Topic

CWE-306: news, advisories and analysis

9 articlesUpdated 18 Oct 2026

CyberSecureToday covers CWE-306 across 9 articles published between 17 Sep 2026 and 18 Oct 2026. The coverage includes 8 vulnerability advisories and 1 incident or breach report. 8 advisories are rated critical or high severity, and 1 involves a flaw listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on CWE-306 most often intersect with Authentication Bypass, SCADA and MCP, with Technology, Cloud & SaaS the most affected sector. The most recent story, “R3 Artifactory Takeover Exposes Corda Enterprise and Central Bank Digital Currency Supply Chain”, was published 18 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

Cyber AttackBanking & Fintech
R3 Artifactory Takeover Exposes Corda Enterprise and Central Bank Digital Currency Supply Chain
A critical default join key flaw in R3's JFrog Artifactory granted full administrative control over 269 repositories, including Corda Enterprise and CBDC builds.
Daniel Okafor18 Oct 202616 min read
ThreatsIndustrial & OTCritical
Emerson DeltaV Distributed Control System Workstation Vulnerability Permits Unauthenticated Command Execution
CISA and Emerson release urgent industrial advisory ICSA-26-283-02 for CVE-2026-46801, a critical authentication bypass in DeltaV DCS operator workstations.
Mei-Lin Chen7 Oct 20268 min read
ThreatsCloud & SaaSCritical
AWS Loom AI Agent Platform Flaw Gave Unauthenticated Attackers Super-Admin Control
CVE-2026-103956 in AWS Labs Loom (CVSS 10.0) let any network client act as super-admin on IdP-less deployments. Two SSRF flaws leaked tokens. Upgrade to 1.7.0+.
Aisha Noor4 Oct 20267 min read
ThreatsCloud & SaaSCritical
Kiteworks Email Protection Gateway Flaw Lets Unauthenticated Attackers Run Code as Root
Kiteworks fixed a CVSS 10 root code-execution flaw in Email Protection Gateway (CVE-2026-54154) and three 9.8 account takeovers. Upgrade EPG and Core to 9.5.1.
Daniel Okafor4 Oct 20266 min read
ThreatsCloud & SaaSCritical
Dell Container Storage Modules Flaws Expose Storage Admin Credentials Without Authentication
Dell DSA-2026-448 fixes two CVSS 10 missing-authentication flaws in Container Storage Modules that expose storage admin credentials. Upgrade CSM to 1.18.0.
Aisha Noor4 Oct 20265 min read
ThreatsCloud & SaaSCritical
Nginx UI Model Context Protocol Endpoint Missing Authentication Enables Unauthenticated RCE CVE-2026-33032
A critical CVSS 9.8 vulnerability in Nginx UI permits unauthenticated attackers to execute arbitrary commands via exposed Model Context Protocol endpoints.
Daniel Okafor28 Sep 20269 min read
ThreatsIndustrial & OTCritical
Siemens SIMATIC IoT2050 Advanced Flaw Enables Unauthenticated Remote Code Execution
CISA and Siemens warn of critical CVSS 9.8 flaw in SIMATIC IoT2050 Advanced (ICSA-26-237-03), enabling remote attackers to execute arbitrary code with root privileges.
Mei-Lin Chen25 Sep 202617 min read
ThreatsCloud & SaaSCritical
Azure AI Language Authentication Flaw Enables Unauthenticated Model Tampering
Microsoft mitigates maximum-severity CVSS 10.0 flaw CVE-2026-70352 in Azure AI Language Authoring, preventing unauthenticated remote tampering with enterprise AI models.
CST Editorial Desk24 Sep 202617 min read
ThreatsCloud & SaaSCritical
TrueConf Enterprise Server Authentication Bypass Flaw Weaponized to Access Communications
CISA mandates urgent remediation of TrueConf Server vulnerability CVE-2026-72529 (CVSS 9.8) exploited in the wild to bypass administrative access controls.
Priya Raman17 Sep 202612 min read