remained signed and trusted by Secure Boot systems because they had not been revoked through the Microsoft-signed DBX revocation list. This created a long-term supply chain exposure in which outdated and vulnerable boot components could still be executed on fully patched systems.

Researchers from ESET identified multiple vulnerable shim bootloaders affected by these issues. The affected bootloaders will be added to Microsoft's official DBX revocation list as part of this coordinated disclosure.

Impacted shim bootloaders
[Vendor and Product Information
Authenticode SHA hash
SHA256 file hash
CVE ID]
Spyrus WTGCreator () from UEFI shim loader(0.7 (or lower)) AE75F0D82BA3DF824FBFC69340CC3B4D66C598373B1AB54CDB6C8BFD83A6B961 1D18DF4B15D3BC3DFFA1777A557075210DD0C53B CVE-2026-8863 RedHat RedHat Enterprise Linux (7.2) from UEFI shim loader(0.9) 7B2A3F5C96F95BD8086CE54B0825E300F9C8F11FE3401BB631B3215C8DE9EB10 3F24DD838C5C9E35B104FA2F3B74AC6A5BF92FD2 CVE pending from vendor RedHat CentOS (7.2) from UEFI shim loader(0.9) EB86FA1386FE6E4533B8B938DCC1250616D2F1C14C15E2FCF80834A161018A0A E133BE08E8AD17AC00E3C8ED215499C5F3C54E64 CVE pending from vendor baramundi baramundi Management Suite (up to 2024R1) from UEFI shim loader(0.8) FD23D6E57DE6F4E1F9D7118DA1C5F31A8AF6BE5E5D9E8170F9493447268D50C5 8637D7EFA23A8A5738F2E4AACB6C9919B405AA2C CVE-2026-8863 WhiteCanyon/Blancco WipeDrive (versions 8.0.0 through 8.1.3.) from UEFI shim loader(0.7) a0de9333442c1bf9349a460141ae5e80f911955c6506040fa3d021bf6c1ae3e4 8A402AFCD3C23D9253BBEA08576113C63E448AD0 CVE-2026-8863 Finland's Matriculation Examination Board Abitti 1 (1.0) from UEFI shim loader(0.8) 95B6D71FC0C0F8C5E1533A37AEF92CF6B0C961E2CC612A97117FA6759CE5FC06 8A83FA30DBF0073F33EAD298A7D5CD69A47C3A4B CVE-2026-8863 NTC IT ROSA, LLC ROSA Linux (R10, R9) from UEFI shim loader(0.9) 236A9CB0D71951C36398A32EB660CE2CD4A52CCFA7CF751CC6A35D9DE549E19B 8F9E8DB8E2C2157C2A591F2BE070FF96BFE318C7 CVE-2026-8863 Oracle America, Inc. OracleLinux (7.2) from UEFI shim loader(0.9) 5E594C448760A3135B1A3A83E07A4F2E6FBE49414EF2C7CAB1CBA77F284FA63B A16136899A12AD214FA4FBA60072BA72FBAB8BCA CVE-2026-8863 PC-Doctor, Inc. PC Doctor Service Center (15, 16) from UEFI shim loader(0.9) 8A964D5F8373948D20A1D4296FB92E545DAD4617A0C810F3B934B53D98AE8963 BC01320D8FF8343B348EF8F3C947A66EB8FD9CE2 CVE-2026-8863 OpenSuse OpenSuse Shim (10.1) from UEFI Shim loader (0.9) 410260B1B6F5AF5FBEEB9EA3220658435E876CB3247126EE907A437F312DB373 3CF8BEB1E2885F51CA04002425C4F3C796D105BC CVE not provided OpenSuse OpenSuse Shim (2.1) from UEFI Shim loader (0.9) 96275DFD6282A522B011177EE049296952AC794832091F937FBBF92869028629 6DB5266E80C9D51CDD54421E736DF2E6E6879A56 CVE not provided Impact

An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the operating system loads. Code executed during this early boot phase may achieve persistent compromise of the platform, including the ability to load unsigned or malicious kernel components that can survive system reboots and, in some cases, operating system reinstallation. Because this activity occurs before the operating system and many security products initialize, malicious code executed through this technique may evade detection by operating system security controls and Endpoint Detection and Response (EDR) solutions.

