Topic

CWE-78: news, advisories and analysis

9 articlesUpdated 17 Oct 2026

CyberSecureToday covers CWE-78 across 9 articles published between 17 Sep 2026 and 17 Oct 2026. The coverage includes 9 vulnerability advisories. 9 advisories are rated critical or high severity.

Stories on CWE-78 most often intersect with Command Injection, Cloud Security and Remote Code Execution, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Palo Alto Networks Patches Critical Command Injection Flaw CVE-2026-0313 in Cortex XSOAR Security Automation Engines”, was published 17 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSCritical
Palo Alto Networks Patches Critical Command Injection Flaw CVE-2026-0313 in Cortex XSOAR Security Automation Engines
Palo Alto Networks fixes a high-severity command injection flaw in Cortex XSOAR (CVE-2026-0313) that allows network actors to execute arbitrary operating system commands.
CST Editorial Desk17 Oct 20269 min read
ThreatsCloud & SaaSHigh
AWS Systems Manager (SSM) Agent OS Command Injection Flaw CVE-2026-87911 Patched
AWS resolves a high-severity OS command injection flaw in AWS Systems Manager Agent (CVE-2026-87911) affecting multi-step Run Command document execution.
CST Editorial Desk14 Oct 20268 min read
ThreatsIndustrial & OTCritical
Phoenix Contact FL SWITCH Managed Industrial Ethernet Devices Vulnerable to Remote Root Execution
CISA issues industrial advisory ICSA-26-285-01 for Phoenix Contact FL SWITCH managed industrial network switches resolving critical firmware RCE CVE-2026-48192.
Mei-Lin Chen7 Oct 20268 min read
ThreatsCloud & SaaSCritical
LlamaIndex Workflows & Tool Calling Arbitrary Command Execution Flaw CVE-2026-41905
GitHub Security Advisory documents an unauthenticated command injection defect in LlamaIndex Workflows agent tool calling pipelines.
Aisha Noor7 Oct 20268 min read
ThreatsIndustrial & OTCritical
Johnson Controls EasyIO FS32 Automation Servers Vulnerable to Unauthenticated OS Command Injection (CVE-2026-71452)
A critical OS command injection vulnerability in Johnson Controls EasyIO FS32 controllers allows network attackers to gain root access and hijack HVAC control logic.
Daniel Okafor2 Oct 20269 min read
ThreatsIndustrial & OTCritical
Anjvision Industrial Video Streaming Transcoders Compromised by Critical Unauthenticated Command Injection (CVE-2026-100291)
CISA advisory ICSA-26-272-05 exposes critical unauthenticated command injection and credential disclosure vulnerabilities across Anjvision streaming transcoders.
CST Editorial Desk1 Oct 20269 min read
ThreatsCloud & SaaSCritical
GitLab AI Gateway Prompt Execution Flaw Exposes Cloud Workspaces to Remote Code Execution (CVE-2026-90970)
A critical command injection flaw in GitLab AI Gateway allows remote attackers to break LLM agent sandboxes and execute code across enterprise cloud runners.
CST Editorial Desk1 Oct 202611 min read
ThreatsCloud & SaaSCritical
Deno Windows Runtime Argument Parsing Flaw Allows Arbitrary Command Injection in Child Processes (CVE-2026-103473)
A critical flaw in Deno on Windows allows attackers to inject OS commands via improperly escaped shell arguments in node:child_process APIs.
CST Editorial Desk1 Oct 202611 min read
ThreatsCloud & SaaSCritical
Fortinet FortiSandbox Critical OS Command Injection Flaws CVE-2026-25089 & CVE-2026-39808 in Active Exploitation
CISA adds Fortinet FortiSandbox vulnerabilities CVE-2026-25089 and CVE-2026-39808 (CVSS 9.8) to KEV following active attacks against enterprise security fabrics.
Daniel Okafor17 Sep 202613 min read