Topic

CWE-287: news, advisories and analysis

20 articlesUpdated 17 Oct 2026

CyberSecureToday covers CWE-287 across 20 articles published between 17 Sep 2026 and 17 Oct 2026. The coverage includes 16 vulnerability advisories, 2 incident or breach reports and 1 analysis or guidance piece. 16 advisories are rated critical or high severity, and 3 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on CWE-287 most often intersect with Authentication Bypass, Cloud Security and Remote Code Execution, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Mage OSS Critical Authentication Bypass Flaw CVE-2026-111823 Exposes Enterprise ETL Data Pipelines to Remote Takeover”, was published 17 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSCritical
Mage OSS Critical Authentication Bypass Flaw CVE-2026-111823 Exposes Enterprise ETL Data Pipelines to Remote Takeover
A critical vulnerability in Mage OSS (CVE-2026-111823, CVSS 9.8) enables unauthenticated attackers to forge OAuth sessions and seize administrative control of cloud data pipelines.
CST Editorial Desk17 Oct 20269 min read
ThreatsCloud & SaaSHigh
Google Cloud Workload Identity Federation OIDC Token Bypass Flaw CVE-2026-19410 Remediated
Google Cloud updates authentication libraries for CVE-2026-19410 where improper audience validation allowed external OIDC tokens to impersonate IAM service accounts.
Aisha Noor14 Oct 20268 min read
ThreatsCloud & SaaSCritical
Ivanti Connect Secure SAML Bypass Opens Gateways to Pre-Auth Code Execution
Ivanti discloses critical vulnerability CVE-2026-104935 in Connect Secure and Policy Secure gateways allowing pre-auth SAML remote code execution.
Mei-Lin Chen14 Oct 20269 min read
ThreatsCloud & SaaSHigh
Azure Arc Connected Machine Agent Local Privilege Escalation Flaw CVE-2026-83711 Enables Host Compromise
Microsoft addresses a critical privilege escalation flaw in Azure Arc Connected Machine Agent (CVE-2026-83711) exposing Hybrid Instance Metadata Service tokens.
Aisha Noor13 Oct 20268 min read
ThreatsCloud & SaaSCritical
AWS IAM Identity Center Flaw Enables SCIM Bearer Token Bypass Across Enterprise Cloud Tenants
AWS resolves high-severity vulnerability CVE-2026-46210 in IAM Identity Center where cached SCIM bearer tokens allowed cross-directory role synchronization bypass.
CST Editorial Desk7 Oct 20268 min read
ThreatsIndustrial & OTCritical
Rockwell Automation FactoryTalk VantagePoint Critical Authentication Bypass Flaw Disclosed by CISA Advisory ICSA-26-280-01
CISA Advisory ICSA-26-280-01 details a critical authentication bypass in Rockwell Automation FactoryTalk VantagePoint manufacturing analytics servers.
Mei-Lin Chen7 Oct 20268 min read
NewsIndustrial & OT
Water Utility Discloses Nation-State Breach of SCADA Gateways in SEC Filing
SEC Form 8-K disclosure details a nation-state intrusion targeting municipal water SCADA gateways and programmable logic controllers.
Daniel Okafor6 Oct 20268 min read
ThreatsIndustrial & OTCritical
Johnson Controls EasyIO Neo Controllers Authentication Bypass Flaw CVE-2026-40112 Disclosed by CISA
CISA Advisory ICSA-26-274-05 details a critical authentication bypass flaw in Johnson Controls EasyIO Neo EC and CW series building automation controllers.
Mei-Lin Chen6 Oct 20268 min read
ThreatsCloud & SaaSCritical
Fleet Device Management API Flaw Allows Host Impersonation and MDM Hijacking
An authentication bypass in Fleet device APIs allows unauthenticated remote attackers to impersonate enrolled Apple devices and trigger MDM actions.
CST Editorial Desk1 Oct 202612 min read
Cyber AttackCloud & SaaS