Solution Apply a Patch

Apply the latest software updates along with latest bootloader updates as provided by your hardware or software vendor. See the Vendor Information section for details. Updated software should replace any vulnerable shim bootloaders with versions that incorporate the latest upstream security fixes and SBAT protections. Additionally, Microsoft DBX updates should be applied to all UEFI-based systems to ensure that vulnerable bootloaders can no longer be executed during the Secure Boot process.

Recommendations for Enterprises and Developers

Because modifications to the DBX (Forbidden Signature Database) can affect system boot behavior, vendors and administrators should thoroughly test these updates before broad deployment to ensure systems remain bootable. When deploying Secure Boot updates, it is recommended the latest authorized signature database (DB) is updated before applying DBX revocations. In practice, this means updating trusted boot applications and certificates first, followed by deployment of the revocation list. Failure to follow this order may cause systems to reject newly updated boot components. Enterprises, virtualization providers, and cloud operators managing large-scale deployments should prioritize validation and deployment of these updates to prevent the execution of vulnerable or unsigned binaries during physical or virtual machine startup. Microsoft also provides DBX update files and related tooling through the following repository: SecureBoot Objects

Audit tools such as Check-UEFISecureBootVariables for Windows systems using PowerShell, and uefi-dbx-audit for Linux systems, can be used to help verify that current DBX updates have been applied to UEFI-based laptops, desktops, servers, and virtual machines with Secure Boot enabled. These tools can also assist enterprise administrators in identifying revoked or vulnerable boot components present on a system. Audit and verification capabilities may vary depending on platform firmware implementation and support for revocation mechanisms such as SBAT and the newer Microsoft-specific Secure Version Numbering (SVN) enforcement.

Acknowledgements

Thanks to Martin Smolar of ESET for researching and reporting this vulnerability. This document was written by Vijay Sarvepalli.

A WhatsApp (a Meta tulajdonában lévő üzenetküldő szolgáltatás) újabb jogi lépéseket tesz az NSO Group nevű kémprogramfejlesztő vállalat ellen, mivel állítása szerint a cég megsértette a korábbi bírósági végzést, és ismét célzott támadásokat indított a WhatsApp felhasználói ellen. A WhatsApp szerint az NSO Group úgynevezett célzott adathalász (spearfishing) támadásokat hajtott végre, amelyek során a felhasználókat […]

A ShinyHunters zsaroló csoport nyilvánosságra hozott több mint 230 gigabájtnyi adatot, amelyet állításuk szerint a fogászati ellátási juttatásokat kezelő DentaQuest rendszereiből szerzett meg. A DentaQuest a Sun Life leányvállalata, és az Egyesült Államok egyik legnagyobb fogászati ellátási juttatásokat kezelő szervezete. Szolgáltatásai az ország mind az 50 államára kiterjednek, és mintegy 35 millió ügyfelet szolgálnak ki. […]

Egy a valódi Bitcoin-tárcaként ismert BlueWallet nevével visszaélő, hamis weboldal a Mac-felhasználókat veszi célba. Maga a BlueWallet nem kompromittálódott, a kiberbűnözők csupán a legitim szolgáltatás nevét és arculati elemeit használják fel arra, hogy a rosszindulatú letöltés megbízhatónak tűnjön. Amennyiben valaki kriptovaluta-tárcát keresve erre a hamis letöltési oldalra tévedt, a webhely arra próbálta rávenni, hogy egy […]

Egy új ellátásilánc-támadás során az npm-csomagindexben 36 csomagot fertőztek meg az IronWorm nevű információlopó kártevővel.

