A zero-day vulnerability (CVE-2026-0322) in Palo Alto Networks PAN-OS has been exploited for remote code execution. The flaw affects the management interface of PAN-OS on PA-Series, VM-Series firewalls, and Panorama, allowing an authenticated attacker with network access to execute arbitrary code with root privileges. Palo Alto Networks has released patches and indicators of compromise (IoCs) related to limited observed exploitation. CISA has added this vulnerability to its KEV catalog, urging federal agencies to address it promptly.
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.
Security Fix(es):
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198)
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197)
* FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)
* freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)
* freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)
* ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)
* ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)
* freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)
Bug Fix(es) and Enhancement(s):
* Fix ipatests for kdcproxy after CVE-2025-59088 fix [rhel-8.10.z] (JIRA:RHEL-129966)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A buffer overflow vulnerability exists in the SODOLA SL902-SWTGW124AS firmware versions up to 200.2.12. This flaw allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Exploitation targets the embedded HTTP server's multipart/form-data boundary parser, causing the device to become unresponsive and lose management access and traffic forwarding during recovery.
ELADMIN version 2.7 and earlier has an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd. This endpoint lacks proper authorization checks, allowing any authenticated user to reset passwords of arbitrary users, including the built-in administrator account. The vulnerability arises because the method does not enforce role-level or ownership validation.
XXL-JOB versions 3.5.0-SNAPSHOT and earlier have a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller. The affected endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP methods, allowing unauthorized actions via CSRF attacks.
CVE-2026-107795 is a high-severity vulnerability in TP-Link Omada Software Controller versions prior to 6.3.0.45. It involves missing authorization checks in the MSP and OpenAPI certificate/private-key management APIs, allowing authenticated users with low privileges to perform privileged certificate management operations. Exploitation could enable such users to upload or delete TLS certificates or private keys, potentially disrupting secure management access.
CVE-2026-0316 is a stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software affecting PA-Series, VM-Series firewalls, and Panorama (virtual and M-Series). It allows a malicious authenticated administrator to store or execute JavaScript payloads via the web interface. The vulnerability does not affect Cloud NGFW or Prisma Access. The risk is reduced if management interfaces are restricted to trusted internal IPs. The CVSS score is low (1.1).
CVE-2026-0317 is a low-severity denial of service (DoS) vulnerability in Palo Alto Networks PAN-OS software affecting certain versions. An authenticated user with a read-only administrator role can cause a DoS by sending a specially crafted API request. The risk is mitigated by restricting management web interface access to trusted internal IP addresses. Cloud NGFW, Panorama, and Prisma Access are not affected by this issue.
CVE-2026-0320 is a command injection vulnerability in Palo Alto Networks PAN-OS software affecting PA-Series and VM-Series firewalls and Panorama devices. An authenticated administrator with access to the management interface can execute arbitrary commands as root. The vulnerability does not affect Cloud NGFW or Prisma Access. Restricting management interface access to trusted internal IP addresses significantly reduces risk. The CVSS 4.0 score is 6.1 (medium severity).
Plane, an open-source project management tool, prior to version 1.4.0, contains an authorization bypass vulnerability allowing members of one project to read description_html of public pages in other projects within the same workspace. This issue affects the PageVersionEndpoint, which scopes lookups by workspace and page but not by project_id, enabling unauthorized read access. The vulnerability is read-only and does not allow modification of pages. It is fixed in version 1.4.0.
Plane, an open-source project management tool, has a missing authorization vulnerability in versions 1.3.1 and earlier. The flaw allows project guests or members to modify the is_active status of other project members, including administrators, by bypassing proper authorization checks. Additionally, members can overwrite preferences of other members due to insufficient object-level authorization. This vulnerability is fixed in version 1.4.0.
Plane, an open-source project management tool, has an authorization bypass vulnerability in versions 1.3.1 and earlier. The public project asset endpoint /api/public/assets/v2/anchor/{anchor} allows authenticated users to perform write operations without verifying workspace or project membership. This enables unauthorized creation and soft-deletion of FileAsset records across projects, potentially causing cross-workspace file injection, storage abuse, and data loss. The issue is fixed in version 1.4.0.
CVE-2026-0322 is a remote code execution vulnerability in the management interface of Palo Alto Networks PAN-OS software. It allows an authenticated attacker with network access to execute arbitrary code with root privileges on affected firewalls. The vulnerability affects PAN-OS on PA-Series and VM-Series firewalls and Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not impacted. The risk is mitigated by restricting management interface access to trusted internal IP addresses as recommended by Palo Alto Networks.