SOGo Groupware Proxy Authentication Flaw Allows Unauthenticated Account Impersonation via WebObjects Header (CVE-2026-74864)
An authentication bypass in SOGo groupware allows remote attackers to impersonate any user without credentials by supplying an unsanitized x-webobjects-remote-user header.
CST Editorial Desk1 Oct 202611 min read
ThreatsBanking & FintechCritical
Apache WSS4J EncryptedHeader Child Confusion Allows Cryptographic Signature and Policy Bypass (CVE-2026-89238)
An element confusion flaw in Apache WSS4J allows attackers to substitute encrypted headers with unencrypted plaintext, bypassing WS-Security confidentiality policies.
Priya Raman1 Oct 202611 min read
ThreatsCloud & SaaSCritical
Zammad Enterprise Helpdesk Session Hijacking Vulnerability Leads to Unauthenticated Remote Code Execution (CVE-2026-102489)
An authentication bypass in Zammad helpdesk versions 6.3.0–6.5.4 allows remote attackers to hijack administrative sessions and achieve remote code execution.
Priya Raman1 Oct 202611 min read
ThreatsCloud & SaaSCritical
OpenBSD ldapd Asynchronous Response Race Allows Unauthorized Directory Session Hijacking (CVE-2026-103547)
A race condition in OpenBSD ldapd delegated authentication allows remote attackers to hijack directory sessions and impersonate arbitrary user identities.
CST Editorial Desk1 Oct 202611 min read
ThreatsCloud & SaaSCritical
Cisco Catalyst SD-WAN Manager Hex Encoding Flaw Exploited to Hijack Enterprise Routing (CVE-2026-76504)
A critical URL hex-encoding vulnerability in Cisco Catalyst SD-WAN Manager allows unauthenticated remote attackers to bypass authentication and hijack fabrics.
CST Editorial Desk29 Sep 20269 min read
Cyber AttackBanking & Fintech
Bitcoin Depot Discloses SEC Form 8-K Material Incident Following $3.6M Cryptocurrency Wallet Breach
Bitcoin Depot filed an SEC Form 8-K disclosing unauthorized access to IT systems and credential theft resulting in the exfiltration of 50.9 Bitcoin.
Daniel Okafor27 Sep 20268 min read
ThreatsIndustrial & OTCritical
Siemens SIMOVE Fleetmanager Flaws Enable Remote Trajectory Hijacking of Factory AGVs
Siemens fixes critical vulnerabilities in SIMOVE Fleetmanager and SIPLANT, preventing unauthenticated remote threat actors from altering autonomous factory AGV paths.
CST Editorial Desk25 Sep 202616 min read
ThreatsCloud & SaaSCritical
HPE Aruba EdgeConnect SD-WAN Orchestrator Authentication Bypass Flaw Enables Remote Network Gateway Hijack
HPE resolves critical flaw CVE-2026-38291 in Aruba EdgeConnect SD-WAN Orchestrator, allowing unauthenticated remote attackers to bypass auth and execute arbitrary code.
Aisha Noor25 Sep 202617 min read
InsightsCloud & SaaS
Model Context Protocol OAuth Passthrough Flaw Exposes Autonomous AI Tool Pipelines to Silent Impersonation
An architectural vulnerability in Model Context Protocol (MCP) OAuth token passthrough allows malicious tool servers to impersonate users and hijack enterprise APIs.
Priya Raman25 Sep 202618 min read
ThreatsCloud & SaaSCritical
Hacktron Uses Claude Opus 5 to Beat libheif ASLR, Infiltrate OpenAI Perimeter
Hacktron AI researchers demonstrate how Claude Opus 5 synthesized an ASLR-bypassing libheif exploit to breach OpenAI forum and pivot to internal repos.
CST Editorial Desk21 Sep 202614 min read
ThreatsCloud & SaaSCritical
SimpleHelp Remote Support Platform Critical Authentication Bypass CVE-2026-48558 in Active Attacks
CISA adds SimpleHelp remote support platform vulnerability CVE-2026-48558 (CVSS 9.8) to KEV catalog following active exploitation against enterprise networks.
Daniel Okafor17 Sep 202613 min read