Ammar Askar biztonsági kutató nyilvánosságra hozott egy súlyos, nulladik napi (zero-day) sérülékenységet kihasználó proof-of-concept (PoC) exploitot a Visual Studio Code környezethez kapcsolódó github.dev szolgáltatásban. A kutató a hibát jelezte a GitHub-nak, majd mindössze egy órával később publikálta a részleteket és a működőképes exploitot, megkerülve a sérülékenységek felelős közzétételének folyamatát. A sérülékenység a github.dev webes fejlesztői […]

Két maximális súlyosságú, nulladik napi sérülékenységet azonosítottak az Acer Wave 7 mesh router sorozatában, amelyek a T7c_GBL_1.01.000055 és korábbi firmware-verziókat érintik. Mindkét CVE CVSS v4.0 szerinti pontszáma 10.0/10, és mindkettő távolról, hitelesítés nélkül kihasználható. Az első sérülékenység, a CVE-2026-49200, amelynek a lényege, hogy az eszköz webes felületén az acer_cgi.log naplófájl autentikáció nélkül olvasható. Ez a […]

A Red Hat 32, széles körben használt fertőzött szoftvercsomagot távolított el, miután egy kompromittált GitHub-fiókon keresztül a Mini Shai-Hulud féreg módosított változata fejlesztői hitelesítő adatok ellopására és további ellátásilánc-támadások terjesztésére szolgáló kártevőt juttatott a nyílt forráskódú ökoszisztémába.

Az Anthropic által fejlesztett Claude Code mesterséges intelligencia alapú kódolási asszisztens GitHub Actionsbe integrált munkafolyamata kritikus biztonsági sérülékenységet tartalmazott, amelyet RyotaK, a GMO Flatt Security kutatója fedezett fel. A sebezhetőség nem csupán egyetlen szervezet vagy projekt kompromittálását tette lehetővé, hanem egy klasszikus ellátási lánc támadás keretei közt minden olyan downstream repositoryt veszélyeztetett, amely az Anthropic […]

A Minecraft-játékosokat célzó WeedHack malware-as-a-service (MaaS) modellben működő információlopó kártevő január óta aktív, terjesztéséhez pedig a játékhoz köthető rosszindulatú klienseket, segédprogramokat és különböző csalási módszereket használnak az elkövetők. A McAfee kiberbiztonsági cég adatai szerint a WeedHack közel 116 464 játékost érintett, ami átlagosan napi 2000 – 3000 fertőzést jelent. A legtöbb áldozatát az Egyesült Államokból, […]

A Google kiadta a 2026. júniusi Android biztonsági javítócsomagot, amelyben 124 sebezhetőség, köztük egy aktívan kihasznált nulladik napi sérülékenység is javításra került. Az Android Framework CVE-2025-48595 számú sebezhetőség kihasználása kódfuttatást és jogosultságeszkalációt tesz lehetővé a támadók számára az Android 14-es vagy újabb verziójú eszközökön. A Google elmondása szerint a hiba már a 2025. márciusi Android […]

Az FBI figyelmeztetést adott ki a 2026-os labdarúgó-világbajnokság közeledtével megjelenő, a FIFA hivatalos weboldalát megszemélyesítő adathalász kampányokkal kapcsolatban. A támadók célja a személyes és a pénzügyi adatok megszerzése, valamint hamis jegyek és VIP csomagok értékesítésén keresztül további pénzügyi csalások elkövetése. Az FBI tájékoztatása szerint a hamis domainek a hivatalos fifa.com oldalt utánozzák, gyakran minimális eltérésekkel, […]

Overview

Version 3.0.7 of the Securly Chrome Extension contains multiple vulnerabilities involving insecure data transmission, weak cryptography, and improper access control. These issues may expose sensitive filtering rules, enable the manipulation of downloaded configuration files, and allow unauthenticated access to protected resources. An attacker could exploit these weakness to steal configuration information, induce a Denial of Service (DoS), or modify content blocking rules for student users.

Description

The Securly Chrome Extension is a browser add-on commonly used in K–12 school-managed Chromebooks to enforce internet safety policies, filter or block websites, and provide activity monitoring for students. It is an element of the Securly classroom management platform, which helps schools comply with web filtering requirements and safely manage student online access.

CVE-2026-8874
Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch Internet Watch Foundation (IWF) and Children's Internet Protection Act (CIPA) data over HTTPS, demonstrating an inconsistent implementation of TLS.

CVE-2026-8876
The Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and intervention site data.

CVE-2026-8878
The Securly Chrome Extension exposes multiple publicly accessible endpoints that allow unauthenticated access to sensitive data. The exposed information consists of SHA-1 hashes that are inadequately obfuscated using a simple Caesar cipher, which can be easily reversed to recover the original hash values and access the protected data.

CVE-2026-8879
The Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scripting.registerContentScripts() at runtime. This script is NOT declared in manifest.json and bypasses Chrome Web Store static security review. It runs on all URLs and immediately hides all page content, creates a full-page overlay, pauses all videos, and only restores content when the service worker confirms the page passes filtering. If Securly's servers are unreachable, pages remain indefinitely hidden.

CVE-2026-8881
The Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration for AES encryption. MD5 has been broken since 2004 and a single iteration provides no key stretching. This weak derivation method significantly reduces the effective security of the encryption, making the protected data vulnerable to efficient offline cracking.

CVE-2026-8888
The Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without complexity validation. An on-path attacker can inject specific patterns to cause catastrophic backtracking, resulting in denial of service on all browsing.

CVE-2026-8889
The Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM URL matching (25,020 hashes) and CIPA blocklist matching (12,352 hashes).

Impact

These vulnerabilities collectively enable multiple attack paths and threaten the security and privacy of student users, for which the extension may be academically mandatory. The HTTP configuration downloads (CVE‑2026‑8874, CVE‑2026‑8888) and weak cryptographic primitives (CVE‑2026‑8876, CVE‑2026‑8881, CVE‑2026‑8889) allow a network‑adjacent attacker to intercept, modify, or decrypt data related to keyword filtering. The presence of unauthenticated, publicly accessible endpoints with trivially reversible obfuscation (CVE‑2026‑8878) further exposes internal keyword lists, blocklists, and rule definitions. These weaknesses enable the reconstruction and manipulation of the extension’s filtering logic. For student users, this could result in exposure to content that the filtering system is intended to block, or the inappropriate blocking of legitimate educational resources. Additionally, the undeclared, dynamically‑registered content script (CVE‑2026‑8879) can be abused to fully obscure web pages, leading to DoS conditions for end users.

Solution

Unfortunately, Securly could not be reached for coordination of these vulnerabilities. Until a patch is available, administrators can lower their potential exposure by restricting usage of the extension on untrusted or public networks, installing school-managed VPNs on the underlying devices, and monitoring for unexpected or abnormal filtering behavior.

Acknowledgements

Thanks to the reporter Santh for discovering and researching these vulnerabilities. This document was written by Molly Jaconski.

Kutatók nyilvánosságra hoztak egy több népszerű webszervert érintő HTTP/2-alapú támadási módszer részleteit, miután a sérülékenység javításai több szoftver esetében is elérhetővé váltak. A sérülékenység abból adódik, hogy számos szerver ugyan korlátozza a HTTP-fejlécek összesített méretét, de nem szab felső határt a fejlécmezők számára. A HTTP/2 sajátosságai miatt a cookie-k több kisebb részre – úgynevezett „cookie […]

A Signal hosszú ideje a biztonságos kommunikáció egyik etalonjának számít. Az alkalmazás végpontok közötti titkosítást használ, ezért sok újságíró, aktivista, vállalati vezető és biztonságtudatos felhasználó választja mindennapi kommunikációra. Azonban egy új adathalász kampány a felhasználókat veszi célba, hogy megszerezze a biztonsági mentések helyreállításához szükséges kulcsokat. A támadás SMS-ben érkezik, és a támadók a Signal ügyfélszolgálatának […]

Az elmúlt napokban több felhasználó is arról számolt be a Redditen és az X-en, hogy feltörték az Instagram fiókjukat. Az érintett fiókok között szerepel például az Obama adminisztráció ideje alatt használt Fehér Ház Instagram oldala, az Egyesült Államok Űrhadereje egyik magas rangú tisztjének, John Bentivegnának a fiókja, illetve Jane Wong biztonsági kutató is azt nyilatkozta, […]

Overview

VoLTE deployments on Verizon’s IMS network have historically lacked IPsec-based integrity protection for SIP signaling, contravening well-established requirements in 3GPP TS 33.203 and GSMA IR.92. As a result, SIP messages—including registration (REGISTER), call setup (INVITE), and messaging (MESSAGE)—were transmitted in plaintext without cryptographic guarantees of integrity or authenticity. Passive analysis of live traffic over multiple months confirmed the consistent absence of SIP Security Agreement headers and ESP traffic, indicating a systematic configuration decision rather than an isolated anomaly.

In response to repeated follow-up inquiries, Verizon stated on [insert date] that integrity support is “currently available at their request” and will be extended to all UEs “starting later this year.” Separately, the researchers recently observed that Apple’s iOS 26.5 carrier bundle (released May 11, 2026) includes IMS IPsec-related configuration entries—an indication that device-side support may now be active or enabled in newer software. While this change is promising, its real-world impact remains uncertain: there is no evidence yet that Verizon has modified its network to enforce IPsec, that the configuration is being activated per session, or that integrity is functionally operational in production deployments. Absent explicit verification (e.g., captured ESP traffic or official confirmation), this may reflect preparatory software changes rather than an end-to-end security upgrade.

The vulnerability remains active for the vast majority of Verizon VoLTE users during the unprotected period, and until network-level enforcement is observed and confirmed, the risk of on-path signaling manipulation endures.

Description

VU#615987.1
SIP signaling stack in Verizon IMS (unspecified version) implements SIP signaling without IPsec integrity protection (missing Security-Client/Security-Server headers and ESP traffic), which allows an on-path attacker to compromise confidentiality, integrity, and authenticity of VoLTE signaling via passive monitoring and active manipulation of unsecured SIP messages over the radio and core network.

According to 3GPP TS 33.203 and GSMA IR.92, SIP signaling between the UE and P-CSCF in IMS networks must be protected using IPsec ESP with mandatory integrity following IMS AKA authentication. This protection is negotiated via SIP Security Agreement headers (Security-Client, Security-Server, Security-Verify) during registration and results in integrity-protected ESP traffic for all subsequent signaling messages.

However, observations conducted over several weeks on Verizon’s network showed no such headers in use. The REGISTER exchange lacked any security negotiation, and post-registration SIP traffic—including INVITE, MESSAGE, BYE, and UPDATE—traversed the network in plaintext over standard UDP/TCP, with no ESP encapsulation. This pattern was consistent across device models and network conditions, indicating a systemic configuration decision rather than a transient issue. The absence of integrity checking means any modification to SIP messages—including redirection of emergency calls or injection of fake message payloads—would go undetected by both the UE and the IMS core.

No technical justification for this deviation from globally adopted security practices has been provided by Verizon, and prior engagement failed to elicit a substantive response beyond the recent, non-binding commitment to future deployment.

Impact

The lack of IPsec integrity protection enables on-path attackers—including those controlling femtocells, compromised base stations, or IMS intermediaries—to intercept, modify, replay, or inject SIP messages without detection. These capabilities permit call hijacking, spoofing of SMS-over-IMS, denial-of-service through forged BYE or CANCEL, and manipulation of emergency call routing—without requiring compromise of the UE, SIM, or backend infrastructure. Because SIP signaling lacks cryptographic integrity, all such modifications go unnoticed by both the UE and the IMS core, undermining core security assumptions of VoLTE. While the recently observed iOS 26.5 configuration change may signal progress toward a more secure implementation, its operational impact is yet to be demonstrated; until then, the risk remains real and unmitigated for users on unprotected deployments.

Solution

Until the vulnerability is fully mitigated by Verizon, users and enterprises should continue to assume VoLTE signaling is untrusted for high-assurance operations.

Acknowledgements

Thanks to DongWon Lee, Jeongmin Choi, and CheolJun Park from Kyung Hee University for their thorough technical report, persistent follow-up efforts, and the additional observation regarding iOS 26.5. Their work has significantly advanced the understanding of this issue and helped keep the discussion grounded in observable behavior.
This AI-assisted document was written by Timur Snoke.

Overview

A stored cross-site scripting (XSS) vulnerability has been discovered in Appsmith, specifically in the CodeMirror based SQL query editor’s autocomplete renderer. CVE-2026-7299 has been assigned to track the vulnerability. An attacker with developer level access to a shared PostgreSQL datasource can inject arbitrary JavaScript by creating malicious database objects whose names contain XSS payloads. Successful exploitation leads to arbitrary JavaScript execution in the browser of any workspace member who triggers SQL autocomplete, enabling session hijacking, privilege escalation, or credential theft. Version 2.1 of Appsmith fixes CVE-2026-7299.

Description

Appsmith is an open source, low code platform intended to allow developers to build internal tools, dashboards, and applications using a UI builder, database and API integrations, and JavaScript customization. Appsmith can also be deployable either self-hosted or via the cloud. A vulnerability, tracked as CVE-2026-7299, has been discovered, allowing for XSS within the SQL query editors autocomplete function.

The vulnerability description is below.

CVE-2026-7299
Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.

This vulnerability requires an account with developer access. A developer Appsmith account is an account designed to create, edit, and delete apps within a workspace they are assigned to. When an administrator opens the SQL editor and triggers autocomplete (e.g., by typing SELECT * FROM), the malicious table name executes their stored payload, which can allow for privesc.

Impact

Successful exploitation of CVE-2026-7299 leads to arbitrary code execution in the browser of any workspace member who triggers SQL autocomplete, enabling session hijacking, privilege escalation, or credential theft.

Solution

Version 2.1 of Appsmith fixes this vulnerability. Users should update their installations as soon as possible.

Acknowledgements

Thanks to the reporter, Stuart Beck. This document was written by Christopher Cullen.vrf26-04-DQBSN_exploit.py

Overview

The Collibra Platform Agent contains vulnerabilities that can be chained by a remote, unauthenticated attacker to achieve remote code execution. An attacker can exploit these issues by uploading a crafted ZIP archive that writes attacker-controlled files to arbitrary locations on the server once extracted, resulting in code execution.

Description

Collibra Platform (CP) and Collibra Platform Self-Hosted (CPSH), an enterprise grade, cloud-based platform designed to help organizations locate, understand, trust, and manage their data assets. The Collibra Agent of CP and CPSH that is installed on the host system is an independent service that listens on different port than the web interface and have the following vulnerabilities.

CVE-2026-10622 Privileged REST endpoints exposed under /rest/* do not properly enforce authentication or authorization. This allows a remote, unauthenticated attacker to interact with sensitive application functionality and gather information useful for further exploitation, including identifying suitable filesystem locations or application paths.
Additionally, the web services hosting the vulnerable REST endpoint was observed to bind to all available network interfaces regardless of the setting passed to the installer script. This behavior may increase exposure in deployments where administrators believe access is restricted to specific interfaces or trusted networks.

CVE-2026-10621 A Zip Slip vulnerability during extraction is exposed through POST /rest/restore and enables path traversal. When a ZIP archive is processed, file paths contained within the archive are not properly validated or canonicalized before extraction.
A remote attacker can supply a crafted ZIP archive containing directory traversal sequences, such as ../, to write files outside of the intended extraction directory. This may allow attackers to write custom files to arbitrary locations on the underlying host.
In an observed exploitation path, this arbitrary file write can be used to place a malicious JSP file into a web-accessible directory, enabling remote code execution when the file is subsequently requested over HTTP.

Impact

A remote, unauthenticated attacker can chain these vulnerabilities to achieve remote code execution on the affected system. An attacker who successfully exploits these issues may be able to:
- install a persistent web shell
- read, modify, or delete application data
- disrupt system availability
- potentially pivot further into surrounding environment
Because exploitation does not require authentication, deployments reachable across public internet may be at significant risk.

Solution

Collibra has released the following versions to address these vulnerabilities.

Collibra Plaform (SaaS):
2026.05
2026.04.5
2026.03.4
2026.02.6
2025.11.7
2025.10.9

Collibra Platform Self Hosted (on-prem):
2026.03 (Build 2026.03.356)
2025.10 (Build 2025.10.399)

Users are strongly encouraged to update to the fixed release as soon as possible. Refer to Collibra documentation and release notes for patching and deployment guidance.
Administrators should ensure that interfaces exposing REST endpoints are not exposed to untrusted networks and should restrict access to management interfaces wherever possible.

Acknowledgements

Thanks to the reporter who wishes to remain anonymous. This document was written by Michael Bragg.

VU#873170.2
Path traversal in restore handler in Collibra Agent, allows an attacker to write arbitrary files via a crafted ZIP archive. Collibra Agent fails to properly validate and canonicalize file path during ZIP extraction, this can allow an attacker to write files outside the intended extraction directory.

VU#873170.1
Improper Authentication in REST API in Collibra Agent, allows a remote unauthenticated attacker to access privileged functionality via exposed /rest/* endpoints.